asyncrat | 6b21c5b53198967f49dda5d8b79e06bfd1ac72ca4c362bbdbc7a58cf2a5de9af

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\Control Panel\International\Geo\Nation	OTPBOT.exe
Key value queried	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\Control Panel\International\Geo\Nation	._cache_OTPBOT.exe
Key value queried	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\Control Panel\International\Geo\Nation	Synaptics.exe
Key value queried	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\Control Panel\International\Geo\Nation	NOBLOCKTM.exe
Key value queried	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\Control Panel\International\Geo\Nation	._cache_Synaptics.exe
Key value queried	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\Control Panel\International\Geo\Nation	._cache_NOBLOCKTM.exe

Executes dropped EXE 8 IoCs

pid	Process
2336	._cache_OTPBOT.exe
1932	Synaptics.exe
2468	OTP_BOT.exe
628	NOBLOCKTM.exe
1700	OTP_BOT.exe
64	._cache_Synaptics.exe
4932	._cache_NOBLOCKTM.exe
4516	steam.exe

Loads dropped DLL 20 IoCs

pid	Process
1700	OTP_BOT.exe
1700	OTP_BOT.exe
1700	OTP_BOT.exe
1700	OTP_BOT.exe
1700	OTP_BOT.exe
1700	OTP_BOT.exe
1700	OTP_BOT.exe
1700	OTP_BOT.exe
1700	OTP_BOT.exe
1700	OTP_BOT.exe
1700	OTP_BOT.exe
1700	OTP_BOT.exe
1700	OTP_BOT.exe
1700	OTP_BOT.exe
1700	OTP_BOT.exe
1700	OTP_BOT.exe
1700	OTP_BOT.exe
1700	OTP_BOT.exe
1700	OTP_BOT.exe
1700	OTP_BOT.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe"	OTPBOT.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
420	powershell.exe
1112	powershell.exe

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
behavioral2/files/0x0007000000023414-185.dat	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
1868	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	OTPBOT.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	Synaptics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	NOBLOCKTM.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
4268	schtasks.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4368	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1112	powershell.exe
1112	powershell.exe
420	powershell.exe
420	powershell.exe
420	powershell.exe
4932	._cache_NOBLOCKTM.exe
4932	._cache_NOBLOCKTM.exe
4932	._cache_NOBLOCKTM.exe
4932	._cache_NOBLOCKTM.exe
4932	._cache_NOBLOCKTM.exe
4932	._cache_NOBLOCKTM.exe
4932	._cache_NOBLOCKTM.exe
4932	._cache_NOBLOCKTM.exe
4932	._cache_NOBLOCKTM.exe
4932	._cache_NOBLOCKTM.exe
4932	._cache_NOBLOCKTM.exe
4932	._cache_NOBLOCKTM.exe
4932	._cache_NOBLOCKTM.exe
4932	._cache_NOBLOCKTM.exe
4932	._cache_NOBLOCKTM.exe
4932	._cache_NOBLOCKTM.exe
4932	._cache_NOBLOCKTM.exe
4932	._cache_NOBLOCKTM.exe
4932	._cache_NOBLOCKTM.exe
4932	._cache_NOBLOCKTM.exe
4932	._cache_NOBLOCKTM.exe
4932	._cache_NOBLOCKTM.exe
4932	._cache_NOBLOCKTM.exe
4932	._cache_NOBLOCKTM.exe
4932	._cache_NOBLOCKTM.exe
4932	._cache_NOBLOCKTM.exe
4932	._cache_NOBLOCKTM.exe
4932	._cache_NOBLOCKTM.exe
4516	steam.exe
4516	steam.exe
4516	steam.exe
4516	steam.exe
4516	steam.exe
4516	steam.exe
4516	steam.exe
4516	steam.exe
4516	steam.exe
4516	steam.exe
4516	steam.exe
4516	steam.exe
4516	steam.exe
4516	steam.exe
4516	steam.exe
4516	steam.exe
4516	steam.exe
4516	steam.exe
4516	steam.exe
4516	steam.exe
4516	steam.exe
4516	steam.exe
4516	steam.exe
4516	steam.exe
4516	steam.exe
4516	steam.exe
4516	steam.exe
4516	steam.exe
4516	steam.exe
4516	steam.exe
4516	steam.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1112	powershell.exe
Token: SeDebugPrivilege	4932	._cache_NOBLOCKTM.exe
Token: SeDebugPrivilege	420	powershell.exe
Token: SeDebugPrivilege	4516	steam.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
4368	EXCEL.EXE
4368	EXCEL.EXE
4368	EXCEL.EXE
4368	EXCEL.EXE
4368	EXCEL.EXE
4368	EXCEL.EXE
4516	steam.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 4592 wrote to memory of 2336	4592	OTPBOT.exe	87
PID 4592 wrote to memory of 2336	4592	OTPBOT.exe	87
PID 4592 wrote to memory of 1932	4592	OTPBOT.exe	88
PID 4592 wrote to memory of 1932	4592	OTPBOT.exe	88
PID 4592 wrote to memory of 1932	4592	OTPBOT.exe	88
PID 2336 wrote to memory of 1112	2336	._cache_OTPBOT.exe	116
PID 2336 wrote to memory of 1112	2336	._cache_OTPBOT.exe	116
PID 2336 wrote to memory of 2468	2336	._cache_OTPBOT.exe	91
PID 2336 wrote to memory of 2468	2336	._cache_OTPBOT.exe	91
PID 2336 wrote to memory of 628	2336	._cache_OTPBOT.exe	93
PID 2336 wrote to memory of 628	2336	._cache_OTPBOT.exe	93
PID 2336 wrote to memory of 628	2336	._cache_OTPBOT.exe	93
PID 2468 wrote to memory of 1700	2468	OTP_BOT.exe	94
PID 2468 wrote to memory of 1700	2468	OTP_BOT.exe	94
PID 1932 wrote to memory of 64	1932	Synaptics.exe	95
PID 1932 wrote to memory of 64	1932	Synaptics.exe	95
PID 1700 wrote to memory of 4620	1700	OTP_BOT.exe	97
PID 1700 wrote to memory of 4620	1700	OTP_BOT.exe	97
PID 628 wrote to memory of 4932	628	NOBLOCKTM.exe	98
PID 628 wrote to memory of 4932	628	NOBLOCKTM.exe	98
PID 1700 wrote to memory of 2144	1700	OTP_BOT.exe	101
PID 1700 wrote to memory of 2144	1700	OTP_BOT.exe	101
PID 2144 wrote to memory of 3904	2144	cmd.exe	103
PID 2144 wrote to memory of 3904	2144	cmd.exe	103
PID 64 wrote to memory of 420	64	._cache_Synaptics.exe	104
PID 64 wrote to memory of 420	64	._cache_Synaptics.exe	104
PID 1700 wrote to memory of 1472	1700	OTP_BOT.exe	109
PID 1700 wrote to memory of 1472	1700	OTP_BOT.exe	109
PID 1472 wrote to memory of 1656	1472	cmd.exe	111
PID 1472 wrote to memory of 1656	1472	cmd.exe	111
PID 1700 wrote to memory of 2920	1700	OTP_BOT.exe	112
PID 1700 wrote to memory of 2920	1700	OTP_BOT.exe	112
PID 4932 wrote to memory of 1112	4932	._cache_NOBLOCKTM.exe	116
PID 4932 wrote to memory of 1112	4932	._cache_NOBLOCKTM.exe	116
PID 4932 wrote to memory of 4944	4932	._cache_NOBLOCKTM.exe	118
PID 4932 wrote to memory of 4944	4932	._cache_NOBLOCKTM.exe	118
PID 1112 wrote to memory of 4268	1112	cmd.exe	120
PID 1112 wrote to memory of 4268	1112	cmd.exe	120
PID 4944 wrote to memory of 1868	4944	cmd.exe	121
PID 4944 wrote to memory of 1868	4944	cmd.exe	121
PID 4944 wrote to memory of 4516	4944	cmd.exe	124
PID 4944 wrote to memory of 4516	4944	cmd.exe	124

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\OTPBOT.exe
"C:\Users\Admin\AppData\Local\Temp\OTPBOT.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4592
- C:\Users\Admin\AppData\Local\Temp\._cache_OTPBOT.exe
  "C:\Users\Admin\AppData\Local\Temp\._cache_OTPBOT.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2336
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAG0AcgB4ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHcAeQB6ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAG4AbQBtACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAHYAYgBhACMAPgA="
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1112
- - C:\Users\Admin\AppData\Local\Temp\OTP_BOT.exe
    "C:\Users\Admin\AppData\Local\Temp\OTP_BOT.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2468
  - - C:\Users\Admin\AppData\Local\Temp\OTP_BOT.exe
      "C:\Users\Admin\AppData\Local\Temp\OTP_BOT.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:1700
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:4620
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c mode con: cols=60 lines=20
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2144
      - C:\Windows\system32\mode.com
        
        mode con: cols=60 lines=20
        6⤵
        
        PID:3904
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c title OTP BOT | By lcm_2080
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1472
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" title OTP BOT "
        6⤵
        
        PID:1656
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c cls
        5⤵
        
        PID:2920
- - C:\Users\Admin\AppData\Local\Temp\NOBLOCKTM.exe
    "C:\Users\Admin\AppData\Local\Temp\NOBLOCKTM.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:628
  - - C:\Users\Admin\AppData\Local\Temp\._cache_NOBLOCKTM.exe
      "C:\Users\Admin\AppData\Local\Temp\._cache_NOBLOCKTM.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4932
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "steam" /tr '"C:\Users\Admin\AppData\Roaming\steam.exe"' & exit
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1112
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "steam" /tr '"C:\Users\Admin\AppData\Roaming\steam.exe"'
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4268
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp9DD6.tmp.bat""
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4944
      - C:\Windows\system32\timeout.exe
        
        timeout 3
        6⤵
        Delays execution with timeout.exe
        
        PID:1868
      - C:\Users\Admin\AppData\Roaming\steam.exe
        
        "C:\Users\Admin\AppData\Roaming\steam.exe"
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:4516
- C:\ProgramData\Synaptics\Synaptics.exe
  "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1932
- - C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
    "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:64
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAG0AcgB4ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHcAeQB6ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAG4AbQBtACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAHYAYgBhACMAPgA="
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:420

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4368

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

System Information Discovery