asyncrat | a917ead806f9c411e83a99d5c7a81754981b540988184cfad4587e2a67bb75b5

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
24-07-2024 13:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Server.exe
Size

63KB
MD5

810261a5b04d3355cd3b9a368bbbf8fa
SHA1

32a90b6674258268b65dc98c8aba74b6ac4cf06f
SHA256

a917ead806f9c411e83a99d5c7a81754981b540988184cfad4587e2a67bb75b5
SHA512

0c81ac8f2a482fd31fd216ec91879c6296bf24e81496ca54c553f5414339fe55d1d7aef706c6b017c05aff927110c22994210c6fa07b9418e0bd1d9038914ec5
SSDEEP

1536:ihODHQtSfGaf2eeiIVUGbbDwDGiDpqKmY7:ihODHQtSzfveQGbbDkgz

Score

10^/10

asyncrat venom clients rat

Malware Config

Extracted

Family

asyncrat

Version

5.0.5

Botnet

Venom Clients

final-consequently.gl.at.ply.gg:10334

Mutex

Venom_RAT_HVNC_Mutex_Venom RAT_HVNC

Attributes

delay
1
install
true
install_file
Test.exe
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral2/files/0x0002000000022aaf-11.dat	family_asyncrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\Control Panel\International\Geo\Nation	Server.exe

Executes dropped EXE 1 IoCs

pid	Process
3056	Test.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
4632	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1772	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4860	Server.exe
4860	Server.exe
4860	Server.exe
4860	Server.exe
4860	Server.exe
4860	Server.exe
4860	Server.exe
4860	Server.exe
4860	Server.exe
4860	Server.exe
4860	Server.exe
4860	Server.exe
4860	Server.exe
4860	Server.exe
4860	Server.exe
4860	Server.exe
4860	Server.exe
4860	Server.exe
4860	Server.exe
4860	Server.exe
4860	Server.exe
4860	Server.exe
4860	Server.exe
4860	Server.exe
4860	Server.exe
4860	Server.exe
4860	Server.exe
4860	Server.exe
4860	Server.exe
4860	Server.exe
4860	Server.exe
4860	Server.exe
3056	Test.exe
3056	Test.exe
3056	Test.exe
3056	Test.exe
3056	Test.exe
3056	Test.exe
3056	Test.exe
3056	Test.exe
3056	Test.exe
3056	Test.exe
3056	Test.exe
3056	Test.exe
3056	Test.exe
3056	Test.exe
3056	Test.exe
3056	Test.exe
3056	Test.exe
3056	Test.exe
3056	Test.exe
3056	Test.exe
3056	Test.exe
3056	Test.exe
3056	Test.exe
3056	Test.exe
3056	Test.exe
3056	Test.exe
3056	Test.exe
3056	Test.exe
3056	Test.exe
3056	Test.exe
3056	Test.exe
3056	Test.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4860	Server.exe
Token: SeDebugPrivilege	4860	Server.exe
Token: SeDebugPrivilege	3056	Test.exe
Token: SeDebugPrivilege	3056	Test.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4860 wrote to memory of 3996	4860	Server.exe	88
PID 4860 wrote to memory of 3996	4860	Server.exe	88
PID 4860 wrote to memory of 3532	4860	Server.exe	90
PID 4860 wrote to memory of 3532	4860	Server.exe	90
PID 3996 wrote to memory of 1772	3996	cmd.exe	92
PID 3996 wrote to memory of 1772	3996	cmd.exe	92
PID 3532 wrote to memory of 4632	3532	cmd.exe	93
PID 3532 wrote to memory of 4632	3532	cmd.exe	93
PID 3532 wrote to memory of 3056	3532	cmd.exe	94
PID 3532 wrote to memory of 3056	3532	cmd.exe	94

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Server.exe
"C:\Users\Admin\AppData\Local\Temp\Server.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4860
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Test" /tr '"C:\Users\Admin\AppData\Roaming\Test.exe"' & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3996
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc onlogon /rl highest /tn "Test" /tr '"C:\Users\Admin\AppData\Roaming\Test.exe"'
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1772
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpB72A.tmp.bat""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3532
- - C:\Windows\system32\timeout.exe
    timeout 3
    3⤵
    - Delays execution with timeout.exe
    PID:4632
- - C:\Users\Admin\AppData\Roaming\Test.exe
    "C:\Users\Admin\AppData\Roaming\Test.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpB72A.tmp.bat

Filesize
148B

MD5
06eee75ad7ba5f92a995379df7092a3a

SHA1
7949d8101fe7fabae3baaab4b98b66a2ad3e64c5

SHA256
0ba7ade49f7eb5d42304bee75cb239f437a606e4924722090dd890b9ff816914

SHA512
e13c26838a8111a41342f90f74ea2beb518a261bf0cac32221ec2ff08731f30fcc11be1b7ff016503656951395a64352c697130335baf225e2c813af06c418fc

Download Submit
C:\Users\Admin\AppData\Roaming\Test.exe

Filesize
63KB

MD5
810261a5b04d3355cd3b9a368bbbf8fa

SHA1
32a90b6674258268b65dc98c8aba74b6ac4cf06f

SHA256
a917ead806f9c411e83a99d5c7a81754981b540988184cfad4587e2a67bb75b5

SHA512
0c81ac8f2a482fd31fd216ec91879c6296bf24e81496ca54c553f5414339fe55d1d7aef706c6b017c05aff927110c22994210c6fa07b9418e0bd1d9038914ec5

Download Submit
memory/4860-1-0x00007FFD76233000-0x00007FFD76235000-memory.dmp

Filesize
8KB

Download
memory/4860-0-0x0000000000C90000-0x0000000000CA6000-memory.dmp

Filesize
88KB

Download
memory/4860-2-0x00007FFD76230000-0x00007FFD76CF1000-memory.dmp

Filesize
10.8MB

Download
memory/4860-7-0x00007FFD76230000-0x00007FFD76CF1000-memory.dmp

Filesize
10.8MB

Download
memory/4860-8-0x00007FFD76230000-0x00007FFD76CF1000-memory.dmp

Filesize
10.8MB

Download