asyncrat | c9b0b965fd64659131f44d19c1a990ab77a1b0dd347326fe4ca8ef916b5fca90

Analysis

max time kernel
1047s
max time network
1053s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
27-07-2024 06:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

AsyncClient.exe
Size

45KB
MD5

8eecd2fdc5ba1e01c80ea1738254d5b5
SHA1

a5f15ff5e8cec43ed8526e4098c862be9e7bbfd2
SHA256

c9b0b965fd64659131f44d19c1a990ab77a1b0dd347326fe4ca8ef916b5fca90
SHA512

663068d92f3d8ecccd2eecdeedd9ce796a301b0489719a13b2377ae9ce1d53c3aad927257cf20bbc69c237818a84eaf019b68e1277f3fa38ac08ac250ff79bca
SSDEEP

768:WuPfZTg4pYiWUU9jjmo2qrUKjPGagAWOzjbFgX3irRwDwraD25WfT9KkcDZTf+:WuPfZTgKa2lKTKTO3bCXSryD2x5m5Idi

Score

10^/10

asyncrat default discovery ransomware rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

community-married.gl.at.ply.gg:14614

Mutex

0nShSbwLmFOV

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Contains code to disable Windows Defender 1 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

resource	yara_rule
behavioral1/memory/4764-20-0x0000000006A80000-0x0000000006A8E000-memory.dmp	disable_win_def

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tmp8C64.tmp.jpg"	AsyncClient.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 4764 set thread context of 4584	4764	AsyncClient.exe	104
PID 4764 set thread context of 1052	4764	AsyncClient.exe	106
PID 4764 set thread context of 3192	4764	AsyncClient.exe	109
PID 4764 set thread context of 4340	4764	AsyncClient.exe	114

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 4 IoCs

pid	pid_target	Process	procid_target
2736	3192	WerFault.exe	109
3576	1052	WerFault.exe	106
3768	4584	WerFault.exe	104
2836	4340	WerFault.exe	114

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AsyncClient.exe

Modifies Control Panel 2 IoCs

evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000\Control Panel\Desktop\WallpaperStyle = "2"	AsyncClient.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000\Control Panel\Desktop\TileWallpaper = "0"	AsyncClient.exe

Suspicious behavior: EnumeratesProcesses 60 IoCs

pid	Process
4764	AsyncClient.exe
4764	AsyncClient.exe
4764	AsyncClient.exe
4764	AsyncClient.exe
4764	AsyncClient.exe
4764	AsyncClient.exe
4764	AsyncClient.exe
4764	AsyncClient.exe
4764	AsyncClient.exe
4764	AsyncClient.exe
4764	AsyncClient.exe
4764	AsyncClient.exe
4764	AsyncClient.exe
4764	AsyncClient.exe
4764	AsyncClient.exe
4764	AsyncClient.exe
4764	AsyncClient.exe
4764	AsyncClient.exe
4764	AsyncClient.exe
4764	AsyncClient.exe
4764	AsyncClient.exe
4764	AsyncClient.exe
4764	AsyncClient.exe
4764	AsyncClient.exe
4764	AsyncClient.exe
4764	AsyncClient.exe
4764	AsyncClient.exe
4764	AsyncClient.exe
4764	AsyncClient.exe
4764	AsyncClient.exe
4764	AsyncClient.exe
4764	AsyncClient.exe
4764	AsyncClient.exe
4764	AsyncClient.exe
4764	AsyncClient.exe
4764	AsyncClient.exe
4764	AsyncClient.exe
4764	AsyncClient.exe
4764	AsyncClient.exe
4764	AsyncClient.exe
4764	AsyncClient.exe
4764	AsyncClient.exe
4764	AsyncClient.exe
4764	AsyncClient.exe
4764	AsyncClient.exe
4764	AsyncClient.exe
4764	AsyncClient.exe
4764	AsyncClient.exe
4764	AsyncClient.exe
4764	AsyncClient.exe
4764	AsyncClient.exe
4764	AsyncClient.exe
4764	AsyncClient.exe
4764	AsyncClient.exe
4764	AsyncClient.exe
4764	AsyncClient.exe
4764	AsyncClient.exe
4764	AsyncClient.exe
4764	AsyncClient.exe
4764	AsyncClient.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4764	AsyncClient.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4764 wrote to memory of 1592	4764	AsyncClient.exe	74
PID 4764 wrote to memory of 1592	4764	AsyncClient.exe	74
PID 4764 wrote to memory of 1592	4764	AsyncClient.exe	74
PID 4764 wrote to memory of 4668	4764	AsyncClient.exe	75
PID 4764 wrote to memory of 4668	4764	AsyncClient.exe	75
PID 4764 wrote to memory of 4668	4764	AsyncClient.exe	75
PID 4764 wrote to memory of 4628	4764	AsyncClient.exe	76
PID 4764 wrote to memory of 4628	4764	AsyncClient.exe	76
PID 4764 wrote to memory of 4628	4764	AsyncClient.exe	76
PID 4764 wrote to memory of 4320	4764	AsyncClient.exe	77
PID 4764 wrote to memory of 4320	4764	AsyncClient.exe	77
PID 4764 wrote to memory of 4320	4764	AsyncClient.exe	77
PID 4764 wrote to memory of 3808	4764	AsyncClient.exe	78
PID 4764 wrote to memory of 3808	4764	AsyncClient.exe	78
PID 4764 wrote to memory of 3808	4764	AsyncClient.exe	78
PID 4764 wrote to memory of 2336	4764	AsyncClient.exe	79
PID 4764 wrote to memory of 2336	4764	AsyncClient.exe	79
PID 4764 wrote to memory of 2336	4764	AsyncClient.exe	79
PID 4764 wrote to memory of 4732	4764	AsyncClient.exe	80
PID 4764 wrote to memory of 4732	4764	AsyncClient.exe	80
PID 4764 wrote to memory of 4732	4764	AsyncClient.exe	80
PID 4764 wrote to memory of 2184	4764	AsyncClient.exe	81
PID 4764 wrote to memory of 2184	4764	AsyncClient.exe	81
PID 4764 wrote to memory of 2184	4764	AsyncClient.exe	81
PID 4764 wrote to memory of 2144	4764	AsyncClient.exe	82
PID 4764 wrote to memory of 2144	4764	AsyncClient.exe	82
PID 4764 wrote to memory of 2144	4764	AsyncClient.exe	82
PID 4764 wrote to memory of 3492	4764	AsyncClient.exe	83
PID 4764 wrote to memory of 3492	4764	AsyncClient.exe	83
PID 4764 wrote to memory of 3492	4764	AsyncClient.exe	83
PID 4764 wrote to memory of 2316	4764	AsyncClient.exe	84
PID 4764 wrote to memory of 2316	4764	AsyncClient.exe	84
PID 4764 wrote to memory of 2316	4764	AsyncClient.exe	84
PID 4764 wrote to memory of 4844	4764	AsyncClient.exe	85
PID 4764 wrote to memory of 4844	4764	AsyncClient.exe	85
PID 4764 wrote to memory of 4844	4764	AsyncClient.exe	85
PID 4764 wrote to memory of 1324	4764	AsyncClient.exe	86
PID 4764 wrote to memory of 1324	4764	AsyncClient.exe	86
PID 4764 wrote to memory of 1324	4764	AsyncClient.exe	86
PID 4764 wrote to memory of 2252	4764	AsyncClient.exe	87
PID 4764 wrote to memory of 2252	4764	AsyncClient.exe	87
PID 4764 wrote to memory of 2252	4764	AsyncClient.exe	87
PID 4764 wrote to memory of 4832	4764	AsyncClient.exe	88
PID 4764 wrote to memory of 4832	4764	AsyncClient.exe	88
PID 4764 wrote to memory of 4832	4764	AsyncClient.exe	88
PID 4764 wrote to memory of 4004	4764	AsyncClient.exe	89
PID 4764 wrote to memory of 4004	4764	AsyncClient.exe	89
PID 4764 wrote to memory of 4004	4764	AsyncClient.exe	89
PID 4764 wrote to memory of 2564	4764	AsyncClient.exe	90
PID 4764 wrote to memory of 2564	4764	AsyncClient.exe	90
PID 4764 wrote to memory of 2564	4764	AsyncClient.exe	90
PID 4764 wrote to memory of 2584	4764	AsyncClient.exe	91
PID 4764 wrote to memory of 2584	4764	AsyncClient.exe	91
PID 4764 wrote to memory of 2584	4764	AsyncClient.exe	91
PID 4764 wrote to memory of 4536	4764	AsyncClient.exe	92
PID 4764 wrote to memory of 4536	4764	AsyncClient.exe	92
PID 4764 wrote to memory of 4536	4764	AsyncClient.exe	92
PID 4764 wrote to memory of 716	4764	AsyncClient.exe	93
PID 4764 wrote to memory of 716	4764	AsyncClient.exe	93
PID 4764 wrote to memory of 716	4764	AsyncClient.exe	93
PID 4764 wrote to memory of 4712	4764	AsyncClient.exe	94
PID 4764 wrote to memory of 4712	4764	AsyncClient.exe	94
PID 4764 wrote to memory of 4712	4764	AsyncClient.exe	94
PID 4764 wrote to memory of 1856	4764	AsyncClient.exe	95

C:\Users\Admin\AppData\Local\Temp\AsyncClient.exe
"C:\Users\Admin\AppData\Local\Temp\AsyncClient.exe"
1⤵
- Sets desktop wallpaper using registry
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4764
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:1592
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:4668
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:4628
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:4320
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:3808
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:2336
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:4732
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:2184
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:2144
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:3492
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:2316
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:4844
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:1324
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:2252
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:4832
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:4004
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:2564
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:2584
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:4536
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:716
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:4712
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:1856
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:4612
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:2016
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:4048
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:4260
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:2100
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:780
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:756
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:1580
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4584
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4584 -s 784
    3⤵
    - Program crash
    PID:3768
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1052
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1052 -s 784
    3⤵
    - Program crash
    PID:3576
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3192
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3192 -s 784
    3⤵
    - Program crash
    PID:2736
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4340
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4340 -s 784
    3⤵
    - Program crash
    PID:2836

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp8C63.tmp.jpg

Filesize
911KB

MD5
b79b8efe372f6a2fd21fd4521dcaa8ae

SHA1
c3a68128c94249a726e7448c76a6e7ecb9a96c88

SHA256
d7e55e5a54efa6d9c765a979b99f6598fefe02096b546c26a9fc251586e17ab0

SHA512
6ae5ce73fa938071f1b4edb71ea9374df51ca2e0e252b486c6690c04453a890ecdd3061b150bd063c02e23281f07e165b39bac162eab96035aea2654868ccf56

Download Submit
memory/4584-13-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/4764-10-0x00000000079F0000-0x0000000007A66000-memory.dmp

Filesize
472KB

Download
memory/4764-11-0x0000000002970000-0x000000000297E000-memory.dmp

Filesize
56KB

Download
memory/4764-6-0x0000000005F10000-0x000000000640E000-memory.dmp

Filesize
5.0MB

Download
memory/4764-7-0x0000000005A10000-0x0000000005A76000-memory.dmp

Filesize
408KB

Download
memory/4764-8-0x000000007362E000-0x000000007362F000-memory.dmp

Filesize
4KB

Download
memory/4764-9-0x0000000073620000-0x0000000073D0E000-memory.dmp

Filesize
6.9MB

Download
memory/4764-0-0x000000007362E000-0x000000007362F000-memory.dmp

Filesize
4KB

Download
memory/4764-5-0x0000000005970000-0x0000000005A0C000-memory.dmp

Filesize
624KB

Download
memory/4764-12-0x0000000007DA0000-0x0000000007DBE000-memory.dmp

Filesize
120KB

Download
memory/4764-2-0x0000000073620000-0x0000000073D0E000-memory.dmp

Filesize
6.9MB

Download
memory/4764-16-0x0000000007F20000-0x0000000007F2A000-memory.dmp

Filesize
40KB

Download
memory/4764-18-0x00000000065D0000-0x00000000065DC000-memory.dmp

Filesize
48KB

Download
memory/4764-19-0x0000000006870000-0x0000000006902000-memory.dmp

Filesize
584KB

Download
memory/4764-20-0x0000000006A80000-0x0000000006A8E000-memory.dmp

Filesize
56KB

Download
memory/4764-1-0x00000000007D0000-0x00000000007E2000-memory.dmp

Filesize
72KB

Download