Analysis
-
max time kernel
144s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
08-08-2024 01:50
Behavioral task
behavioral1
Sample
AsyncClient.exe
Resource
win7-20240705-en
General
-
Target
AsyncClient.exe
-
Size
45KB
-
MD5
2f0206e9dd15d9dccb2ecf93e7cf8ce8
-
SHA1
48223ea372b29b082e8f44c610ffc0edd88ed2ae
-
SHA256
24fa23a1908d5afe4a323872a2df703ecdc1fe033d321423c6c60f983d8d1f6e
-
SHA512
0790798f4a11cbf09c2a1dc74ef92c1b2f84c3b659efec9df9099a1eaab9c6a00c430c8316aaefa94da206b589741c45e7f0bf56cd3b58e8e43f8a8130ff8160
-
SSDEEP
768:puwpFTAY3IQWUe9jqmo2qLoKjPGaG6PIyzjbFgX3i+7Qs0M48wDdOTwBDZ6x:puwpFTA4/2xKTkDy3bCXS+cs07tgmd6x
Malware Config
Extracted
asyncrat
0.5.8
Default
127.0.0.1:6606
127.0.0.1:7707
127.0.0.1:8808
ZC7aTuQsZ3YU
-
delay
3
-
install
true
-
install_file
new rat.exe
-
install_folder
%AppData%
Signatures
-
Async RAT payload 1 IoCs
resource yara_rule behavioral2/files/0x000400000001692d-11.dat family_asyncrat -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation AsyncClient.exe -
Executes dropped EXE 1 IoCs
pid Process 824 new rat.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AsyncClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language new rat.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 3908 timeout.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4040 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 21 IoCs
pid Process 2964 AsyncClient.exe 2964 AsyncClient.exe 2964 AsyncClient.exe 2964 AsyncClient.exe 2964 AsyncClient.exe 2964 AsyncClient.exe 2964 AsyncClient.exe 2964 AsyncClient.exe 2964 AsyncClient.exe 2964 AsyncClient.exe 2964 AsyncClient.exe 2964 AsyncClient.exe 2964 AsyncClient.exe 2964 AsyncClient.exe 2964 AsyncClient.exe 2964 AsyncClient.exe 2964 AsyncClient.exe 2964 AsyncClient.exe 2964 AsyncClient.exe 2964 AsyncClient.exe 2964 AsyncClient.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2964 AsyncClient.exe Token: SeDebugPrivilege 824 new rat.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 2964 wrote to memory of 4600 2964 AsyncClient.exe 86 PID 2964 wrote to memory of 4600 2964 AsyncClient.exe 86 PID 2964 wrote to memory of 4600 2964 AsyncClient.exe 86 PID 2964 wrote to memory of 3996 2964 AsyncClient.exe 88 PID 2964 wrote to memory of 3996 2964 AsyncClient.exe 88 PID 2964 wrote to memory of 3996 2964 AsyncClient.exe 88 PID 4600 wrote to memory of 4040 4600 cmd.exe 91 PID 4600 wrote to memory of 4040 4600 cmd.exe 91 PID 4600 wrote to memory of 4040 4600 cmd.exe 91 PID 3996 wrote to memory of 3908 3996 cmd.exe 90 PID 3996 wrote to memory of 3908 3996 cmd.exe 90 PID 3996 wrote to memory of 3908 3996 cmd.exe 90 PID 3996 wrote to memory of 824 3996 cmd.exe 92 PID 3996 wrote to memory of 824 3996 cmd.exe 92 PID 3996 wrote to memory of 824 3996 cmd.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\AsyncClient.exe"C:\Users\Admin\AppData\Local\Temp\AsyncClient.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2964 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "new rat" /tr '"C:\Users\Admin\AppData\Roaming\new rat.exe"' & exit2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4600 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "new rat" /tr '"C:\Users\Admin\AppData\Roaming\new rat.exe"'3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:4040
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpCDEF.tmp.bat""2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3996 -
C:\Windows\SysWOW64\timeout.exetimeout 33⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:3908
-
-
C:\Users\Admin\AppData\Roaming\new rat.exe"C:\Users\Admin\AppData\Roaming\new rat.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:824
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
151B
MD523b31c02ae5256542c49a2e0b70c0633
SHA180b81506421fb20f73ffef3fe09dfdca2fe467a7
SHA256a8b076f234dc8bc2db591fc74f9b2b275fa62c6ed164ada71c3a91c036ed719d
SHA512587d4fe9975570132fab5ad1fcee193e0fd5b34f9db4cbf06a090ab10e0a5cbd98e83f1351d48cb54cc7dc735bd956308a62c3b9629326b4c09ffb86021556a7
-
Filesize
45KB
MD52f0206e9dd15d9dccb2ecf93e7cf8ce8
SHA148223ea372b29b082e8f44c610ffc0edd88ed2ae
SHA25624fa23a1908d5afe4a323872a2df703ecdc1fe033d321423c6c60f983d8d1f6e
SHA5120790798f4a11cbf09c2a1dc74ef92c1b2f84c3b659efec9df9099a1eaab9c6a00c430c8316aaefa94da206b589741c45e7f0bf56cd3b58e8e43f8a8130ff8160