asyncrat | 6705e4dbe804386d2bcee3bb9065feef12e8d16999aabf3fffa48e4b60ae7950

General

Target

AsyncClient.exe
Size

45KB
MD5

5142671fa2d46cf8d77065acd3207c28
SHA1

a5d95297afa5aa80be622d408f0c5177d66b4322
SHA256

6705e4dbe804386d2bcee3bb9065feef12e8d16999aabf3fffa48e4b60ae7950
SHA512

1abf6f9e52f131913be6f4472fe2ab52893ee4c27724ed7c41646517ba6936cc162931b674e468327792ac70673308cfc74b8fd86e1f8a25be34820c1e058ea4
SSDEEP

768:du361TFMBX1WUVLGPmo2qj1KjPGaG6PIyzjbFgX3iOoWzPV4p71C6WBDZ3x:du361TFqG28KTkDy3bCXS8zOF1CBd3x

Score

10^/10

asyncrat hawkeye latentbot default discovery keylogger rat spyware stealer trojan

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

C2

baltekbezmajtek.zapto.org:6606

baltekbezmajtek.zapto.org:7707

baltekbezmajtek.zapto.org:8808

baltekbezmajtek.zapto.org:1605

192.168.8.1:6606

192.168.8.1:7707

192.168.8.1:8808

192.168.8.1:1605

192.168.8.158:6606

192.168.8.158:7707

192.168.8.158:8808

192.168.8.158:1605

Mutex

CZu6WvgWISic

Attributes

delay
3
install
true
install_file
WindowsUpdate.exe
install_folder
%AppData%

aes.plain

Extracted

Family

latentbot

C2

baltekbezmajtek.zapto.org

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
HawkEye
HawkEye is a malware kit that has seen continuous development since at least 2013.
keylogger trojan stealer spyware hawkeye
LatentBot
Modular trojan written in Delphi which has been in-the-wild since 2013.
trojan latentbot

Async RAT payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral1/files/0x000b000000023390-11.dat	family_asyncrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

AsyncClient.exe

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation	AsyncClient.exe

Executes dropped EXE 1 IoCs

Processes:

WindowsUpdate.exe

pid	Process
4524	WindowsUpdate.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

AsyncClient.exeAsyncClient.execmd.exetimeout.execmd.exeschtasks.exeWindowsUpdate.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AsyncClient.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AsyncClient.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsUpdate.exe

Delays execution with timeout.exe 1 IoCs

evasion

Processes:

timeout.exe

pid	Process
5084	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

Processes:

schtasks.exe

pid	Process
1080	schtasks.exe

Suspicious behavior: EnumeratesProcesses 23 IoCs

Processes:

AsyncClient.exe

pid	Process
2460	AsyncClient.exe
2460	AsyncClient.exe
2460	AsyncClient.exe
2460	AsyncClient.exe
2460	AsyncClient.exe
2460	AsyncClient.exe
2460	AsyncClient.exe
2460	AsyncClient.exe
2460	AsyncClient.exe
2460	AsyncClient.exe
2460	AsyncClient.exe
2460	AsyncClient.exe
2460	AsyncClient.exe
2460	AsyncClient.exe
2460	AsyncClient.exe
2460	AsyncClient.exe
2460	AsyncClient.exe
2460	AsyncClient.exe
2460	AsyncClient.exe
2460	AsyncClient.exe
2460	AsyncClient.exe
2460	AsyncClient.exe
2460	AsyncClient.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

AsyncClient.exeWindowsUpdate.exe

description	pid	Process
Token: SeDebugPrivilege	2460	AsyncClient.exe
Token: SeDebugPrivilege	4524	WindowsUpdate.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

AsyncClient.execmd.execmd.exe

description	pid	Process	procid_target
PID 2460 wrote to memory of 3940	2460	AsyncClient.exe	91
PID 2460 wrote to memory of 3940	2460	AsyncClient.exe	91
PID 2460 wrote to memory of 3940	2460	AsyncClient.exe	91
PID 2460 wrote to memory of 1804	2460	AsyncClient.exe	93
PID 2460 wrote to memory of 1804	2460	AsyncClient.exe	93
PID 2460 wrote to memory of 1804	2460	AsyncClient.exe	93
PID 1804 wrote to memory of 5084	1804	cmd.exe	95
PID 1804 wrote to memory of 5084	1804	cmd.exe	95
PID 1804 wrote to memory of 5084	1804	cmd.exe	95
PID 3940 wrote to memory of 1080	3940	cmd.exe	96
PID 3940 wrote to memory of 1080	3940	cmd.exe	96
PID 3940 wrote to memory of 1080	3940	cmd.exe	96
PID 1804 wrote to memory of 4524	1804	cmd.exe	98
PID 1804 wrote to memory of 4524	1804	cmd.exe	98
PID 1804 wrote to memory of 4524	1804	cmd.exe	98

C:\Users\Admin\AppData\Local\Temp\AsyncClient.exe
"C:\Users\Admin\AppData\Local\Temp\AsyncClient.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2460
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "WindowsUpdate" /tr '"C:\Users\Admin\AppData\Roaming\WindowsUpdate.exe"' & exit
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3940
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /f /sc onlogon /rl highest /tn "WindowsUpdate" /tr '"C:\Users\Admin\AppData\Roaming\WindowsUpdate.exe"'
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1080
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp92AB.tmp.bat""
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1804
- - C:\Windows\SysWOW64\timeout.exe
    timeout 3
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:5084
- - C:\Users\Admin\AppData\Roaming\WindowsUpdate.exe
    "C:\Users\Admin\AppData\Roaming\WindowsUpdate.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4524

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2644

C:\Users\Admin\AppData\Local\Temp\AsyncClient.exe
"C:\Users\Admin\AppData\Local\Temp\AsyncClient.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4604

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\AsyncClient.exe.log

Filesize
522B

MD5
acc9090417037dfa2a55b46ed86e32b8

SHA1
53fa6fb25fb3e88c24d2027aca6ae492b2800a4d

SHA256
2412679218bb0a7d05ceee32869bbb223619bde9966c4c460a68304a3367724b

SHA512
d51f7085ec147c708f446b9fb6923cd2fb64596d354ed929e125b30ace57c8cb3217589447a36960e5d3aea87a4e48aaa82c7509eced6d6c2cecd71fcfe3697b

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp92AB.tmp.bat

Filesize
157B

MD5
78b093595bf79c8a841a4a9dfc78b4f4

SHA1
53807c66564af8df6de6ca1cd8927d27c1056064

SHA256
3e02a9827d1142cd26e4e77130ccdf21b9c592de8b16a4ac29fa4fea30f4c229

SHA512
20a5f4f36f2145fd4a55e89f0347d741ab38bd9fed53b989968d857b41edf9e6bc92a0822a45b5e01b38f5d9f0e213d45b47a29657cc267abc74458313da02cf

Download Submit
C:\Users\Admin\AppData\Roaming\WindowsUpdate.exe

Filesize
45KB

MD5
5142671fa2d46cf8d77065acd3207c28

SHA1
a5d95297afa5aa80be622d408f0c5177d66b4322

SHA256
6705e4dbe804386d2bcee3bb9065feef12e8d16999aabf3fffa48e4b60ae7950

SHA512
1abf6f9e52f131913be6f4472fe2ab52893ee4c27724ed7c41646517ba6936cc162931b674e468327792ac70673308cfc74b8fd86e1f8a25be34820c1e058ea4

Download Submit
memory/2460-0-0x0000000074B5E000-0x0000000074B5F000-memory.dmp

Filesize
4KB

Download
memory/2460-1-0x0000000000AA0000-0x0000000000AB2000-memory.dmp

Filesize
72KB

Download
memory/2460-2-0x0000000074B50000-0x0000000075300000-memory.dmp

Filesize
7.7MB

Download
memory/2460-3-0x00000000054D0000-0x000000000556C000-memory.dmp

Filesize
624KB

Download
memory/2460-8-0x0000000074B50000-0x0000000075300000-memory.dmp

Filesize
7.7MB

Download
memory/4524-13-0x0000000074AB0000-0x0000000075260000-memory.dmp

Filesize
7.7MB

Download
memory/4524-14-0x0000000074AB0000-0x0000000075260000-memory.dmp

Filesize
7.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads