asyncrat | 7559e6ca8b77400f88bf4e67208a1c32570a670068eccae9e3d226cc5471bd47

Resubmissions

20-09-2024 07:43

240920-jkdj5avhqa 10

16-09-2024 13:49

240916-q4rz7a1apg 10

Analysis

max time kernel
147s
max time network
119s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
16-09-2024 13:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bazaar.2020.02/HEUR-Backdoor.MSIL.Crysan.exe
Size

46KB
MD5

ceef7b8296b733da0be864ccdf41ce77
SHA1

c66de07f66ace03ef1e140c8e46525c27df94b04
SHA256

5515739bd8752264b7ee2a2c9b957d36af9fb16b19d7dd1aef4139f2fe74af47
SHA512

62241a9b37933edd4c751316c9cc8a8b195766d81baab7d5b2ef3a532c464e6d76fe9d781ac94c1aff587052a3d9e18478e509e51313656bc2db2b38df792c70
SSDEEP

768:vqdwSbXx6csbXkOicvHk3eHlWMPbPgF0qybI6QolYI6OCC2tYcFmVc6K:vJbXXvZH0ub4FrybI6Qm6OnKmVcl

Score

10^/10

asyncrat null rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.6A

Botnet

null

sam144169-56334.portmap.io:56334

sam144169-56334.portmap.io:5552

sam144169-56334.portmap.io:5050

webforma.chickenkiller.com:56334

webforma.chickenkiller.com:5552

webforma.chickenkiller.com:5050

webdata.ddns.net:56334

webdata.ddns.net:5552

webdata.ddns.net:5050

Mutex

xOUgFqeTTggB

Attributes

delay
5
install
true
install_file
svchost.exe
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Executes dropped EXE 1 IoCs

Processes:

svchost.exe

pid process

3000 svchost.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

2800 timeout.exe
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exe

pid process

2720 schtasks.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

HEUR-Backdoor.MSIL.Crysan.exesvchost.exe

pid process

2168 HEUR-Backdoor.MSIL.Crysan.exe
2168 HEUR-Backdoor.MSIL.Crysan.exe
2168 HEUR-Backdoor.MSIL.Crysan.exe
3000 svchost.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

HEUR-Backdoor.MSIL.Crysan.exesvchost.exe

description pid process

Token: SeDebugPrivilege 2168 HEUR-Backdoor.MSIL.Crysan.exe
Token: SeDebugPrivilege 3000 svchost.exe

pid	process
3000	svchost.exe

pid	process
2800	timeout.exe

pid	process
2720	schtasks.exe

pid	process
2168	HEUR-Backdoor.MSIL.Crysan.exe
2168	HEUR-Backdoor.MSIL.Crysan.exe
2168	HEUR-Backdoor.MSIL.Crysan.exe
3000	svchost.exe

description	pid	process
Token: SeDebugPrivilege	2168	HEUR-Backdoor.MSIL.Crysan.exe
Token: SeDebugPrivilege	3000	svchost.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

HEUR-Backdoor.MSIL.Crysan.execmd.exe

description	pid	process	target process
PID 2168 wrote to memory of 2720	2168	HEUR-Backdoor.MSIL.Crysan.exe	schtasks.exe
PID 2168 wrote to memory of 2720	2168	HEUR-Backdoor.MSIL.Crysan.exe	schtasks.exe
PID 2168 wrote to memory of 2720	2168	HEUR-Backdoor.MSIL.Crysan.exe	schtasks.exe
PID 2168 wrote to memory of 2680	2168	HEUR-Backdoor.MSIL.Crysan.exe	cmd.exe
PID 2168 wrote to memory of 2680	2168	HEUR-Backdoor.MSIL.Crysan.exe	cmd.exe
PID 2168 wrote to memory of 2680	2168	HEUR-Backdoor.MSIL.Crysan.exe	cmd.exe
PID 2680 wrote to memory of 2800	2680	cmd.exe	timeout.exe
PID 2680 wrote to memory of 2800	2680	cmd.exe	timeout.exe
PID 2680 wrote to memory of 2800	2680	cmd.exe	timeout.exe
PID 2680 wrote to memory of 3000	2680	cmd.exe	svchost.exe
PID 2680 wrote to memory of 3000	2680	cmd.exe	svchost.exe
PID 2680 wrote to memory of 3000	2680	cmd.exe	svchost.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\bazaar.2020.02\HEUR-Backdoor.MSIL.Crysan.exe
"C:\Users\Admin\AppData\Local\Temp\bazaar.2020.02\HEUR-Backdoor.MSIL.Crysan.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2168
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "'svchost"' /tr "'C:\Users\Admin\AppData\Roaming\svchost.exe"'
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2720
- C:\Windows\system32\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp18DE.tmp.bat""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2680
- - C:\Windows\system32\timeout.exe
    timeout 3
    3⤵
    - Delays execution with timeout.exe
    PID:2800
- - C:\Users\Admin\AppData\Roaming\svchost.exe
    "C:\Users\Admin\AppData\Roaming\svchost.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3000

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp18DE.tmp.bat

Filesize
151B

MD5
c4604f0e81bdcac92682823f034694a6

SHA1
2bcfe728d229bef7f38fca96a48de9e66e4ec25a

SHA256
b6c32b0411c59defa8989cfb9927a8d72c833e7e1f26b9a8e1e055c9d3e57c88

SHA512
706d77fdb4afcdc56f58a221f074ef1b3fa2a6fc3ddd5ada0730b3ac63a100d624b2b08f60262139f24f763cee14e505e3356f5aa0493713bde1c9a939b7b9c8

Download Submit
C:\Users\Admin\AppData\Roaming\svchost.exe

Filesize
44.5MB

MD5
65192b545b5932f12ac5156c46a1f296

SHA1
4e618e5ceb681ac65a27d3b73bec3fd10f69e66b

SHA256
29cce253381815b8b185178dde470cd569cf202538063a6a18237835cc9ea18d

SHA512
e0521abe68fcfb6dc1b53097bea763b4f093cb11535dc8238ae8b92cbf1d48477599dc5f6fb6c8a5fb89aed431c96c0b161cda2e5618e74b6bf55334408a1e22

Download Submit
memory/2168-0-0x000007FEF56A3000-0x000007FEF56A4000-memory.dmp

Filesize
4KB

Download
memory/2168-1-0x00000000013B0000-0x00000000013C2000-memory.dmp

Filesize
72KB

Download
memory/2168-2-0x000007FEF56A0000-0x000007FEF608C000-memory.dmp

Filesize
9.9MB

Download
memory/2168-3-0x000007FEF56A3000-0x000007FEF56A4000-memory.dmp

Filesize
4KB

Download
memory/2168-4-0x000007FEF56A0000-0x000007FEF608C000-memory.dmp

Filesize
9.9MB

Download
memory/2168-14-0x000007FEF56A0000-0x000007FEF608C000-memory.dmp

Filesize
9.9MB

Download
memory/3000-18-0x0000000001310000-0x0000000001322000-memory.dmp

Filesize
72KB

Download