asyncrat | 7559e6ca8b77400f88bf4e67208a1c32570a670068eccae9e3d226cc5471bd47

Resubmissions

20-09-2024 07:43

240920-jkdj5avhqa 10

16-09-2024 13:49

240916-q4rz7a1apg 10

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
16-09-2024 13:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bazaar.2020.02/HEUR-Backdoor.MSIL.Crysan.exe
Size

46KB
MD5

ceef7b8296b733da0be864ccdf41ce77
SHA1

c66de07f66ace03ef1e140c8e46525c27df94b04
SHA256

5515739bd8752264b7ee2a2c9b957d36af9fb16b19d7dd1aef4139f2fe74af47
SHA512

62241a9b37933edd4c751316c9cc8a8b195766d81baab7d5b2ef3a532c464e6d76fe9d781ac94c1aff587052a3d9e18478e509e51313656bc2db2b38df792c70
SSDEEP

768:vqdwSbXx6csbXkOicvHk3eHlWMPbPgF0qybI6QolYI6OCC2tYcFmVc6K:vJbXXvZH0ub4FrybI6Qm6OnKmVcl

Score

10^/10

asyncrat null rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.6A

Botnet

null

sam144169-56334.portmap.io:56334

sam144169-56334.portmap.io:5552

sam144169-56334.portmap.io:5050

webforma.chickenkiller.com:56334

webforma.chickenkiller.com:5552

webforma.chickenkiller.com:5050

webdata.ddns.net:56334

webdata.ddns.net:5552

webdata.ddns.net:5050

Mutex

xOUgFqeTTggB

Attributes

delay
5
install
true
install_file
svchost.exe
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation	HEUR-Backdoor.MSIL.Crysan.exe

Executes dropped EXE 1 IoCs

pid	Process
216	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
636	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4916	schtasks.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
3752	HEUR-Backdoor.MSIL.Crysan.exe
3752	HEUR-Backdoor.MSIL.Crysan.exe
3752	HEUR-Backdoor.MSIL.Crysan.exe
3752	HEUR-Backdoor.MSIL.Crysan.exe
3752	HEUR-Backdoor.MSIL.Crysan.exe
3752	HEUR-Backdoor.MSIL.Crysan.exe
3752	HEUR-Backdoor.MSIL.Crysan.exe
3752	HEUR-Backdoor.MSIL.Crysan.exe
3752	HEUR-Backdoor.MSIL.Crysan.exe
3752	HEUR-Backdoor.MSIL.Crysan.exe
3752	HEUR-Backdoor.MSIL.Crysan.exe
3752	HEUR-Backdoor.MSIL.Crysan.exe
3752	HEUR-Backdoor.MSIL.Crysan.exe
3752	HEUR-Backdoor.MSIL.Crysan.exe
3752	HEUR-Backdoor.MSIL.Crysan.exe
3752	HEUR-Backdoor.MSIL.Crysan.exe
3752	HEUR-Backdoor.MSIL.Crysan.exe
3752	HEUR-Backdoor.MSIL.Crysan.exe
3752	HEUR-Backdoor.MSIL.Crysan.exe
3752	HEUR-Backdoor.MSIL.Crysan.exe
3752	HEUR-Backdoor.MSIL.Crysan.exe
3752	HEUR-Backdoor.MSIL.Crysan.exe
3752	HEUR-Backdoor.MSIL.Crysan.exe
216	svchost.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3752	HEUR-Backdoor.MSIL.Crysan.exe
Token: SeDebugPrivilege	216	svchost.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3752 wrote to memory of 4916	3752	HEUR-Backdoor.MSIL.Crysan.exe	88
PID 3752 wrote to memory of 4916	3752	HEUR-Backdoor.MSIL.Crysan.exe	88
PID 3752 wrote to memory of 5092	3752	HEUR-Backdoor.MSIL.Crysan.exe	90
PID 3752 wrote to memory of 5092	3752	HEUR-Backdoor.MSIL.Crysan.exe	90
PID 5092 wrote to memory of 636	5092	cmd.exe	92
PID 5092 wrote to memory of 636	5092	cmd.exe	92
PID 5092 wrote to memory of 216	5092	cmd.exe	93
PID 5092 wrote to memory of 216	5092	cmd.exe	93

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\bazaar.2020.02\HEUR-Backdoor.MSIL.Crysan.exe
"C:\Users\Admin\AppData\Local\Temp\bazaar.2020.02\HEUR-Backdoor.MSIL.Crysan.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3752
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "'svchost"' /tr "'C:\Users\Admin\AppData\Roaming\svchost.exe"'
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4916
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpB47B.tmp.bat""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5092
- - C:\Windows\system32\timeout.exe
    timeout 3
    3⤵
    - Delays execution with timeout.exe
    PID:636
- - C:\Users\Admin\AppData\Roaming\svchost.exe
    "C:\Users\Admin\AppData\Roaming\svchost.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:216

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpB47B.tmp.bat

Filesize
151B

MD5
ab59754d85aee1f616c3eb16a0e962c5

SHA1
aaa0259a43d294ac946a80a91c8ea646d7c57abc

SHA256
b8aa3793500207297eb60b7db1f053aba18006992aa8b60078a855b953c0263c

SHA512
6215b2ca18007cead277c6416e2c0010ba7f6b7b19250eba60003422cd4cd1b0f9836f05b58acf574c6be73d07a0be3583da8f85fcc45dd531ac7b235ca4a1ec

Download Submit
C:\Users\Admin\AppData\Roaming\svchost.exe

Filesize
41.8MB

MD5
0071c2f88f0284c396278bf0b996b35a

SHA1
ba1ca973f623a37ec104c528a94800ef3bb33fc7

SHA256
689275e87091b191cd430385b3d048e969d1c680052a88100f0d52b48a3ba127

SHA512
2ab5d8f13d5aee38cf958179b0b0b57efb11534d9b4b3f281be8e5b71fe45b319a26205a4022c7f47efad9943f2a4110d6d43b32aa2e7cd9879991e42ac97fe0

Download Submit
memory/216-14-0x00007FFBA6ED0000-0x00007FFBA7991000-memory.dmp

Filesize
10.8MB

Download
memory/216-15-0x00007FFBA6ED0000-0x00007FFBA7991000-memory.dmp

Filesize
10.8MB

Download
memory/3752-0-0x00007FFBA6ED3000-0x00007FFBA6ED5000-memory.dmp

Filesize
8KB

Download
memory/3752-1-0x0000000000C50000-0x0000000000C62000-memory.dmp

Filesize
72KB

Download
memory/3752-2-0x00007FFBA6ED0000-0x00007FFBA7991000-memory.dmp

Filesize
10.8MB

Download
memory/3752-3-0x00007FFBA6ED3000-0x00007FFBA6ED5000-memory.dmp

Filesize
8KB

Download
memory/3752-4-0x00007FFBA6ED0000-0x00007FFBA7991000-memory.dmp

Filesize
10.8MB

Download
memory/3752-10-0x00007FFBA6ED0000-0x00007FFBA7991000-memory.dmp

Filesize
10.8MB

Download