asyncrat | 7559e6ca8b77400f88bf4e67208a1c32570a670068eccae9e3d226cc5471bd47

Analysis

max time kernel
151s
max time network
66s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
17-09-2024 06:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bazaar.2020.02/HEUR-Backdoor.MSIL.Crysan.exe
Size

46KB
MD5

ceef7b8296b733da0be864ccdf41ce77
SHA1

c66de07f66ace03ef1e140c8e46525c27df94b04
SHA256

5515739bd8752264b7ee2a2c9b957d36af9fb16b19d7dd1aef4139f2fe74af47
SHA512

62241a9b37933edd4c751316c9cc8a8b195766d81baab7d5b2ef3a532c464e6d76fe9d781ac94c1aff587052a3d9e18478e509e51313656bc2db2b38df792c70
SSDEEP

768:vqdwSbXx6csbXkOicvHk3eHlWMPbPgF0qybI6QolYI6OCC2tYcFmVc6K:vJbXXvZH0ub4FrybI6Qm6OnKmVcl

Score

10^/10

asyncrat null rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.6A

Botnet

null

sam144169-56334.portmap.io:56334

sam144169-56334.portmap.io:5552

sam144169-56334.portmap.io:5050

webforma.chickenkiller.com:56334

webforma.chickenkiller.com:5552

webforma.chickenkiller.com:5050

webdata.ddns.net:56334

webdata.ddns.net:5552

webdata.ddns.net:5050

Mutex

xOUgFqeTTggB

Attributes

delay
5
install
true
install_file
svchost.exe
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Executes dropped EXE 1 IoCs

Processes:

svchost.exe

pid process

2844 svchost.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

2968 timeout.exe
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exe

pid process

2828 schtasks.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

HEUR-Backdoor.MSIL.Crysan.exesvchost.exe

pid process

2292 HEUR-Backdoor.MSIL.Crysan.exe
2844 svchost.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

HEUR-Backdoor.MSIL.Crysan.exesvchost.exe

description pid process

Token: SeDebugPrivilege 2292 HEUR-Backdoor.MSIL.Crysan.exe
Token: SeDebugPrivilege 2844 svchost.exe

pid	process
2844	svchost.exe

pid	process
2968	timeout.exe

pid	process
2828	schtasks.exe

pid	process
2292	HEUR-Backdoor.MSIL.Crysan.exe
2844	svchost.exe

description	pid	process
Token: SeDebugPrivilege	2292	HEUR-Backdoor.MSIL.Crysan.exe
Token: SeDebugPrivilege	2844	svchost.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

HEUR-Backdoor.MSIL.Crysan.execmd.exe

description	pid	process	target process
PID 2292 wrote to memory of 2828	2292	HEUR-Backdoor.MSIL.Crysan.exe	schtasks.exe
PID 2292 wrote to memory of 2828	2292	HEUR-Backdoor.MSIL.Crysan.exe	schtasks.exe
PID 2292 wrote to memory of 2828	2292	HEUR-Backdoor.MSIL.Crysan.exe	schtasks.exe
PID 2292 wrote to memory of 2224	2292	HEUR-Backdoor.MSIL.Crysan.exe	cmd.exe
PID 2292 wrote to memory of 2224	2292	HEUR-Backdoor.MSIL.Crysan.exe	cmd.exe
PID 2292 wrote to memory of 2224	2292	HEUR-Backdoor.MSIL.Crysan.exe	cmd.exe
PID 2224 wrote to memory of 2968	2224	cmd.exe	timeout.exe
PID 2224 wrote to memory of 2968	2224	cmd.exe	timeout.exe
PID 2224 wrote to memory of 2968	2224	cmd.exe	timeout.exe
PID 2224 wrote to memory of 2844	2224	cmd.exe	svchost.exe
PID 2224 wrote to memory of 2844	2224	cmd.exe	svchost.exe
PID 2224 wrote to memory of 2844	2224	cmd.exe	svchost.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\bazaar.2020.02\HEUR-Backdoor.MSIL.Crysan.exe
"C:\Users\Admin\AppData\Local\Temp\bazaar.2020.02\HEUR-Backdoor.MSIL.Crysan.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2292
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "'svchost"' /tr "'C:\Users\Admin\AppData\Roaming\svchost.exe"'
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2828
- C:\Windows\system32\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp2607.tmp.bat""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2224
- - C:\Windows\system32\timeout.exe
    timeout 3
    3⤵
    - Delays execution with timeout.exe
    PID:2968
- - C:\Users\Admin\AppData\Roaming\svchost.exe
    "C:\Users\Admin\AppData\Roaming\svchost.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2844

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp2607.tmp.bat

Filesize
151B

MD5
93f47e69d13f8f2f6fc2c7e802957d18

SHA1
a6e94eb0e90b63faca23b6380791bb9903c2435f

SHA256
b01c6d393ad54671f6a5402f605d45fbe10f6f373365d900ba12b17db7f07b08

SHA512
b9f57961ad3e6a763062bf5f2d4b80a84b9308dde4e8831524b086f17d375a8346ffc5f26e2dd69648c9310ed4b0490702653df31ee05266ffb7621a8e141ab6

Download Submit
C:\Users\Admin\AppData\Roaming\svchost.exe

Filesize
48.3MB

MD5
e44e05cdd878bd02c4f2a840fa635755

SHA1
3978fc52bbe86fca9482ba75617865f065fe1c5d

SHA256
68a5bc747554da53e083dd3a7b2d713a2d4e4a842cd70868a16168a7cc101081

SHA512
b58941de3670b110184c9fb364e81996776dee650f8f984ad9d582659604bcdbd9561fddd3f2c45c388f6bb248be5ca598072d45d2752a231dbe3880a971f1ee

Download Submit
memory/2292-0-0x000007FEF6003000-0x000007FEF6004000-memory.dmp

Filesize
4KB

Download
memory/2292-1-0x0000000000D20000-0x0000000000D32000-memory.dmp

Filesize
72KB

Download
memory/2292-2-0x000007FEF6000000-0x000007FEF69EC000-memory.dmp

Filesize
9.9MB

Download
memory/2292-3-0x000007FEF6003000-0x000007FEF6004000-memory.dmp

Filesize
4KB

Download
memory/2292-4-0x000007FEF6000000-0x000007FEF69EC000-memory.dmp

Filesize
9.9MB

Download
memory/2292-14-0x000007FEF6000000-0x000007FEF69EC000-memory.dmp

Filesize
9.9MB

Download
memory/2844-18-0x0000000000CF0000-0x0000000000D02000-memory.dmp

Filesize
72KB

Download