asyncrat | 7559e6ca8b77400f88bf4e67208a1c32570a670068eccae9e3d226cc5471bd47

Analysis

max time kernel
148s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
17-09-2024 06:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bazaar.2020.02/HEUR-Backdoor.MSIL.Crysan.exe
Size

46KB
MD5

ceef7b8296b733da0be864ccdf41ce77
SHA1

c66de07f66ace03ef1e140c8e46525c27df94b04
SHA256

5515739bd8752264b7ee2a2c9b957d36af9fb16b19d7dd1aef4139f2fe74af47
SHA512

62241a9b37933edd4c751316c9cc8a8b195766d81baab7d5b2ef3a532c464e6d76fe9d781ac94c1aff587052a3d9e18478e509e51313656bc2db2b38df792c70
SSDEEP

768:vqdwSbXx6csbXkOicvHk3eHlWMPbPgF0qybI6QolYI6OCC2tYcFmVc6K:vJbXXvZH0ub4FrybI6Qm6OnKmVcl

Score

10^/10

asyncrat null rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.6A

Botnet

null

sam144169-56334.portmap.io:56334

sam144169-56334.portmap.io:5552

sam144169-56334.portmap.io:5050

webforma.chickenkiller.com:56334

webforma.chickenkiller.com:5552

webforma.chickenkiller.com:5050

webdata.ddns.net:56334

webdata.ddns.net:5552

webdata.ddns.net:5050

Mutex

xOUgFqeTTggB

Attributes

delay
5
install
true
install_file
svchost.exe
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation	HEUR-Backdoor.MSIL.Crysan.exe

Executes dropped EXE 1 IoCs

pid	Process
3644	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
2144	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3976	schtasks.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
4432	HEUR-Backdoor.MSIL.Crysan.exe
4432	HEUR-Backdoor.MSIL.Crysan.exe
4432	HEUR-Backdoor.MSIL.Crysan.exe
4432	HEUR-Backdoor.MSIL.Crysan.exe
4432	HEUR-Backdoor.MSIL.Crysan.exe
4432	HEUR-Backdoor.MSIL.Crysan.exe
4432	HEUR-Backdoor.MSIL.Crysan.exe
4432	HEUR-Backdoor.MSIL.Crysan.exe
4432	HEUR-Backdoor.MSIL.Crysan.exe
4432	HEUR-Backdoor.MSIL.Crysan.exe
4432	HEUR-Backdoor.MSIL.Crysan.exe
4432	HEUR-Backdoor.MSIL.Crysan.exe
4432	HEUR-Backdoor.MSIL.Crysan.exe
4432	HEUR-Backdoor.MSIL.Crysan.exe
4432	HEUR-Backdoor.MSIL.Crysan.exe
4432	HEUR-Backdoor.MSIL.Crysan.exe
4432	HEUR-Backdoor.MSIL.Crysan.exe
4432	HEUR-Backdoor.MSIL.Crysan.exe
4432	HEUR-Backdoor.MSIL.Crysan.exe
4432	HEUR-Backdoor.MSIL.Crysan.exe
4432	HEUR-Backdoor.MSIL.Crysan.exe
4432	HEUR-Backdoor.MSIL.Crysan.exe
4432	HEUR-Backdoor.MSIL.Crysan.exe
3644	svchost.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4432	HEUR-Backdoor.MSIL.Crysan.exe
Token: SeDebugPrivilege	3644	svchost.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4432 wrote to memory of 3976	4432	HEUR-Backdoor.MSIL.Crysan.exe	88
PID 4432 wrote to memory of 3976	4432	HEUR-Backdoor.MSIL.Crysan.exe	88
PID 4432 wrote to memory of 3352	4432	HEUR-Backdoor.MSIL.Crysan.exe	90
PID 4432 wrote to memory of 3352	4432	HEUR-Backdoor.MSIL.Crysan.exe	90
PID 3352 wrote to memory of 2144	3352	cmd.exe	92
PID 3352 wrote to memory of 2144	3352	cmd.exe	92
PID 3352 wrote to memory of 3644	3352	cmd.exe	93
PID 3352 wrote to memory of 3644	3352	cmd.exe	93

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\bazaar.2020.02\HEUR-Backdoor.MSIL.Crysan.exe
"C:\Users\Admin\AppData\Local\Temp\bazaar.2020.02\HEUR-Backdoor.MSIL.Crysan.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4432
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "'svchost"' /tr "'C:\Users\Admin\AppData\Roaming\svchost.exe"'
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3976
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpEC06.tmp.bat""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3352
- - C:\Windows\system32\timeout.exe
    timeout 3
    3⤵
    - Delays execution with timeout.exe
    PID:2144
- - C:\Users\Admin\AppData\Roaming\svchost.exe
    "C:\Users\Admin\AppData\Roaming\svchost.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3644

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpEC06.tmp.bat

Filesize
151B

MD5
a1cac399259fb6f6b06860744e0edf2c

SHA1
585cbc105a484c1e861c830b2fb573e1e8919f27

SHA256
1fe25ead1b48bf6f9d5694159c0d0ddd53124bad08229156c102af7f64aa7dab

SHA512
9e47d21b0e844f401d65e85b104b2f012e1ea9eb9c08767c7587996132ca91d2b751ac014e525cd8ff8757d8fd9c54261162b128b27697836dc88dbcba9f42d5

Download Submit
C:\Users\Admin\AppData\Roaming\svchost.exe

Filesize
40.0MB

MD5
01236c67af3b6d59bc1c29de9066541c

SHA1
b2bfc4771447f88ad75c17a9e8c2ef9fb9d4fd93

SHA256
0707870dabfdbf73e327f07b6a2185b97b26078061c8a1eac1b8167945a96ee0

SHA512
57686c828a48765930608e7e78c241db7379b3518b1c4f2cb4207cbe708ecb3583380489925baf040e0def5b1e250380c3ab03fb6136167c6f8916c988eafc15

Download Submit
memory/3644-14-0x00007FFB88240000-0x00007FFB88D01000-memory.dmp

Filesize
10.8MB

Download
memory/3644-15-0x00007FFB88240000-0x00007FFB88D01000-memory.dmp

Filesize
10.8MB

Download
memory/4432-0-0x00007FFB88243000-0x00007FFB88245000-memory.dmp

Filesize
8KB

Download
memory/4432-1-0x0000000000E30000-0x0000000000E42000-memory.dmp

Filesize
72KB

Download
memory/4432-2-0x00007FFB88240000-0x00007FFB88D01000-memory.dmp

Filesize
10.8MB

Download
memory/4432-3-0x00007FFB88243000-0x00007FFB88245000-memory.dmp

Filesize
8KB

Download
memory/4432-4-0x00007FFB88240000-0x00007FFB88D01000-memory.dmp

Filesize
10.8MB

Download
memory/4432-10-0x00007FFB88240000-0x00007FFB88D01000-memory.dmp

Filesize
10.8MB

Download