asyncrat | 7559e6ca8b77400f88bf4e67208a1c32570a670068eccae9e3d226cc5471bd47

Resubmissions

26-09-2024 06:42

240926-hgnp9ashkk 10

25-09-2024 16:40

240925-t6kwfayfph 10

Analysis

max time kernel
149s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
25-09-2024 16:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bazaar.2020.02/HEUR-Backdoor.MSIL.Crysan.exe
Size

46KB
MD5

ceef7b8296b733da0be864ccdf41ce77
SHA1

c66de07f66ace03ef1e140c8e46525c27df94b04
SHA256

5515739bd8752264b7ee2a2c9b957d36af9fb16b19d7dd1aef4139f2fe74af47
SHA512

62241a9b37933edd4c751316c9cc8a8b195766d81baab7d5b2ef3a532c464e6d76fe9d781ac94c1aff587052a3d9e18478e509e51313656bc2db2b38df792c70
SSDEEP

768:vqdwSbXx6csbXkOicvHk3eHlWMPbPgF0qybI6QolYI6OCC2tYcFmVc6K:vJbXXvZH0ub4FrybI6Qm6OnKmVcl

Score

10^/10

asyncrat null rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.6A

Botnet

null

sam144169-56334.portmap.io:56334

sam144169-56334.portmap.io:5552

sam144169-56334.portmap.io:5050

webforma.chickenkiller.com:56334

webforma.chickenkiller.com:5552

webforma.chickenkiller.com:5050

webdata.ddns.net:56334

webdata.ddns.net:5552

webdata.ddns.net:5050

Mutex

xOUgFqeTTggB

Attributes

delay
5
install
true
install_file
svchost.exe
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

HEUR-Backdoor.MSIL.Crysan.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation	HEUR-Backdoor.MSIL.Crysan.exe

Executes dropped EXE 1 IoCs

Processes:

svchost.exe

pid process

3480 svchost.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

3728 timeout.exe
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exe

pid process

3784 schtasks.exe

pid	process
3480	svchost.exe

pid	process
3728	timeout.exe

pid	process
3784	schtasks.exe

Suspicious behavior: EnumeratesProcesses 25 IoCs

Processes:

HEUR-Backdoor.MSIL.Crysan.exesvchost.exe

pid	process
4028	HEUR-Backdoor.MSIL.Crysan.exe
4028	HEUR-Backdoor.MSIL.Crysan.exe
4028	HEUR-Backdoor.MSIL.Crysan.exe
4028	HEUR-Backdoor.MSIL.Crysan.exe
4028	HEUR-Backdoor.MSIL.Crysan.exe
4028	HEUR-Backdoor.MSIL.Crysan.exe
4028	HEUR-Backdoor.MSIL.Crysan.exe
4028	HEUR-Backdoor.MSIL.Crysan.exe
4028	HEUR-Backdoor.MSIL.Crysan.exe
4028	HEUR-Backdoor.MSIL.Crysan.exe
4028	HEUR-Backdoor.MSIL.Crysan.exe
4028	HEUR-Backdoor.MSIL.Crysan.exe
4028	HEUR-Backdoor.MSIL.Crysan.exe
4028	HEUR-Backdoor.MSIL.Crysan.exe
4028	HEUR-Backdoor.MSIL.Crysan.exe
4028	HEUR-Backdoor.MSIL.Crysan.exe
4028	HEUR-Backdoor.MSIL.Crysan.exe
4028	HEUR-Backdoor.MSIL.Crysan.exe
4028	HEUR-Backdoor.MSIL.Crysan.exe
4028	HEUR-Backdoor.MSIL.Crysan.exe
4028	HEUR-Backdoor.MSIL.Crysan.exe
4028	HEUR-Backdoor.MSIL.Crysan.exe
4028	HEUR-Backdoor.MSIL.Crysan.exe
4028	HEUR-Backdoor.MSIL.Crysan.exe
3480	svchost.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

HEUR-Backdoor.MSIL.Crysan.exesvchost.exe

description pid process

Token: SeDebugPrivilege 4028 HEUR-Backdoor.MSIL.Crysan.exe
Token: SeDebugPrivilege 3480 svchost.exe

description	pid	process
Token: SeDebugPrivilege	4028	HEUR-Backdoor.MSIL.Crysan.exe
Token: SeDebugPrivilege	3480	svchost.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

HEUR-Backdoor.MSIL.Crysan.execmd.exe

description	pid	process	target process
PID 4028 wrote to memory of 3784	4028	HEUR-Backdoor.MSIL.Crysan.exe	schtasks.exe
PID 4028 wrote to memory of 3784	4028	HEUR-Backdoor.MSIL.Crysan.exe	schtasks.exe
PID 4028 wrote to memory of 5072	4028	HEUR-Backdoor.MSIL.Crysan.exe	cmd.exe
PID 4028 wrote to memory of 5072	4028	HEUR-Backdoor.MSIL.Crysan.exe	cmd.exe
PID 5072 wrote to memory of 3728	5072	cmd.exe	timeout.exe
PID 5072 wrote to memory of 3728	5072	cmd.exe	timeout.exe
PID 5072 wrote to memory of 3480	5072	cmd.exe	svchost.exe
PID 5072 wrote to memory of 3480	5072	cmd.exe	svchost.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\bazaar.2020.02\HEUR-Backdoor.MSIL.Crysan.exe
"C:\Users\Admin\AppData\Local\Temp\bazaar.2020.02\HEUR-Backdoor.MSIL.Crysan.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4028
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "'svchost"' /tr "'C:\Users\Admin\AppData\Roaming\svchost.exe"'
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3784
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpAB82.tmp.bat""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5072
- - C:\Windows\system32\timeout.exe
    timeout 3
    3⤵
    - Delays execution with timeout.exe
    PID:3728
- - C:\Users\Admin\AppData\Roaming\svchost.exe
    "C:\Users\Admin\AppData\Roaming\svchost.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3480

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpAB82.tmp.bat

Filesize
151B

MD5
b1b8c9d5cf85431f3aff0e7f4d5ed27a

SHA1
ee028b3293fdd101633205f31c3ab44db8b2ee8b

SHA256
6363f677fa2e905498cfeca4386db37c28b9b1eb1167ef8d2b3eed10798ad982

SHA512
d111b4240a3d763420fc55a3b8fa6eaf80279d25f91e4198577d2fbee5e87c0567e731781db6493c7a2563455bf80310c5fcc44ba8188e416ee88e5f646d6835

Download Submit
C:\Users\Admin\AppData\Roaming\svchost.exe

Filesize
43.3MB

MD5
d9d7bcdecb8449a428a228d60fd4bacd

SHA1
4d5ac569a150685c0f44728f36872ea6c0fe20e5

SHA256
2a540997f61ee1360187fb7804d37099c4e98adb902d9e10d85da33e1d94dd9a

SHA512
b7ca3835900c14657aee309c3efbba703d0bb42bf3af5d3cecfcf88cedf3bd21065cf76752584e48627901e1f88b5d099027e2f0d93d5eb0f54fd694214187ea

Download Submit
memory/3480-14-0x00007FFF286D0000-0x00007FFF29191000-memory.dmp

Filesize
10.8MB

Download
memory/3480-15-0x00007FFF286D0000-0x00007FFF29191000-memory.dmp

Filesize
10.8MB

Download
memory/4028-0-0x00007FFF286D3000-0x00007FFF286D5000-memory.dmp

Filesize
8KB

Download
memory/4028-1-0x0000000000300000-0x0000000000312000-memory.dmp

Filesize
72KB

Download
memory/4028-2-0x00007FFF286D0000-0x00007FFF29191000-memory.dmp

Filesize
10.8MB

Download
memory/4028-3-0x00007FFF286D3000-0x00007FFF286D5000-memory.dmp

Filesize
8KB

Download
memory/4028-4-0x00007FFF286D0000-0x00007FFF29191000-memory.dmp

Filesize
10.8MB

Download
memory/4028-10-0x00007FFF286D0000-0x00007FFF29191000-memory.dmp

Filesize
10.8MB

Download