asyncrat | 08f7f44b07fb6e06a731314aaaaa0d4ee2aa1f98b3ce45437e5b150c0ba6575e

Analysis

max time kernel
145s
max time network
149s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
28-09-2024 07:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SpotifyPatch.exe
Size

129KB
MD5

4ed5ceebb1fd4b6bbc4eb963676f4ac1
SHA1

b3c2f3900fa231849697c008c3deedbf0d2510f4
SHA256

08f7f44b07fb6e06a731314aaaaa0d4ee2aa1f98b3ce45437e5b150c0ba6575e
SHA512

cbc6a1f5a07dedeee42bc50a731a83f2d8eb6faf918484e16d947f7f0c041e3203ac151b75017d2418b054e6e4f6b09efd75f2bdb4fdcb7efcc10b44c7ad3664
SSDEEP

1536:ckbdDbhR3fV9BJbFXGbbwSo9ljVGKc27pqKmY7:c8DbhR3tdlGbbwx91Hoz

Score

10^/10

asyncrat venom clients rat

Malware Config

Extracted

Family

asyncrat

Version

5.0.5

Botnet

Venom Clients

127.0.0.1:4449

127.0.0.1:4140

147.185.221.21:4449

147.185.221.21:4140

Mutex

Venom_RAT_HVNC_Mutex_Venom RAT_HVNC

Attributes

delay
1
install
true
install_file
SpotifyICL.exe
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Roaming\SpotifyICL.exe	family_asyncrat

Executes dropped EXE 1 IoCs

Processes:

SpotifyICL.exe

pid process

3540 SpotifyICL.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

3160 timeout.exe
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exe

pid process

1016 schtasks.exe

pid	process
3540	SpotifyICL.exe

pid	process
3160	timeout.exe

pid	process
1016	schtasks.exe

Suspicious behavior: EnumeratesProcesses 15 IoCs

Processes:

SpotifyPatch.exe

pid	process
5064	SpotifyPatch.exe
5064	SpotifyPatch.exe
5064	SpotifyPatch.exe
5064	SpotifyPatch.exe
5064	SpotifyPatch.exe
5064	SpotifyPatch.exe
5064	SpotifyPatch.exe
5064	SpotifyPatch.exe
5064	SpotifyPatch.exe
5064	SpotifyPatch.exe
5064	SpotifyPatch.exe
5064	SpotifyPatch.exe
5064	SpotifyPatch.exe
5064	SpotifyPatch.exe
5064	SpotifyPatch.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

SpotifyPatch.exeSpotifyICL.exe

description pid process

Token: SeDebugPrivilege 5064 SpotifyPatch.exe
Token: SeDebugPrivilege 3540 SpotifyICL.exe

description	pid	process
Token: SeDebugPrivilege	5064	SpotifyPatch.exe
Token: SeDebugPrivilege	3540	SpotifyICL.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

SpotifyPatch.execmd.execmd.exe

description	pid	process	target process
PID 5064 wrote to memory of 4164	5064	SpotifyPatch.exe	cmd.exe
PID 5064 wrote to memory of 4164	5064	SpotifyPatch.exe	cmd.exe
PID 5064 wrote to memory of 4560	5064	SpotifyPatch.exe	cmd.exe
PID 5064 wrote to memory of 4560	5064	SpotifyPatch.exe	cmd.exe
PID 4560 wrote to memory of 3160	4560	cmd.exe	timeout.exe
PID 4560 wrote to memory of 3160	4560	cmd.exe	timeout.exe
PID 4164 wrote to memory of 1016	4164	cmd.exe	schtasks.exe
PID 4164 wrote to memory of 1016	4164	cmd.exe	schtasks.exe
PID 4560 wrote to memory of 3540	4560	cmd.exe	SpotifyICL.exe
PID 4560 wrote to memory of 3540	4560	cmd.exe	SpotifyICL.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\SpotifyPatch.exe
"C:\Users\Admin\AppData\Local\Temp\SpotifyPatch.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5064

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "SpotifyICL" /tr '"C:\Users\Admin\AppData\Roaming\SpotifyICL.exe"' & exit
2⤵
- Suspicious use of WriteProcessMemory
PID:4164

C:\Windows\system32\schtasks.exe
schtasks /create /f /sc onlogon /rl highest /tn "SpotifyICL" /tr '"C:\Users\Admin\AppData\Roaming\SpotifyICL.exe"'
3⤵
- Scheduled Task/Job: Scheduled Task
PID:1016

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp73C8.tmp.bat""
2⤵
- Suspicious use of WriteProcessMemory
PID:4560

C:\Windows\system32\timeout.exe
timeout 3
3⤵
- Delays execution with timeout.exe
PID:3160

C:\Users\Admin\AppData\Roaming\SpotifyICL.exe
"C:\Users\Admin\AppData\Roaming\SpotifyICL.exe"
3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3540

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp73C8.tmp.bat

Filesize
154B

MD5
63ffc4cf1c522e7ac64e0813f15e4898

SHA1
2fb47c24eecd46d7067a1ab53cac0c84bf53bceb

SHA256
82cf09d5d66493c7da5dc295f0c9f90e84ad6925600c78c954414ea63080f0b0

SHA512
293b2a709183cd60e234f8b38e4884b09e9b815af9da2a4a090b84d96f6f3f486f61cdf2091260e58206ba76a19fef46c82c448972ecf77b7d186d444bedbe87

Download Submit
C:\Users\Admin\AppData\Roaming\SpotifyICL.exe

Filesize
129KB

MD5
4ed5ceebb1fd4b6bbc4eb963676f4ac1

SHA1
b3c2f3900fa231849697c008c3deedbf0d2510f4

SHA256
08f7f44b07fb6e06a731314aaaaa0d4ee2aa1f98b3ce45437e5b150c0ba6575e

SHA512
cbc6a1f5a07dedeee42bc50a731a83f2d8eb6faf918484e16d947f7f0c041e3203ac151b75017d2418b054e6e4f6b09efd75f2bdb4fdcb7efcc10b44c7ad3664

Download Submit
memory/5064-0-0x0000000000FA0000-0x0000000000FC6000-memory.dmp

Filesize
152KB

Download
memory/5064-1-0x00007FFA2DF73000-0x00007FFA2DF74000-memory.dmp

Filesize
4KB

Download
memory/5064-2-0x00007FFA2DF70000-0x00007FFA2E95C000-memory.dmp

Filesize
9.9MB

Download
memory/5064-3-0x00007FFA2DF70000-0x00007FFA2E95C000-memory.dmp

Filesize
9.9MB

Download
memory/5064-8-0x00007FFA2DF70000-0x00007FFA2E95C000-memory.dmp

Filesize
9.9MB

Download