asyncrat | 08f7f44b07fb6e06a731314aaaaa0d4ee2aa1f98b3ce45437e5b150c0ba6575e

Analysis

max time kernel
147s
max time network
152s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
28-09-2024 07:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SpotifyPatch.exe
Size

129KB
MD5

4ed5ceebb1fd4b6bbc4eb963676f4ac1
SHA1

b3c2f3900fa231849697c008c3deedbf0d2510f4
SHA256

08f7f44b07fb6e06a731314aaaaa0d4ee2aa1f98b3ce45437e5b150c0ba6575e
SHA512

cbc6a1f5a07dedeee42bc50a731a83f2d8eb6faf918484e16d947f7f0c041e3203ac151b75017d2418b054e6e4f6b09efd75f2bdb4fdcb7efcc10b44c7ad3664
SSDEEP

1536:ckbdDbhR3fV9BJbFXGbbwSo9ljVGKc27pqKmY7:c8DbhR3tdlGbbwx91Hoz

Score

10^/10

asyncrat venom clients rat

Malware Config

Extracted

Family

asyncrat

Version

5.0.5

Botnet

Venom Clients

127.0.0.1:4449

127.0.0.1:4140

147.185.221.21:4449

147.185.221.21:4140

Mutex

Venom_RAT_HVNC_Mutex_Venom RAT_HVNC

Attributes

delay
1
install
true
install_file
SpotifyICL.exe
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Roaming\SpotifyICL.exe	family_asyncrat

Executes dropped EXE 1 IoCs

Processes:

SpotifyICL.exe

pid process

6084 SpotifyICL.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

924 timeout.exe
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exe

pid process

1216 schtasks.exe

pid	process
6084	SpotifyICL.exe

pid	process
924	timeout.exe

pid	process
1216	schtasks.exe

Suspicious behavior: EnumeratesProcesses 19 IoCs

Processes:

SpotifyPatch.exe

pid	process
3576	SpotifyPatch.exe
3576	SpotifyPatch.exe
3576	SpotifyPatch.exe
3576	SpotifyPatch.exe
3576	SpotifyPatch.exe
3576	SpotifyPatch.exe
3576	SpotifyPatch.exe
3576	SpotifyPatch.exe
3576	SpotifyPatch.exe
3576	SpotifyPatch.exe
3576	SpotifyPatch.exe
3576	SpotifyPatch.exe
3576	SpotifyPatch.exe
3576	SpotifyPatch.exe
3576	SpotifyPatch.exe
3576	SpotifyPatch.exe
3576	SpotifyPatch.exe
3576	SpotifyPatch.exe
3576	SpotifyPatch.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

SpotifyPatch.exeSpotifyICL.exe

description pid process

Token: SeDebugPrivilege 3576 SpotifyPatch.exe
Token: SeDebugPrivilege 6084 SpotifyICL.exe

description	pid	process
Token: SeDebugPrivilege	3576	SpotifyPatch.exe
Token: SeDebugPrivilege	6084	SpotifyICL.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

SpotifyPatch.execmd.execmd.exe

description	pid	process	target process
PID 3576 wrote to memory of 3052	3576	SpotifyPatch.exe	cmd.exe
PID 3576 wrote to memory of 3052	3576	SpotifyPatch.exe	cmd.exe
PID 3576 wrote to memory of 4456	3576	SpotifyPatch.exe	cmd.exe
PID 3576 wrote to memory of 4456	3576	SpotifyPatch.exe	cmd.exe
PID 4456 wrote to memory of 924	4456	cmd.exe	timeout.exe
PID 4456 wrote to memory of 924	4456	cmd.exe	timeout.exe
PID 3052 wrote to memory of 1216	3052	cmd.exe	schtasks.exe
PID 3052 wrote to memory of 1216	3052	cmd.exe	schtasks.exe
PID 4456 wrote to memory of 6084	4456	cmd.exe	SpotifyICL.exe
PID 4456 wrote to memory of 6084	4456	cmd.exe	SpotifyICL.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\SpotifyPatch.exe
"C:\Users\Admin\AppData\Local\Temp\SpotifyPatch.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3576

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "SpotifyICL" /tr '"C:\Users\Admin\AppData\Roaming\SpotifyICL.exe"' & exit
2⤵
- Suspicious use of WriteProcessMemory
PID:3052

C:\Windows\system32\schtasks.exe
schtasks /create /f /sc onlogon /rl highest /tn "SpotifyICL" /tr '"C:\Users\Admin\AppData\Roaming\SpotifyICL.exe"'
3⤵
- Scheduled Task/Job: Scheduled Task
PID:1216

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpBB03.tmp.bat""
2⤵
- Suspicious use of WriteProcessMemory
PID:4456

C:\Windows\system32\timeout.exe
timeout 3
3⤵
- Delays execution with timeout.exe
PID:924

C:\Users\Admin\AppData\Roaming\SpotifyICL.exe
"C:\Users\Admin\AppData\Roaming\SpotifyICL.exe"
3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:6084

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpBB03.tmp.bat

Filesize
154B

MD5
ff21a613b5b41cb5991bc5c085663569

SHA1
2a872eb4c781940ebe76093eaa79ce3a31abda75

SHA256
59d24e10605ecbd2639b6f1c94619351f257f4e0ebb1e91f87ff669eff5ab032

SHA512
7bb4ccab817e278af6ca8f96c40754295174c1aaeaeafad630156193bf21e4d82cb33b0dd7a03e0b90897f8c9bef266bebb47751f8f9a667aaa90d88cf486743

Download Submit
C:\Users\Admin\AppData\Roaming\SpotifyICL.exe

Filesize
129KB

MD5
4ed5ceebb1fd4b6bbc4eb963676f4ac1

SHA1
b3c2f3900fa231849697c008c3deedbf0d2510f4

SHA256
08f7f44b07fb6e06a731314aaaaa0d4ee2aa1f98b3ce45437e5b150c0ba6575e

SHA512
cbc6a1f5a07dedeee42bc50a731a83f2d8eb6faf918484e16d947f7f0c041e3203ac151b75017d2418b054e6e4f6b09efd75f2bdb4fdcb7efcc10b44c7ad3664

Download Submit
memory/3576-0-0x00007FFD8E2D3000-0x00007FFD8E2D5000-memory.dmp

Filesize
8KB

Download
memory/3576-1-0x0000000000D60000-0x0000000000D86000-memory.dmp

Filesize
152KB

Download
memory/3576-2-0x00007FFD8E2D0000-0x00007FFD8ED92000-memory.dmp

Filesize
10.8MB

Download
memory/3576-3-0x00007FFD8E2D0000-0x00007FFD8ED92000-memory.dmp

Filesize
10.8MB

Download
memory/3576-8-0x00007FFD8E2D0000-0x00007FFD8ED92000-memory.dmp

Filesize
10.8MB

Download