asyncrat | b63bf28780e02bf0bb1bb59dec135e6263f4c582724c95eee0519b279022f31c

Analysis

max time kernel
282s
max time network
293s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
30-09-2024 05:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b63bf28780e02bf0bb1bb59dec135e6263f4c582724c95eee0519b279022f31c.exe
Size

810KB
MD5

87c051a77edc0cc77a4d791ef72367d1
SHA1

5d5bab642235f0af7d9afe3cacec5ae2a4cfc8e5
SHA256

b63bf28780e02bf0bb1bb59dec135e6263f4c582724c95eee0519b279022f31c
SHA512

259a3f823d5051fcc9e87ceacf25557ab17f5d26ff4f0c17801d9ef83a23d2a51261a73e5ba9c3caf1ca2feb18a569458f17a2a5d56b542b86d6a124a42d4c2c
SSDEEP

12288:FCxMe2dk7YgL+OsQdFGHjaRYf9bquEZ68ufU3wqB2ydPsW/w0bvf:FsMe2KYIDpSO5vZ68FwqB2aPsW3

Score

10^/10

asyncrat default discovery rat

Malware Config

Extracted

Family

asyncrat

Version

Venom RAT + HVNC + Stealer + Grabber v6.0.2

Botnet

Default

47.238.55.14:4449

Mutex

rqwcncaesrdtlckoweu

Attributes

delay
1
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

Processes:

Thermal.pif

description pid process target process

PID 2560 created 1196 2560 Thermal.pif Explorer.EXE

description	pid	process	target process
PID 2560 created 1196	2560	Thermal.pif	Explorer.EXE

Drops startup file 2 IoCs

Processes:

cmd.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HermesKey.url	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HermesKey.url	cmd.exe

Executes dropped EXE 2 IoCs

Processes:

Thermal.pifRegAsm.exe

pid process

2560 Thermal.pif
1224 RegAsm.exe
Loads dropped DLL 3 IoCs

Processes:

cmd.exeThermal.pifRegAsm.exe

pid process

1056 cmd.exe
2560 Thermal.pif
1224 RegAsm.exe
Enumerates processes with tasklist 1 TTPs 2 IoCs
discovery

Process Discovery
T1057

Processes:

tasklist.exetasklist.exe

pid process

2064 tasklist.exe
2852 tasklist.exe

pid	process
1056	cmd.exe
2560	Thermal.pif
1224	RegAsm.exe

pid	process
2064	tasklist.exe
2852	tasklist.exe

Drops file in Windows directory 6 IoCs

Processes:

b63bf28780e02bf0bb1bb59dec135e6263f4c582724c95eee0519b279022f31c.exe

description	ioc	process
File opened for modification	C:\Windows\FirewireBros	b63bf28780e02bf0bb1bb59dec135e6263f4c582724c95eee0519b279022f31c.exe
File opened for modification	C:\Windows\PortugalCharges	b63bf28780e02bf0bb1bb59dec135e6263f4c582724c95eee0519b279022f31c.exe
File opened for modification	C:\Windows\PgJune	b63bf28780e02bf0bb1bb59dec135e6263f4c582724c95eee0519b279022f31c.exe
File opened for modification	C:\Windows\ReceptorsTeeth	b63bf28780e02bf0bb1bb59dec135e6263f4c582724c95eee0519b279022f31c.exe
File opened for modification	C:\Windows\PorcelainExhaust	b63bf28780e02bf0bb1bb59dec135e6263f4c582724c95eee0519b279022f31c.exe
File opened for modification	C:\Windows\MonsterRaymond	b63bf28780e02bf0bb1bb59dec135e6263f4c582724c95eee0519b279022f31c.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

RegAsm.exefindstr.exetasklist.exefindstr.exefindstr.exeThermal.pifchoice.execmd.exeb63bf28780e02bf0bb1bb59dec135e6263f4c582724c95eee0519b279022f31c.execmd.exetasklist.execmd.execmd.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Thermal.pif
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b63bf28780e02bf0bb1bb59dec135e6263f4c582724c95eee0519b279022f31c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: EnumeratesProcesses 29 IoCs

Processes:

Thermal.pifRegAsm.exe

pid	process
2560	Thermal.pif
2560	Thermal.pif
2560	Thermal.pif
2560	Thermal.pif
2560	Thermal.pif
2560	Thermal.pif
2560	Thermal.pif
2560	Thermal.pif
2560	Thermal.pif
2560	Thermal.pif
2560	Thermal.pif
2560	Thermal.pif
2560	Thermal.pif
2560	Thermal.pif
2560	Thermal.pif
2560	Thermal.pif
1224	RegAsm.exe
1224	RegAsm.exe
1224	RegAsm.exe
1224	RegAsm.exe
1224	RegAsm.exe
1224	RegAsm.exe
1224	RegAsm.exe
1224	RegAsm.exe
1224	RegAsm.exe
1224	RegAsm.exe
1224	RegAsm.exe
1224	RegAsm.exe
1224	RegAsm.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

tasklist.exetasklist.exeRegAsm.exe

description pid process

Token: SeDebugPrivilege 2064 tasklist.exe
Token: SeDebugPrivilege 2852 tasklist.exe
Token: SeDebugPrivilege 1224 RegAsm.exe
Suspicious use of FindShellTrayWindow 3 IoCs

Processes:

Thermal.pif

pid process

2560 Thermal.pif
2560 Thermal.pif
2560 Thermal.pif
Suspicious use of SendNotifyMessage 3 IoCs

Processes:

Thermal.pif

pid process

2560 Thermal.pif
2560 Thermal.pif
2560 Thermal.pif
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

RegAsm.exe

pid process

1224 RegAsm.exe

description	pid	process
Token: SeDebugPrivilege	2064	tasklist.exe
Token: SeDebugPrivilege	2852	tasklist.exe
Token: SeDebugPrivilege	1224	RegAsm.exe

pid	process
1224	RegAsm.exe

Suspicious use of WriteProcessMemory 53 IoCs

Processes:

b63bf28780e02bf0bb1bb59dec135e6263f4c582724c95eee0519b279022f31c.execmd.exeThermal.pif

description	pid	process	target process
PID 2080 wrote to memory of 1056	2080	b63bf28780e02bf0bb1bb59dec135e6263f4c582724c95eee0519b279022f31c.exe	cmd.exe
PID 2080 wrote to memory of 1056	2080	b63bf28780e02bf0bb1bb59dec135e6263f4c582724c95eee0519b279022f31c.exe	cmd.exe
PID 2080 wrote to memory of 1056	2080	b63bf28780e02bf0bb1bb59dec135e6263f4c582724c95eee0519b279022f31c.exe	cmd.exe
PID 2080 wrote to memory of 1056	2080	b63bf28780e02bf0bb1bb59dec135e6263f4c582724c95eee0519b279022f31c.exe	cmd.exe
PID 1056 wrote to memory of 2064	1056	cmd.exe	tasklist.exe
PID 1056 wrote to memory of 2064	1056	cmd.exe	tasklist.exe
PID 1056 wrote to memory of 2064	1056	cmd.exe	tasklist.exe
PID 1056 wrote to memory of 2064	1056	cmd.exe	tasklist.exe
PID 1056 wrote to memory of 2688	1056	cmd.exe	findstr.exe
PID 1056 wrote to memory of 2688	1056	cmd.exe	findstr.exe
PID 1056 wrote to memory of 2688	1056	cmd.exe	findstr.exe
PID 1056 wrote to memory of 2688	1056	cmd.exe	findstr.exe
PID 1056 wrote to memory of 2852	1056	cmd.exe	tasklist.exe
PID 1056 wrote to memory of 2852	1056	cmd.exe	tasklist.exe
PID 1056 wrote to memory of 2852	1056	cmd.exe	tasklist.exe
PID 1056 wrote to memory of 2852	1056	cmd.exe	tasklist.exe
PID 1056 wrote to memory of 2720	1056	cmd.exe	findstr.exe
PID 1056 wrote to memory of 2720	1056	cmd.exe	findstr.exe
PID 1056 wrote to memory of 2720	1056	cmd.exe	findstr.exe
PID 1056 wrote to memory of 2720	1056	cmd.exe	findstr.exe
PID 1056 wrote to memory of 2584	1056	cmd.exe	cmd.exe
PID 1056 wrote to memory of 2584	1056	cmd.exe	cmd.exe
PID 1056 wrote to memory of 2584	1056	cmd.exe	cmd.exe
PID 1056 wrote to memory of 2584	1056	cmd.exe	cmd.exe
PID 1056 wrote to memory of 2580	1056	cmd.exe	findstr.exe
PID 1056 wrote to memory of 2580	1056	cmd.exe	findstr.exe
PID 1056 wrote to memory of 2580	1056	cmd.exe	findstr.exe
PID 1056 wrote to memory of 2580	1056	cmd.exe	findstr.exe
PID 1056 wrote to memory of 2728	1056	cmd.exe	cmd.exe
PID 1056 wrote to memory of 2728	1056	cmd.exe	cmd.exe
PID 1056 wrote to memory of 2728	1056	cmd.exe	cmd.exe
PID 1056 wrote to memory of 2728	1056	cmd.exe	cmd.exe
PID 1056 wrote to memory of 2560	1056	cmd.exe	Thermal.pif
PID 1056 wrote to memory of 2560	1056	cmd.exe	Thermal.pif
PID 1056 wrote to memory of 2560	1056	cmd.exe	Thermal.pif
PID 1056 wrote to memory of 2560	1056	cmd.exe	Thermal.pif
PID 1056 wrote to memory of 2624	1056	cmd.exe	choice.exe
PID 1056 wrote to memory of 2624	1056	cmd.exe	choice.exe
PID 1056 wrote to memory of 2624	1056	cmd.exe	choice.exe
PID 1056 wrote to memory of 2624	1056	cmd.exe	choice.exe
PID 2560 wrote to memory of 3068	2560	Thermal.pif	cmd.exe
PID 2560 wrote to memory of 3068	2560	Thermal.pif	cmd.exe
PID 2560 wrote to memory of 3068	2560	Thermal.pif	cmd.exe
PID 2560 wrote to memory of 3068	2560	Thermal.pif	cmd.exe
PID 2560 wrote to memory of 1224	2560	Thermal.pif	RegAsm.exe
PID 2560 wrote to memory of 1224	2560	Thermal.pif	RegAsm.exe
PID 2560 wrote to memory of 1224	2560	Thermal.pif	RegAsm.exe
PID 2560 wrote to memory of 1224	2560	Thermal.pif	RegAsm.exe
PID 2560 wrote to memory of 1224	2560	Thermal.pif	RegAsm.exe
PID 2560 wrote to memory of 1224	2560	Thermal.pif	RegAsm.exe
PID 2560 wrote to memory of 1224	2560	Thermal.pif	RegAsm.exe
PID 2560 wrote to memory of 1224	2560	Thermal.pif	RegAsm.exe
PID 2560 wrote to memory of 1224	2560	Thermal.pif	RegAsm.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1196

C:\Users\Admin\AppData\Local\Temp\b63bf28780e02bf0bb1bb59dec135e6263f4c582724c95eee0519b279022f31c.exe
"C:\Users\Admin\AppData\Local\Temp\b63bf28780e02bf0bb1bb59dec135e6263f4c582724c95eee0519b279022f31c.exe"
2⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2080

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c move Hammer Hammer.bat & Hammer.bat
3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1056

C:\Windows\SysWOW64\tasklist.exe
tasklist
4⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2064

C:\Windows\SysWOW64\findstr.exe
findstr /I "wrsa opssvc"
4⤵
- System Location Discovery: System Language Discovery
PID:2688

C:\Windows\SysWOW64\tasklist.exe
tasklist
4⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2852

C:\Windows\SysWOW64\findstr.exe
findstr /I "avastui avgui bdservicehost nswscsvc sophoshealth"
4⤵
- System Location Discovery: System Language Discovery
PID:2720

C:\Windows\SysWOW64\cmd.exe
cmd /c md 724598
4⤵
- System Location Discovery: System Language Discovery
PID:2584

C:\Windows\SysWOW64\findstr.exe
findstr /V "WowLiberalCalOfficer" Weight
4⤵
- System Location Discovery: System Language Discovery
PID:2580

C:\Windows\SysWOW64\cmd.exe
cmd /c copy /b ..\Explorer + ..\West + ..\Agencies + ..\Situated y
4⤵
- System Location Discovery: System Language Discovery
PID:2728

C:\Users\Admin\AppData\Local\Temp\724598\Thermal.pif
Thermal.pif y
4⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2560

C:\Users\Admin\AppData\Local\Temp\724598\RegAsm.exe
C:\Users\Admin\AppData\Local\Temp\724598\RegAsm.exe
5⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1224

C:\Windows\SysWOW64\choice.exe
choice /d y /t 5
4⤵
- System Location Discovery: System Language Discovery
PID:2624

C:\Windows\SysWOW64\cmd.exe
cmd /k echo [InternetShortcut] > "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HermesKey.url" & echo URL="C:\Users\Admin\AppData\Local\GuardKey Solutions\HermesKey.js" >> "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HermesKey.url" & exit
2⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:3068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\724598\y

Filesize
254KB

MD5
a65498ab3a69a64ead790db5bb2f48aa

SHA1
eb8cd723dab355ff507b356b9286f09b9ffcd968

SHA256
9ad27753646f1eec5009be7ed43bcdfc4e9ab8dffc6fe3ff4adc558a1f32f5cd

SHA512
9cfcb7873c3bad12109a85516eaf62393aa905b5a7fa93e8bc808ef0911070ea89f0e41953e67b45b74409bf0ac046fd7f4a12ab612edf7bf01a46c459ba1cef

Download Submit
C:\Users\Admin\AppData\Local\Temp\Agencies

Filesize
90KB

MD5
975bfc19287c2c5b74a1b228f30f14b0

SHA1
8f5feec00b337529a7e193f452c45f6063ad37a1

SHA256
91e28eface5e10865887b9a13420b1bfd3a8673255785e3bfc65745da63d1322

SHA512
18d8c41ebcba5667cb3ac3fa1270d78cad2fd9e8fc69dd32969b693fedc6354e3de12f74830e68b55c6aa7c5a0fbb388599f827cb94d71732231f4ebbf580f85

Download Submit
C:\Users\Admin\AppData\Local\Temp\Explorer

Filesize
58KB

MD5
01d7374bf51507454392d1081d9b309e

SHA1
034378159b5f4b6089a95064aec9ff210da7c3df

SHA256
eecdd8dfd2dd6d9d1c55077ee6515a9c59d3046112d014b7a5e87fdabb8157a2

SHA512
de64b35bfd2c279a77d552f7c518421bffcf2f5d14e78fa3f80e21b97aeb5dc287340452d61ca19c9aa5ce426c61ec6605786727d844282aa5457a1d8c4f94f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Hammer

Filesize
17KB

MD5
f15a876fe95af76d09e4f26593b4502e

SHA1
53d14a9f7b44de6fd9aba018e0f4738175a4e3a0

SHA256
4ddf695422db24b6917750a923db6d55e9973a4463cf3b60f0c732d34f7728d1

SHA512
cbc944366518fea910cc685c6ac99caafa20ffd91ba8572b5e33feeb9529cea6684e83365c5851d6798bcd3dc265e9157ae80e60f56f061c2b78e6c935e48741

Download Submit
C:\Users\Admin\AppData\Local\Temp\Ought

Filesize
865KB

MD5
260377b64080b872ffd57234ff7d097e

SHA1
f9ea953f328a1ec1cac31ac05a6353ae27519238

SHA256
29826de3343c0a6f753f3cdcc551e755e12059e79b0658be1048e5f893e1c0d3

SHA512
a01a781d352ac7cb98fd17f91db6114147188519819106d27a183f8bc114713de8d0e78524dcab8833187e365f2207da5e4cd77fc8d787f63b48a04bf17b6de5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Situated

Filesize
10KB

MD5
b5a2ce2534752d3a6033f59c8436d7b6

SHA1
8e184055af6e0f7dcd83d832bd565e784a7b8e80

SHA256
c142ebc3005012c982b366c6e4b03db5b477c721eed245592a6f2c585ec314c3

SHA512
c2f5480e23fcd32ac7111fc9e507b7660ee551477a1dc18f188bd5796bf29bc93cc10926908f9f6483e906bfc07dde07be7223bc0b4b4c5dbc0fa1c0f2d43f2c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Weight

Filesize
7KB

MD5
4192ba712a2fdc09914b07d144f06e20

SHA1
0a3320eea12b490fd589b9f2cb878579108be555

SHA256
265661fdddd79aefcfba0fc456cf864c05439b8281da8345d200283f5664a229

SHA512
543248b976f061c835329adbccbb249922ebeb671bb158d7a0e70284e0fe9d723c18e8a2e4f198202cfa20dc3d0f341efd4e78c64f4d5e56e8d2a08745417948

Download Submit
C:\Users\Admin\AppData\Local\Temp\West

Filesize
96KB

MD5
b7c64d91870c30f6d27b86c9294ca361

SHA1
41ea994169f7bea9752f6bd40d9833d6577ede49

SHA256
91a57858547382fa34e5aad2a6c8546c4eaeaa32b515693e42e84ad190149a6a

SHA512
d6d3625a28a8ab2aad5e5e80cb10798d3602e0e189d521e4fecbee4f4015f07e7d2c6f9cdbec4c9efcc5c903c3ebaaf9b6abbf30d615748316992a5c398bc1b6

Download Submit
\Users\Admin\AppData\Local\Temp\724598\RegAsm.exe

Filesize
63KB

MD5
b58b926c3574d28d5b7fdd2ca3ec30d5

SHA1
d260c4ffd603a9cfc057fcb83d678b1cecdf86f9

SHA256
6e70b56d748c4ccab13cc8a055d3795ea0dd95fe3b70568d7d3ac0c6621140a3

SHA512
b13cb998822b716b695013bcd6dec62a2290567d0d1743b2d982ca084235cf69c6ea1fc91c9d4e62657c6f9e102c7c60e81296ab055ffe43b887c5f8ec8958ab

Download Submit
\Users\Admin\AppData\Local\Temp\724598\Thermal.pif

Filesize
872KB

MD5
18ce19b57f43ce0a5af149c96aecc685

SHA1
1bd5ca29fc35fc8ac346f23b155337c5b28bbc36

SHA256
d8b7c7178fbadbf169294e4f29dce582f89a5cf372e9da9215aa082330dc12fd

SHA512
a0c58f04dfb49272a2b6f1e8ce3f541a030a6c7a09bb040e660fc4cd9892ca3ac39cf3d6754c125f7cd1987d1fca01640a153519b4e2eb3e3b4b8c9dc1480558

Download Submit
memory/1224-33-0x0000000000090000-0x00000000000A8000-memory.dmp

Filesize
96KB

Download
memory/1224-35-0x0000000000090000-0x00000000000A8000-memory.dmp

Filesize
96KB

Download
memory/1224-36-0x0000000000090000-0x00000000000A8000-memory.dmp

Filesize
96KB

Download