asyncrat | e4a36be98f730d706d2ca97a5d687329a1cc7d4848daf698b7e21b6b9b577f31

Analysis

max time kernel
300s
max time network
300s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
30-09-2024 05:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e4a36be98f730d706d2ca97a5d687329a1cc7d4848daf698b7e21b6b9b577f31.exe
Size

3.5MB
MD5

b3fd0e1003b1cd38402b6d32829f6135
SHA1

c9cedd6322fb83457f56b64b4624b07e2786f702
SHA256

e4a36be98f730d706d2ca97a5d687329a1cc7d4848daf698b7e21b6b9b577f31
SHA512

04692e0f80a75f78b533677cefe3db6607108abf19963d88e231925cfa13f1ec054811aebe53c82d238e732a999cd8d176107d50cf2ea5694d4177cbfd3b30f1
SSDEEP

49152:KXSBgOQSMWnpCkICTugfaU6vTN4Z6WSk7s7jsjS4znnqyIn7TrvU:KygOQSVpC/CHMTWk8zn

Score

10^/10

asyncrat discovery persistence rat

Malware Config

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Executes dropped EXE 2 IoCs

Processes:

neon.exeneon.exe

pid process

2348 neon.exe
2768 neon.exe

pid	process
2348	neon.exe
2768	neon.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

reg.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Software\Microsoft\Windows\CurrentVersion\Run\neon = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\neon.exe"	reg.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

e4a36be98f730d706d2ca97a5d687329a1cc7d4848daf698b7e21b6b9b577f31.exe

description	pid	process	target process
PID 4748 set thread context of 4676	4748	e4a36be98f730d706d2ca97a5d687329a1cc7d4848daf698b7e21b6b9b577f31.exe	InstallUtil.exe
PID 4748 set thread context of 4904	4748	e4a36be98f730d706d2ca97a5d687329a1cc7d4848daf698b7e21b6b9b577f31.exe	InstallUtil.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

neon.exeneon.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	neon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	neon.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
discovery

Internet Connection Discovery
T1016.001

Processes:

cmd.exePING.EXE

pid process

668 cmd.exe
2900 PING.EXE
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

2900 PING.EXE

pid	process
668	cmd.exe
2900	PING.EXE

pid	process
2900	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

e4a36be98f730d706d2ca97a5d687329a1cc7d4848daf698b7e21b6b9b577f31.exeneon.exeneon.exeInstallUtil.exe

pid	process
4748	e4a36be98f730d706d2ca97a5d687329a1cc7d4848daf698b7e21b6b9b577f31.exe
4748	e4a36be98f730d706d2ca97a5d687329a1cc7d4848daf698b7e21b6b9b577f31.exe
4748	e4a36be98f730d706d2ca97a5d687329a1cc7d4848daf698b7e21b6b9b577f31.exe
4748	e4a36be98f730d706d2ca97a5d687329a1cc7d4848daf698b7e21b6b9b577f31.exe
2348	neon.exe
2768	neon.exe
2768	neon.exe
2768	neon.exe
4748	e4a36be98f730d706d2ca97a5d687329a1cc7d4848daf698b7e21b6b9b577f31.exe
4748	e4a36be98f730d706d2ca97a5d687329a1cc7d4848daf698b7e21b6b9b577f31.exe
4748	e4a36be98f730d706d2ca97a5d687329a1cc7d4848daf698b7e21b6b9b577f31.exe
4904	InstallUtil.exe
4904	InstallUtil.exe
4904	InstallUtil.exe
4904	InstallUtil.exe
4904	InstallUtil.exe
4904	InstallUtil.exe
4904	InstallUtil.exe
4904	InstallUtil.exe
4904	InstallUtil.exe
4904	InstallUtil.exe
4904	InstallUtil.exe
4904	InstallUtil.exe
4904	InstallUtil.exe
4904	InstallUtil.exe
4904	InstallUtil.exe
4904	InstallUtil.exe
4904	InstallUtil.exe
4904	InstallUtil.exe
4904	InstallUtil.exe
4904	InstallUtil.exe
4904	InstallUtil.exe
4904	InstallUtil.exe
4904	InstallUtil.exe
4904	InstallUtil.exe
4904	InstallUtil.exe
4904	InstallUtil.exe
4904	InstallUtil.exe
4904	InstallUtil.exe
4904	InstallUtil.exe
4904	InstallUtil.exe
4904	InstallUtil.exe
4904	InstallUtil.exe
4904	InstallUtil.exe
4904	InstallUtil.exe
4904	InstallUtil.exe
4904	InstallUtil.exe
4904	InstallUtil.exe
4904	InstallUtil.exe
4904	InstallUtil.exe
4904	InstallUtil.exe
4904	InstallUtil.exe
4904	InstallUtil.exe
4904	InstallUtil.exe
4904	InstallUtil.exe
4904	InstallUtil.exe
4904	InstallUtil.exe
4904	InstallUtil.exe
4904	InstallUtil.exe
4904	InstallUtil.exe
4904	InstallUtil.exe
4904	InstallUtil.exe
4904	InstallUtil.exe
4904	InstallUtil.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

e4a36be98f730d706d2ca97a5d687329a1cc7d4848daf698b7e21b6b9b577f31.exeneon.exeneon.exeInstallUtil.exe

description	pid	process
Token: SeDebugPrivilege	4748	e4a36be98f730d706d2ca97a5d687329a1cc7d4848daf698b7e21b6b9b577f31.exe
Token: SeDebugPrivilege	2348	neon.exe
Token: SeDebugPrivilege	2768	neon.exe
Token: SeDebugPrivilege	4904	InstallUtil.exe

Suspicious use of WriteProcessMemory 25 IoCs

Processes:

e4a36be98f730d706d2ca97a5d687329a1cc7d4848daf698b7e21b6b9b577f31.execmd.exeneon.exe

description	pid	process	target process
PID 4748 wrote to memory of 668	4748	e4a36be98f730d706d2ca97a5d687329a1cc7d4848daf698b7e21b6b9b577f31.exe	cmd.exe
PID 4748 wrote to memory of 668	4748	e4a36be98f730d706d2ca97a5d687329a1cc7d4848daf698b7e21b6b9b577f31.exe	cmd.exe
PID 668 wrote to memory of 2900	668	cmd.exe	PING.EXE
PID 668 wrote to memory of 2900	668	cmd.exe	PING.EXE
PID 4748 wrote to memory of 4676	4748	e4a36be98f730d706d2ca97a5d687329a1cc7d4848daf698b7e21b6b9b577f31.exe	InstallUtil.exe
PID 4748 wrote to memory of 4676	4748	e4a36be98f730d706d2ca97a5d687329a1cc7d4848daf698b7e21b6b9b577f31.exe	InstallUtil.exe
PID 4748 wrote to memory of 4676	4748	e4a36be98f730d706d2ca97a5d687329a1cc7d4848daf698b7e21b6b9b577f31.exe	InstallUtil.exe
PID 4748 wrote to memory of 4676	4748	e4a36be98f730d706d2ca97a5d687329a1cc7d4848daf698b7e21b6b9b577f31.exe	InstallUtil.exe
PID 4748 wrote to memory of 4676	4748	e4a36be98f730d706d2ca97a5d687329a1cc7d4848daf698b7e21b6b9b577f31.exe	InstallUtil.exe
PID 4748 wrote to memory of 4676	4748	e4a36be98f730d706d2ca97a5d687329a1cc7d4848daf698b7e21b6b9b577f31.exe	InstallUtil.exe
PID 4748 wrote to memory of 4676	4748	e4a36be98f730d706d2ca97a5d687329a1cc7d4848daf698b7e21b6b9b577f31.exe	InstallUtil.exe
PID 668 wrote to memory of 596	668	cmd.exe	reg.exe
PID 668 wrote to memory of 596	668	cmd.exe	reg.exe
PID 4748 wrote to memory of 4904	4748	e4a36be98f730d706d2ca97a5d687329a1cc7d4848daf698b7e21b6b9b577f31.exe	InstallUtil.exe
PID 4748 wrote to memory of 4904	4748	e4a36be98f730d706d2ca97a5d687329a1cc7d4848daf698b7e21b6b9b577f31.exe	InstallUtil.exe
PID 4748 wrote to memory of 4904	4748	e4a36be98f730d706d2ca97a5d687329a1cc7d4848daf698b7e21b6b9b577f31.exe	InstallUtil.exe
PID 4748 wrote to memory of 4904	4748	e4a36be98f730d706d2ca97a5d687329a1cc7d4848daf698b7e21b6b9b577f31.exe	InstallUtil.exe
PID 4748 wrote to memory of 4904	4748	e4a36be98f730d706d2ca97a5d687329a1cc7d4848daf698b7e21b6b9b577f31.exe	InstallUtil.exe
PID 4748 wrote to memory of 4904	4748	e4a36be98f730d706d2ca97a5d687329a1cc7d4848daf698b7e21b6b9b577f31.exe	InstallUtil.exe
PID 4748 wrote to memory of 2348	4748	e4a36be98f730d706d2ca97a5d687329a1cc7d4848daf698b7e21b6b9b577f31.exe	neon.exe
PID 4748 wrote to memory of 2348	4748	e4a36be98f730d706d2ca97a5d687329a1cc7d4848daf698b7e21b6b9b577f31.exe	neon.exe
PID 4748 wrote to memory of 2348	4748	e4a36be98f730d706d2ca97a5d687329a1cc7d4848daf698b7e21b6b9b577f31.exe	neon.exe
PID 2348 wrote to memory of 2768	2348	neon.exe	neon.exe
PID 2348 wrote to memory of 2768	2348	neon.exe	neon.exe
PID 2348 wrote to memory of 2768	2348	neon.exe	neon.exe

C:\Users\Admin\AppData\Local\Temp\e4a36be98f730d706d2ca97a5d687329a1cc7d4848daf698b7e21b6b9b577f31.exe
"C:\Users\Admin\AppData\Local\Temp\e4a36be98f730d706d2ca97a5d687329a1cc7d4848daf698b7e21b6b9b577f31.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4748

C:\Windows\SYSTEM32\cmd.exe
"cmd" /c ping 127.0.0.1 -n 10 > nul && REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "neon" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\neon.exe"
2⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:668

C:\Windows\system32\PING.EXE
ping 127.0.0.1 -n 10
3⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2900

C:\Windows\system32\reg.exe
REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "neon" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\neon.exe"
3⤵
- Adds Run key to start application
PID:596

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"
2⤵
PID:4676

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4904

C:\Users\Admin\AppData\Local\Temp\neon.exe
"C:\Users\Admin\AppData\Local\Temp\neon.exe"
2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2348

C:\Users\Admin\AppData\Local\Temp\neon.exe
"C:\Users\Admin\AppData\Local\Temp\neon.exe"
3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2768

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\neon.exe.log

Filesize
1KB

MD5
e555c48cb712a9597ecb55a60135d1f8

SHA1
2081c72d30c34ec3f61f9944545ecdaae11521f7

SHA256
815c80df060afa8acf7640ca011735ef77c66666d03901e04a8767827d5da4e9

SHA512
32129b5be15217e5400f1e7536270a703d62db60ebb06396b9d74703e6a0dcd2e78f7f42b2019093be1508a9310912f305b88de274a295c9135a4086cd8c8427

Download Submit
C:\Users\Admin\AppData\Local\Temp\neon.exe

Filesize
76KB

MD5
0e362e7005823d0bec3719b902ed6d62

SHA1
590d860b909804349e0cdc2f1662b37bd62f7463

SHA256
2d0dc6216f613ac7551a7e70a798c22aee8eb9819428b1357e2b8c73bef905ad

SHA512
518991b68496b3f8545e418cf9b345e0791e09cc20d177b8aa47e0aba447aa55383c64f5bdaca39f2b061a5d08c16f2ad484af8a9f238ca23ab081618fba3ad3

Download Submit
C:\Users\Admin\AppData\Local\Temp\neon.txt

Filesize
113B

MD5
09515d8c79dd97b800512319b50e3b61

SHA1
9f356676a07ed3923f3b3cf69387b5e5c927c7f6

SHA256
a9854bbceab163ebfcdba110f5075d717eac418390fa012089b5ab70fb9ebfe8

SHA512
9eba1ed32c51d5b8af58fffbd2dc03e672065968520a85d098d9c970bf9fd673d5a9899c6d1a4328e205dbf86c84ff5c06149420adb9038af5f6b479ec8d00de

Download Submit
C:\Users\Admin\AppData\Local\Temp\neon.txt

Filesize
116B

MD5
911f4096d105745f095b64114f8ce07c

SHA1
dc6c3bb403f2b03d4979bc320616d762204a7272

SHA256
43e52270be473758d9878ed26a71e865c3ae8161b811f2e7a90c4643da443d98

SHA512
0b1357116d173cf416f117ebba92e152578ddfd6889efbe43eb041a2a821ca82e718e7d631e7be7daddf863838a67e38c08eaa77f88405afc30f33a8856df4d0

Download Submit
memory/2348-202-0x0000000000A60000-0x0000000000A7A000-memory.dmp

Filesize
104KB

Download
memory/2348-203-0x0000000005290000-0x000000000532C000-memory.dmp

Filesize
624KB

Download
memory/4748-39-0x0000000023C80000-0x0000000023C8B000-memory.dmp

Filesize
44KB

Download
memory/4748-7-0x0000000000D60000-0x0000000000DDE000-memory.dmp

Filesize
504KB

Download
memory/4748-37-0x0000000023B60000-0x0000000023B77000-memory.dmp

Filesize
92KB

Download
memory/4748-4-0x0000000000180000-0x00000000001E3000-memory.dmp

Filesize
396KB

Download
memory/4748-5-0x0000000000950000-0x00000000009FE000-memory.dmp

Filesize
696KB

Download
memory/4748-11-0x00000000017C0000-0x00000000018E5000-memory.dmp

Filesize
1.1MB

Download
memory/4748-24-0x0000000000840000-0x000000000084A000-memory.dmp

Filesize
40KB

Download
memory/4748-23-0x0000000001E30000-0x0000000001E41000-memory.dmp

Filesize
68KB

Download
memory/4748-22-0x0000000002470000-0x000000000249D000-memory.dmp

Filesize
180KB

Download
memory/4748-21-0x00000000023D0000-0x000000000246A000-memory.dmp

Filesize
616KB

Download
memory/4748-20-0x0000000001E50000-0x0000000001E6E000-memory.dmp

Filesize
120KB

Download
memory/4748-42-0x0000000023E80000-0x0000000023ED6000-memory.dmp

Filesize
344KB

Download
memory/4748-43-0x0000000023EE0000-0x0000000023EF1000-memory.dmp

Filesize
68KB

Download
memory/4748-30-0x0000000021FA0000-0x00000000233D7000-memory.dmp

Filesize
20.2MB

Download
memory/4748-51-0x0000000026470000-0x000000002661C000-memory.dmp

Filesize
1.7MB

Download
memory/4748-50-0x00000000257A0000-0x00000000257A8000-memory.dmp

Filesize
32KB

Download
memory/4748-49-0x0000000025370000-0x0000000025630000-memory.dmp

Filesize
2.8MB

Download
memory/4748-48-0x0000000024D30000-0x0000000024DEF000-memory.dmp

Filesize
764KB

Download
memory/4748-47-0x0000000025200000-0x0000000025366000-memory.dmp

Filesize
1.4MB

Download
memory/4748-46-0x0000000024B90000-0x0000000024D25000-memory.dmp

Filesize
1.6MB

Download
memory/4748-45-0x0000000024B60000-0x0000000024B8A000-memory.dmp

Filesize
168KB

Download
memory/4748-44-0x0000000024990000-0x0000000024A36000-memory.dmp

Filesize
664KB

Download
memory/4748-41-0x0000000023CB0000-0x0000000023E79000-memory.dmp

Filesize
1.8MB

Download
memory/4748-40-0x0000000023C90000-0x0000000023CA4000-memory.dmp

Filesize
80KB

Download
memory/4748-1-0x0000000023F00000-0x0000000023F9E000-memory.dmp

Filesize
632KB

Download
memory/4748-38-0x0000000023C40000-0x0000000023C74000-memory.dmp

Filesize
208KB

Download
memory/4748-3-0x0000000026F40000-0x0000000026F46000-memory.dmp

Filesize
24KB

Download
memory/4748-2-0x0000000026F20000-0x0000000026F3A000-memory.dmp

Filesize
104KB

Download
memory/4748-12-0x0000000001CF0000-0x0000000001D8C000-memory.dmp

Filesize
624KB

Download
memory/4748-31-0x000000001F240000-0x000000001F289000-memory.dmp

Filesize
292KB

Download
memory/4748-36-0x0000000023B30000-0x0000000023B55000-memory.dmp

Filesize
148KB

Download
memory/4748-35-0x0000000021F70000-0x0000000021F85000-memory.dmp

Filesize
84KB

Download
memory/4748-34-0x0000000023AE0000-0x0000000023B2C000-memory.dmp

Filesize
304KB

Download
memory/4748-29-0x000000001F330000-0x000000001F45C000-memory.dmp

Filesize
1.2MB

Download
memory/4748-25-0x0000000003E00000-0x00000000047EC000-memory.dmp

Filesize
9.9MB

Download
memory/4748-28-0x0000000004AA0000-0x0000000004B35000-memory.dmp

Filesize
596KB

Download
memory/4748-27-0x000000001F0F0000-0x000000001F233000-memory.dmp

Filesize
1.3MB

Download
memory/4748-26-0x0000000004820000-0x0000000004917000-memory.dmp

Filesize
988KB

Download
memory/4748-19-0x0000000001DC0000-0x0000000001E2A000-memory.dmp

Filesize
424KB

Download
memory/4748-18-0x00000000024D0000-0x0000000002659000-memory.dmp

Filesize
1.5MB

Download
memory/4748-17-0x00000000022D0000-0x00000000023C6000-memory.dmp

Filesize
984KB

Download
memory/4748-16-0x0000000002180000-0x00000000022CA000-memory.dmp

Filesize
1.3MB

Download
memory/4748-15-0x0000000001D90000-0x0000000001DB7000-memory.dmp

Filesize
156KB

Download
memory/4748-14-0x0000000001E80000-0x0000000002179000-memory.dmp

Filesize
3.0MB

Download
memory/4748-32-0x0000000021EC0000-0x0000000021F6A000-memory.dmp

Filesize
680KB

Download
memory/4748-10-0x0000000001700000-0x0000000001759000-memory.dmp

Filesize
356KB

Download
memory/4748-0-0x0000000000ED0000-0x000000000124C000-memory.dmp

Filesize
3.5MB

Download
memory/4748-9-0x0000000000DE0000-0x0000000000E7D000-memory.dmp

Filesize
628KB

Download
memory/4748-8-0x0000000001250000-0x00000000012F1000-memory.dmp

Filesize
644KB

Download
memory/4748-33-0x00000000233E0000-0x0000000023AD2000-memory.dmp

Filesize
6.9MB

Download
memory/4748-6-0x0000000000A00000-0x0000000000C49000-memory.dmp

Filesize
2.3MB

Download
memory/4748-13-0x0000000001760000-0x00000000017B1000-memory.dmp

Filesize
324KB

Download
memory/4904-383-0x0000000040000000-0x0000000040030000-memory.dmp

Filesize
192KB

Download
memory/4904-384-0x000002B8E1070000-0x000002B8E109C000-memory.dmp

Filesize
176KB

Download