asyncrat | e366818fbcf3c6d6e4688373e93b4eed9970034455174c905b51c228dd704623

General

Target

captcha.exe
Size

47KB
MD5

cf9f5eb717b1fc8d8923197fd9ba131e
SHA1

f4b7b86c279a4ceaa0e484b46ed427c3de3c976a
SHA256

e366818fbcf3c6d6e4688373e93b4eed9970034455174c905b51c228dd704623
SHA512

7ffbac453b035b4374341c440bd0cd65d1bc004e7150a2d9a2bc7fc4003ed9f05eb30f66c520ba4f22d396ff581a0c91b857705dce0657349172784528833519
SSDEEP

768:BOEuILWCKi+DiPdPahD9S5iuKbCYbXge6WDoU4SvEgK/JrZVc6KN:BOtmR6UpKbhbwHdjSnkJrZVclN

Score

10^/10

asyncrat default discovery rat

Malware Config

Extracted

Family

asyncrat

Version

1.0.7

Botnet

Default

C2

127.0.0.1:8848

Mutex

DcRatMutex_qwqdanchun

Attributes

delay
1
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

Processes:

msedge.exemsedge.exemsedge.exe

pid process

800 msedge.exe
800 msedge.exe
4928 msedge.exe
4928 msedge.exe
4928 msedge.exe
3920 msedge.exe
3920 msedge.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

Processes:

msedge.exe

pid process

4928 msedge.exe
4928 msedge.exe
4928 msedge.exe
4928 msedge.exe
4928 msedge.exe
4928 msedge.exe
4928 msedge.exe
4928 msedge.exe

pid	process
800	msedge.exe
800	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
3920	msedge.exe
3920	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

Processes:

msedge.exe

pid	process
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 4928 wrote to memory of 2604	4928	msedge.exe	msedge.exe
PID 4928 wrote to memory of 2604	4928	msedge.exe	msedge.exe
PID 4928 wrote to memory of 3764	4928	msedge.exe	msedge.exe
PID 4928 wrote to memory of 3764	4928	msedge.exe	msedge.exe
PID 4928 wrote to memory of 3764	4928	msedge.exe	msedge.exe
PID 4928 wrote to memory of 3764	4928	msedge.exe	msedge.exe
PID 4928 wrote to memory of 3764	4928	msedge.exe	msedge.exe
PID 4928 wrote to memory of 3764	4928	msedge.exe	msedge.exe
PID 4928 wrote to memory of 3764	4928	msedge.exe	msedge.exe
PID 4928 wrote to memory of 3764	4928	msedge.exe	msedge.exe
PID 4928 wrote to memory of 3764	4928	msedge.exe	msedge.exe
PID 4928 wrote to memory of 3764	4928	msedge.exe	msedge.exe
PID 4928 wrote to memory of 3764	4928	msedge.exe	msedge.exe
PID 4928 wrote to memory of 3764	4928	msedge.exe	msedge.exe
PID 4928 wrote to memory of 3764	4928	msedge.exe	msedge.exe
PID 4928 wrote to memory of 3764	4928	msedge.exe	msedge.exe
PID 4928 wrote to memory of 3764	4928	msedge.exe	msedge.exe
PID 4928 wrote to memory of 3764	4928	msedge.exe	msedge.exe
PID 4928 wrote to memory of 3764	4928	msedge.exe	msedge.exe
PID 4928 wrote to memory of 3764	4928	msedge.exe	msedge.exe
PID 4928 wrote to memory of 3764	4928	msedge.exe	msedge.exe
PID 4928 wrote to memory of 3764	4928	msedge.exe	msedge.exe
PID 4928 wrote to memory of 3764	4928	msedge.exe	msedge.exe
PID 4928 wrote to memory of 3764	4928	msedge.exe	msedge.exe
PID 4928 wrote to memory of 3764	4928	msedge.exe	msedge.exe
PID 4928 wrote to memory of 3764	4928	msedge.exe	msedge.exe
PID 4928 wrote to memory of 3764	4928	msedge.exe	msedge.exe
PID 4928 wrote to memory of 3764	4928	msedge.exe	msedge.exe
PID 4928 wrote to memory of 3764	4928	msedge.exe	msedge.exe
PID 4928 wrote to memory of 3764	4928	msedge.exe	msedge.exe
PID 4928 wrote to memory of 3764	4928	msedge.exe	msedge.exe
PID 4928 wrote to memory of 3764	4928	msedge.exe	msedge.exe
PID 4928 wrote to memory of 3764	4928	msedge.exe	msedge.exe
PID 4928 wrote to memory of 3764	4928	msedge.exe	msedge.exe
PID 4928 wrote to memory of 3764	4928	msedge.exe	msedge.exe
PID 4928 wrote to memory of 3764	4928	msedge.exe	msedge.exe
PID 4928 wrote to memory of 3764	4928	msedge.exe	msedge.exe
PID 4928 wrote to memory of 3764	4928	msedge.exe	msedge.exe
PID 4928 wrote to memory of 3764	4928	msedge.exe	msedge.exe
PID 4928 wrote to memory of 3764	4928	msedge.exe	msedge.exe
PID 4928 wrote to memory of 3764	4928	msedge.exe	msedge.exe
PID 4928 wrote to memory of 3764	4928	msedge.exe	msedge.exe
PID 4928 wrote to memory of 800	4928	msedge.exe	msedge.exe
PID 4928 wrote to memory of 800	4928	msedge.exe	msedge.exe
PID 4928 wrote to memory of 1764	4928	msedge.exe	msedge.exe
PID 4928 wrote to memory of 1764	4928	msedge.exe	msedge.exe
PID 4928 wrote to memory of 1764	4928	msedge.exe	msedge.exe
PID 4928 wrote to memory of 1764	4928	msedge.exe	msedge.exe
PID 4928 wrote to memory of 1764	4928	msedge.exe	msedge.exe
PID 4928 wrote to memory of 1764	4928	msedge.exe	msedge.exe
PID 4928 wrote to memory of 1764	4928	msedge.exe	msedge.exe
PID 4928 wrote to memory of 1764	4928	msedge.exe	msedge.exe
PID 4928 wrote to memory of 1764	4928	msedge.exe	msedge.exe
PID 4928 wrote to memory of 1764	4928	msedge.exe	msedge.exe
PID 4928 wrote to memory of 1764	4928	msedge.exe	msedge.exe
PID 4928 wrote to memory of 1764	4928	msedge.exe	msedge.exe
PID 4928 wrote to memory of 1764	4928	msedge.exe	msedge.exe
PID 4928 wrote to memory of 1764	4928	msedge.exe	msedge.exe
PID 4928 wrote to memory of 1764	4928	msedge.exe	msedge.exe
PID 4928 wrote to memory of 1764	4928	msedge.exe	msedge.exe
PID 4928 wrote to memory of 1764	4928	msedge.exe	msedge.exe
PID 4928 wrote to memory of 1764	4928	msedge.exe	msedge.exe
PID 4928 wrote to memory of 1764	4928	msedge.exe	msedge.exe
PID 4928 wrote to memory of 1764	4928	msedge.exe	msedge.exe

C:\Users\Admin\AppData\Local\Temp\captcha.exe
"C:\Users\Admin\AppData\Local\Temp\captcha.exe"
1⤵
PID:2188

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://run/
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4928

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffcdace3cb8,0x7ffcdace3cc8,0x7ffcdace3cd8
2⤵
PID:2604

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1924,7999820124759296286,15521941367197989055,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1952 /prefetch:2
2⤵
PID:3764

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1924,7999820124759296286,15521941367197989055,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:800

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1924,7999820124759296286,15521941367197989055,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2732 /prefetch:8
2⤵
PID:1764

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,7999820124759296286,15521941367197989055,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3196 /prefetch:1
2⤵
PID:4868

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,7999820124759296286,15521941367197989055,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3200 /prefetch:1
2⤵
PID:4788

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,7999820124759296286,15521941367197989055,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4152 /prefetch:1
2⤵
PID:4648

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,7999820124759296286,15521941367197989055,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1908 /prefetch:1
2⤵
PID:4776

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1924,7999820124759296286,15521941367197989055,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5116 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3920

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,7999820124759296286,15521941367197989055,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4148 /prefetch:1
2⤵
PID:1108

C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1924,7999820124759296286,15521941367197989055,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3828 /prefetch:8
2⤵
PID:1848

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,7999820124759296286,15521941367197989055,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5180 /prefetch:1
2⤵
PID:5012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,7999820124759296286,15521941367197989055,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5260 /prefetch:1
2⤵
PID:4412

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,7999820124759296286,15521941367197989055,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5372 /prefetch:1
2⤵
PID:5084

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2456

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
03a56f81ee69dd9727832df26709a1c9

SHA1
ab6754cc9ebd922ef3c37b7e84ff20e250cfde3b

SHA256
65d97e83b315d9140f3922b278d08352809f955e2a714fedfaea6283a5300e53

SHA512
e9915f11e74c1bcf7f80d1bcdc8175df820af30f223a17c0fe11b6808e5a400550dcbe59b64346b7741c7c77735abefaf2c988753e11d086000522a05a0f7781

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d30a5618854b9da7bcfc03aeb0a594c4

SHA1
7f37105d7e5b1ecb270726915956c2271116eab7

SHA256
3494c446aa3cb038f1d920b26910b7fe1f4286db78cb3f203ad02cb93889c1a8

SHA512
efd488fcd1729017a596ddd2950bff07d5a11140cba56ff8e0c62ef62827b35c22857bc4f5f5ea11ccc2e1394c0b3ee8651df62a25e66710f320e7a2cf4d1a77

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
7a2777a7f2a12596aae6009ae7abeb51

SHA1
d0ace1227034b33ffeae72a9c9168f6f6ce58aab

SHA256
383a37f282975cb72765af928a802bebec1ebc2e5b4603766830aef24a8e88c6

SHA512
8dd4da9fa5a132a528aa6d47b66be7965bd8cd8c56a1b55da485ccc67f964d549d86f289037e6d70226d63a73b96f3eb6ae352bb26e83d94e1926f8091ae9b25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
da1d702e975a16632b30b330398517a2

SHA1
e5ab7ad328a69662b4c1433f1c17b3431d069cb4

SHA256
a32d9a1f7ed509339fe8231155695d10ef8aa7f31ff828d80f0814a210695046

SHA512
c77d7ce35be87837eca640b552d5e0bf2a1917518e960d8179c715ac614ddfca50d0e3c93f6871d059e820cb3b308235653874a23f890b8b19de2ab7c205ebb6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
661cfb81a6bb7944851b7c8a2ea9dfc3

SHA1
0cdc3fd2908339c951ba0fe6a21e926da3a89004

SHA256
8dc68f51f8137fcf64579a17dc61d53eff01de0dbcd612d992c756e5d9ed6ea9

SHA512
3b1ed021a54303efd331f9f7818c9543b20504a07cb7b2ef484a1d025ad5f467333309c229aa8bed00017cd6e506400d222f9a9a0d643432d9d07009042d6851

Download Submit
\??\pipe\LOCAL\crashpad_4928_XGKXGBWTHHBYEDGQ

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/2188-0-0x00007FFCEFDA3000-0x00007FFCEFDA5000-memory.dmp

Filesize
8KB

Download
memory/2188-1-0x00000000001F0000-0x0000000000202000-memory.dmp

Filesize
72KB

Download
memory/2188-2-0x00007FFCEFDA0000-0x00007FFCF0862000-memory.dmp

Filesize
10.8MB

Download
memory/2188-3-0x00007FFCEFDA3000-0x00007FFCEFDA5000-memory.dmp

Filesize
8KB

Download
memory/2188-4-0x00007FFCEFDA0000-0x00007FFCF0862000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads