asyncrat | 0b29711ec115c27f4cd6963b9ea1e4febf15624f1c17d1c018611ee3df8c333c

Analysis

max time kernel
307s
max time network
306s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
16-10-2024 23:35

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

AsyncRAT/AsyncRAT.exe
Size

6.4MB
MD5

97a429c4b6a2cb95ece0ddb24c3c2152
SHA1

6fcc26793dd474c0c7113b3360ff29240d9a9020
SHA256

06899071233d61009a64c726a4523aa13d81c2517a0486cc99ac5931837008e5
SHA512

524a63f39e472bd052a258a313ff4f2005041b31f11da4774d3d97f72773f3edb40df316fa9cc2a0f51ea5d8ac404cfdd486bab6718bae60f0d860e98e533f89
SSDEEP

98304:+bPmDVa3VxobFwUN5xXhAqin1MNuSZTKA0t9FFPEG6xJJ33Je2PsBpCz6Ry:+7aIXUN5htin2bk9fcPHJDE7Cz60

Score

10^/10

asyncrat default discovery rat spyware stealer

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

127.0.0.1:6606

127.0.0.1:7707

127.0.0.1:8808

Mutex

bK0WtUi7LMEi

Attributes

delay
3
install
true
install_file
w.exe
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

Processes:

resource	yara_rule
C:\Users\Admin\Desktop\AsyncClient.exe	family_asyncrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

AsyncClient.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	AsyncClient.exe

Executes dropped EXE 2 IoCs

Processes:

AsyncClient.exew.exe

pid process

3052 AsyncClient.exe
1848 w.exe
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service
T1102

Processes:

flow ioc

102 pastebin.com
103 pastebin.com
104 pastebin.com
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
3052	AsyncClient.exe
1848	w.exe

flow	ioc
102	pastebin.com
103	pastebin.com
104	pastebin.com

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

schtasks.exew.execmd.exeAsyncClient.execmd.execmd.exetimeout.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	w.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AsyncClient.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe

Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

632 timeout.exe

pid	process
632	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

chrome.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133735954414035748"	chrome.exe

Modifies registry class 64 IoCs

Processes:

AsyncRAT.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0	AsyncRAT.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0\MRUListEx = ffffffff	AsyncRAT.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	AsyncRAT.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	AsyncRAT.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1"	AsyncRAT.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	AsyncRAT.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\MRUListEx = 00000000ffffffff	AsyncRAT.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202	AsyncRAT.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5	AsyncRAT.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1	AsyncRAT.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	AsyncRAT.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings	AsyncRAT.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	AsyncRAT.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff	AsyncRAT.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0 = 56003100000000004759f14912004170704461746100400009000400efbe4759f149505978bc2e00000070e10100000001000000000000000000000000000000f44609014100700070004400610074006100000016000000	AsyncRAT.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\MRUListEx = 00000000ffffffff	AsyncRAT.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	AsyncRAT.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0\NodeSlot = "1"	AsyncRAT.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000030000000200000001000000ffffffff	AsyncRAT.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\SniffedFolderType = "Generic"	AsyncRAT.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg	AsyncRAT.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0	AsyncRAT.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	AsyncRAT.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202	AsyncRAT.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\SniffedFolderType = "Documents"	AsyncRAT.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	AsyncRAT.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	AsyncRAT.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0	AsyncRAT.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\MRUListEx = 00000000ffffffff	AsyncRAT.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	AsyncRAT.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg	AsyncRAT.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	AsyncRAT.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	AsyncRAT.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	AsyncRAT.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0	AsyncRAT.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	AsyncRAT.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	AsyncRAT.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	AsyncRAT.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 78003100000000004759f1491100557365727300640009000400efbe874f7748505978bc2e000000c70500000000010000000000000000003a00000000000795170155007300650072007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100380031003300000014000000	AsyncRAT.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0 = 4e00310000000000505978bc100054656d7000003a0009000400efbe4759f149505978bc2e00000084e101000000010000000000000000000000000000004bea8e00540065006d007000000014000000	AsyncRAT.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616257"	AsyncRAT.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	AsyncRAT.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	AsyncRAT.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	AsyncRAT.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	AsyncRAT.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000010000000300000002000000ffffffff	AsyncRAT.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	AsyncRAT.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 500031000000000047590955100041646d696e003c0009000400efbe4759f149505978bc2e00000065e10100000001000000000000000000000000000000ef611000410064006d0069006e00000014000000	AsyncRAT.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff	AsyncRAT.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0000000001000000ffffffff	AsyncRAT.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\3	AsyncRAT.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}	AsyncRAT.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	AsyncRAT.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	AsyncRAT.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 19002f433a5c000000000000000000000000000000000000000000	AsyncRAT.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0	AsyncRAT.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0 = 5a00310000000000505980bc10004173796e635241540000420009000400efbe505978bc505981bc2e0000007c3b020000000a000000000000000000000000000000619729004100730079006e006300520041005400000018000000	AsyncRAT.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	AsyncRAT.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\3\MRUListEx = ffffffff	AsyncRAT.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4"	AsyncRAT.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	AsyncRAT.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic"	AsyncRAT.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	AsyncRAT.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1"	AsyncRAT.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exe

pid process

2916 schtasks.exe

pid	process
2916	schtasks.exe

Suspicious behavior: EnumeratesProcesses 60 IoCs

Processes:

AsyncRAT.exechrome.exeAsyncClient.exew.exe

pid	process
1420	AsyncRAT.exe
1420	AsyncRAT.exe
1420	AsyncRAT.exe
1420	AsyncRAT.exe
1420	AsyncRAT.exe
1420	AsyncRAT.exe
1420	AsyncRAT.exe
1420	AsyncRAT.exe
1420	AsyncRAT.exe
1420	AsyncRAT.exe
1420	AsyncRAT.exe
1420	AsyncRAT.exe
1420	AsyncRAT.exe
1420	AsyncRAT.exe
1420	AsyncRAT.exe
1420	AsyncRAT.exe
1420	AsyncRAT.exe
1420	AsyncRAT.exe
1420	AsyncRAT.exe
1420	AsyncRAT.exe
1420	AsyncRAT.exe
1420	AsyncRAT.exe
1420	AsyncRAT.exe
1420	AsyncRAT.exe
1420	AsyncRAT.exe
1420	AsyncRAT.exe
1420	AsyncRAT.exe
2288	chrome.exe
2288	chrome.exe
3052	AsyncClient.exe
3052	AsyncClient.exe
3052	AsyncClient.exe
3052	AsyncClient.exe
3052	AsyncClient.exe
3052	AsyncClient.exe
3052	AsyncClient.exe
3052	AsyncClient.exe
3052	AsyncClient.exe
3052	AsyncClient.exe
3052	AsyncClient.exe
3052	AsyncClient.exe
3052	AsyncClient.exe
3052	AsyncClient.exe
3052	AsyncClient.exe
3052	AsyncClient.exe
3052	AsyncClient.exe
1848	w.exe
1848	w.exe
1848	w.exe
1848	w.exe
1848	w.exe
1848	w.exe
1848	w.exe
1848	w.exe
1848	w.exe
1848	w.exe
1848	w.exe
1848	w.exe
1848	w.exe
1848	w.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

AsyncRAT.exe

pid process

1420 AsyncRAT.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

Processes:

chrome.exe

pid process

2288 chrome.exe
2288 chrome.exe
2288 chrome.exe
2288 chrome.exe

pid	process
2288	chrome.exe
2288	chrome.exe
2288	chrome.exe
2288	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

chrome.exe

description	pid	process
Token: SeShutdownPrivilege	2288	chrome.exe
Token: SeCreatePagefilePrivilege	2288	chrome.exe
Token: SeShutdownPrivilege	2288	chrome.exe
Token: SeCreatePagefilePrivilege	2288	chrome.exe
Token: SeShutdownPrivilege	2288	chrome.exe
Token: SeCreatePagefilePrivilege	2288	chrome.exe
Token: SeShutdownPrivilege	2288	chrome.exe
Token: SeCreatePagefilePrivilege	2288	chrome.exe
Token: SeShutdownPrivilege	2288	chrome.exe
Token: SeCreatePagefilePrivilege	2288	chrome.exe
Token: SeShutdownPrivilege	2288	chrome.exe
Token: SeCreatePagefilePrivilege	2288	chrome.exe
Token: SeShutdownPrivilege	2288	chrome.exe
Token: SeCreatePagefilePrivilege	2288	chrome.exe
Token: SeShutdownPrivilege	2288	chrome.exe
Token: SeCreatePagefilePrivilege	2288	chrome.exe
Token: SeShutdownPrivilege	2288	chrome.exe
Token: SeCreatePagefilePrivilege	2288	chrome.exe
Token: SeShutdownPrivilege	2288	chrome.exe
Token: SeCreatePagefilePrivilege	2288	chrome.exe
Token: SeShutdownPrivilege	2288	chrome.exe
Token: SeCreatePagefilePrivilege	2288	chrome.exe
Token: SeShutdownPrivilege	2288	chrome.exe
Token: SeCreatePagefilePrivilege	2288	chrome.exe
Token: SeShutdownPrivilege	2288	chrome.exe
Token: SeCreatePagefilePrivilege	2288	chrome.exe
Token: SeShutdownPrivilege	2288	chrome.exe
Token: SeCreatePagefilePrivilege	2288	chrome.exe
Token: SeShutdownPrivilege	2288	chrome.exe
Token: SeCreatePagefilePrivilege	2288	chrome.exe
Token: SeShutdownPrivilege	2288	chrome.exe
Token: SeCreatePagefilePrivilege	2288	chrome.exe
Token: SeShutdownPrivilege	2288	chrome.exe
Token: SeCreatePagefilePrivilege	2288	chrome.exe
Token: SeShutdownPrivilege	2288	chrome.exe
Token: SeCreatePagefilePrivilege	2288	chrome.exe
Token: SeShutdownPrivilege	2288	chrome.exe
Token: SeCreatePagefilePrivilege	2288	chrome.exe
Token: SeShutdownPrivilege	2288	chrome.exe
Token: SeCreatePagefilePrivilege	2288	chrome.exe
Token: SeShutdownPrivilege	2288	chrome.exe
Token: SeCreatePagefilePrivilege	2288	chrome.exe
Token: SeShutdownPrivilege	2288	chrome.exe
Token: SeCreatePagefilePrivilege	2288	chrome.exe
Token: SeShutdownPrivilege	2288	chrome.exe
Token: SeCreatePagefilePrivilege	2288	chrome.exe
Token: SeShutdownPrivilege	2288	chrome.exe
Token: SeCreatePagefilePrivilege	2288	chrome.exe
Token: SeShutdownPrivilege	2288	chrome.exe
Token: SeCreatePagefilePrivilege	2288	chrome.exe
Token: SeShutdownPrivilege	2288	chrome.exe
Token: SeCreatePagefilePrivilege	2288	chrome.exe
Token: SeShutdownPrivilege	2288	chrome.exe
Token: SeCreatePagefilePrivilege	2288	chrome.exe
Token: SeShutdownPrivilege	2288	chrome.exe
Token: SeCreatePagefilePrivilege	2288	chrome.exe
Token: SeShutdownPrivilege	2288	chrome.exe
Token: SeCreatePagefilePrivilege	2288	chrome.exe
Token: SeShutdownPrivilege	2288	chrome.exe
Token: SeCreatePagefilePrivilege	2288	chrome.exe
Token: SeShutdownPrivilege	2288	chrome.exe
Token: SeCreatePagefilePrivilege	2288	chrome.exe
Token: SeShutdownPrivilege	2288	chrome.exe
Token: SeCreatePagefilePrivilege	2288	chrome.exe

Suspicious use of FindShellTrayWindow 46 IoCs

Processes:

AsyncRAT.exechrome.exe

pid	process
1420	AsyncRAT.exe
1420	AsyncRAT.exe
2288	chrome.exe
2288	chrome.exe
2288	chrome.exe
2288	chrome.exe
2288	chrome.exe
2288	chrome.exe
2288	chrome.exe
2288	chrome.exe
2288	chrome.exe
2288	chrome.exe
2288	chrome.exe
2288	chrome.exe
2288	chrome.exe
2288	chrome.exe
2288	chrome.exe
2288	chrome.exe
2288	chrome.exe
2288	chrome.exe
2288	chrome.exe
2288	chrome.exe
2288	chrome.exe
2288	chrome.exe
2288	chrome.exe
2288	chrome.exe
2288	chrome.exe
2288	chrome.exe
2288	chrome.exe
2288	chrome.exe
2288	chrome.exe
2288	chrome.exe
2288	chrome.exe
2288	chrome.exe
2288	chrome.exe
2288	chrome.exe
2288	chrome.exe
2288	chrome.exe
2288	chrome.exe
2288	chrome.exe
2288	chrome.exe
2288	chrome.exe
2288	chrome.exe
2288	chrome.exe
2288	chrome.exe
1420	AsyncRAT.exe

Suspicious use of SendNotifyMessage 42 IoCs

Processes:

AsyncRAT.exechrome.exe

pid	process
1420	AsyncRAT.exe
2288	chrome.exe
2288	chrome.exe
2288	chrome.exe
2288	chrome.exe
2288	chrome.exe
2288	chrome.exe
2288	chrome.exe
2288	chrome.exe
2288	chrome.exe
2288	chrome.exe
2288	chrome.exe
2288	chrome.exe
2288	chrome.exe
2288	chrome.exe
2288	chrome.exe
2288	chrome.exe
2288	chrome.exe
2288	chrome.exe
2288	chrome.exe
2288	chrome.exe
2288	chrome.exe
2288	chrome.exe
2288	chrome.exe
2288	chrome.exe
2288	chrome.exe
2288	chrome.exe
2288	chrome.exe
2288	chrome.exe
2288	chrome.exe
2288	chrome.exe
2288	chrome.exe
2288	chrome.exe
2288	chrome.exe
2288	chrome.exe
2288	chrome.exe
2288	chrome.exe
2288	chrome.exe
2288	chrome.exe
2288	chrome.exe
2288	chrome.exe
1420	AsyncRAT.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

AsyncRAT.exe

pid process

1420 AsyncRAT.exe
1420 AsyncRAT.exe
1420 AsyncRAT.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

chrome.exe

description	pid	process	target process
PID 2288 wrote to memory of 1720	2288	chrome.exe	chrome.exe
PID 2288 wrote to memory of 1720	2288	chrome.exe	chrome.exe
PID 2288 wrote to memory of 4956	2288	chrome.exe	chrome.exe
PID 2288 wrote to memory of 4956	2288	chrome.exe	chrome.exe
PID 2288 wrote to memory of 4956	2288	chrome.exe	chrome.exe
PID 2288 wrote to memory of 4956	2288	chrome.exe	chrome.exe
PID 2288 wrote to memory of 4956	2288	chrome.exe	chrome.exe
PID 2288 wrote to memory of 4956	2288	chrome.exe	chrome.exe
PID 2288 wrote to memory of 4956	2288	chrome.exe	chrome.exe
PID 2288 wrote to memory of 4956	2288	chrome.exe	chrome.exe
PID 2288 wrote to memory of 4956	2288	chrome.exe	chrome.exe
PID 2288 wrote to memory of 4956	2288	chrome.exe	chrome.exe
PID 2288 wrote to memory of 4956	2288	chrome.exe	chrome.exe
PID 2288 wrote to memory of 4956	2288	chrome.exe	chrome.exe
PID 2288 wrote to memory of 4956	2288	chrome.exe	chrome.exe
PID 2288 wrote to memory of 4956	2288	chrome.exe	chrome.exe
PID 2288 wrote to memory of 4956	2288	chrome.exe	chrome.exe
PID 2288 wrote to memory of 4956	2288	chrome.exe	chrome.exe
PID 2288 wrote to memory of 4956	2288	chrome.exe	chrome.exe
PID 2288 wrote to memory of 4956	2288	chrome.exe	chrome.exe
PID 2288 wrote to memory of 4956	2288	chrome.exe	chrome.exe
PID 2288 wrote to memory of 4956	2288	chrome.exe	chrome.exe
PID 2288 wrote to memory of 4956	2288	chrome.exe	chrome.exe
PID 2288 wrote to memory of 4956	2288	chrome.exe	chrome.exe
PID 2288 wrote to memory of 4956	2288	chrome.exe	chrome.exe
PID 2288 wrote to memory of 4956	2288	chrome.exe	chrome.exe
PID 2288 wrote to memory of 4956	2288	chrome.exe	chrome.exe
PID 2288 wrote to memory of 4956	2288	chrome.exe	chrome.exe
PID 2288 wrote to memory of 4956	2288	chrome.exe	chrome.exe
PID 2288 wrote to memory of 4956	2288	chrome.exe	chrome.exe
PID 2288 wrote to memory of 4956	2288	chrome.exe	chrome.exe
PID 2288 wrote to memory of 4956	2288	chrome.exe	chrome.exe
PID 2288 wrote to memory of 1140	2288	chrome.exe	chrome.exe
PID 2288 wrote to memory of 1140	2288	chrome.exe	chrome.exe
PID 2288 wrote to memory of 1088	2288	chrome.exe	chrome.exe
PID 2288 wrote to memory of 1088	2288	chrome.exe	chrome.exe
PID 2288 wrote to memory of 1088	2288	chrome.exe	chrome.exe
PID 2288 wrote to memory of 1088	2288	chrome.exe	chrome.exe
PID 2288 wrote to memory of 1088	2288	chrome.exe	chrome.exe
PID 2288 wrote to memory of 1088	2288	chrome.exe	chrome.exe
PID 2288 wrote to memory of 1088	2288	chrome.exe	chrome.exe
PID 2288 wrote to memory of 1088	2288	chrome.exe	chrome.exe
PID 2288 wrote to memory of 1088	2288	chrome.exe	chrome.exe
PID 2288 wrote to memory of 1088	2288	chrome.exe	chrome.exe
PID 2288 wrote to memory of 1088	2288	chrome.exe	chrome.exe
PID 2288 wrote to memory of 1088	2288	chrome.exe	chrome.exe
PID 2288 wrote to memory of 1088	2288	chrome.exe	chrome.exe
PID 2288 wrote to memory of 1088	2288	chrome.exe	chrome.exe
PID 2288 wrote to memory of 1088	2288	chrome.exe	chrome.exe
PID 2288 wrote to memory of 1088	2288	chrome.exe	chrome.exe
PID 2288 wrote to memory of 1088	2288	chrome.exe	chrome.exe
PID 2288 wrote to memory of 1088	2288	chrome.exe	chrome.exe
PID 2288 wrote to memory of 1088	2288	chrome.exe	chrome.exe
PID 2288 wrote to memory of 1088	2288	chrome.exe	chrome.exe
PID 2288 wrote to memory of 1088	2288	chrome.exe	chrome.exe
PID 2288 wrote to memory of 1088	2288	chrome.exe	chrome.exe
PID 2288 wrote to memory of 1088	2288	chrome.exe	chrome.exe
PID 2288 wrote to memory of 1088	2288	chrome.exe	chrome.exe
PID 2288 wrote to memory of 1088	2288	chrome.exe	chrome.exe
PID 2288 wrote to memory of 1088	2288	chrome.exe	chrome.exe
PID 2288 wrote to memory of 1088	2288	chrome.exe	chrome.exe
PID 2288 wrote to memory of 1088	2288	chrome.exe	chrome.exe
PID 2288 wrote to memory of 1088	2288	chrome.exe	chrome.exe
PID 2288 wrote to memory of 1088	2288	chrome.exe	chrome.exe

C:\Users\Admin\AppData\Local\Temp\AsyncRAT\AsyncRAT.exe
"C:\Users\Admin\AppData\Local\Temp\AsyncRAT\AsyncRAT.exe"
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1420

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:3940

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2288

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7fff36dccc40,0x7fff36dccc4c,0x7fff36dccc58
2⤵
PID:1720

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1884,i,17388056718102856932,11241198283396421614,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1880 /prefetch:2
2⤵
PID:4956

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2188,i,17388056718102856932,11241198283396421614,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2252 /prefetch:3
2⤵
PID:1140

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2284,i,17388056718102856932,11241198283396421614,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2456 /prefetch:8
2⤵
PID:1088

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3084,i,17388056718102856932,11241198283396421614,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3192 /prefetch:1
2⤵
PID:4720

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3296,i,17388056718102856932,11241198283396421614,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3396 /prefetch:1
2⤵
PID:4864

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3744,i,17388056718102856932,11241198283396421614,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4620 /prefetch:1
2⤵
PID:4324

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4756,i,17388056718102856932,11241198283396421614,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4768 /prefetch:8
2⤵
PID:2236

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4868,i,17388056718102856932,11241198283396421614,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4884 /prefetch:8
2⤵
PID:3624

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4780,i,17388056718102856932,11241198283396421614,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4876 /prefetch:8
2⤵
PID:2600

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5036,i,17388056718102856932,11241198283396421614,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5048 /prefetch:8
2⤵
PID:5116

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=5448,i,17388056718102856932,11241198283396421614,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5508 /prefetch:1
2⤵
PID:3768

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:2008

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2644

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4876

C:\Users\Admin\Desktop\AsyncClient.exe
"C:\Users\Admin\Desktop\AsyncClient.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3052

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "w" /tr '"C:\Users\Admin\AppData\Roaming\w.exe"' & exit
2⤵
- System Location Discovery: System Language Discovery
PID:2640

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /f /sc onlogon /rl highest /tn "w" /tr '"C:\Users\Admin\AppData\Roaming\w.exe"'
3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2916

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpE0FB.tmp.bat""
2⤵
- System Location Discovery: System Language Discovery
PID:1084

C:\Windows\SysWOW64\timeout.exe
timeout 3
3⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:632

C:\Users\Admin\AppData\Roaming\w.exe
"C:\Users\Admin\AppData\Roaming\w.exe"
3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1848

C:\Windows\SysWOW64\cmd.exe
"cmd"
4⤵
- System Location Discovery: System Language Discovery
PID:512

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:3520

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2524

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:4036

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:5068

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:3284

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:4460

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\43e7b9db-e97b-4e28-b752-ac083629b9c4.tmp

Filesize
15KB

MD5
db75f4afe67475e25338c294b7c65ae4

SHA1
ff0e30207e04413c95e3e7c66937efc07138444e

SHA256
0e707860f37ea3f7e4878ce7c7865c8c6d999ee23bf605859c26d83bf31e540e

SHA512
7c17098174a0ef134c4f8d758b0d6cf1bf79c13a9fd075b1fe2859ca35779e5aaafdd841d82c47f38eb72f39d14d52aba329373ce61ef4325f03a4d865a1992f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
fea156cc55572ae6fcb87dfd337d7746

SHA1
ba0bb0789f8328c8a34045d124778a97f786d41c

SHA256
1f72523ce5d835066f0158922db44cb8dd7c7371a96cb513cb0fff4dc9f38cb5

SHA512
1a86653c66feb22556cf1d0bdd4778ab56b933f31e116065fb73ecfb409c78c7dba0130ca52e28280c85e07ba2f8b86852fbbeac24616def8be16997e0f26706

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
d4b069cbe58cfeb30652a3d7904bfd7e

SHA1
1183bd915a525bcc382299536c080e10e5731807

SHA256
0a99531b94dbf774c08eef3fbe2feba2fde6903682ed394bf33c229aa831b7d2

SHA512
d12d001638361f15d7463b8c9d2e5b92ee361b6ab8f68e65b30aa912c2f247e821cb8f3e5ede070f75188872abb90758ce90278b9bb399e2f219ba51993deb8a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
e9277189082670401c49e56c175c16be

SHA1
0fdf244ca7a364c775b0248384d0f22b314fc220

SHA256
1afba2ab380fbc89ab0103bf2a646fc090d7eac5e091d8ab6c18680515ff4d92

SHA512
6137cb7a7e82ccd4ab9d3f1c45172eed386e4b8ad79e91cb2c7c404bc27ef2a676330b0d6525fed4e85e57633501db85dc5e35e88832fb6a8211222fb53b26ec

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
356B

MD5
cec827b432f947bc35bdec8fdf95d8a3

SHA1
5758e9baa3b5e6ad17c0aa01f715834933bf91a8

SHA256
6357cd1613a192b84e88222d0a8ce05b4238e33c82eff034c013d20fd230145b

SHA512
e625004e51de7edbbb5942cd84246f181ec5ac7dd543177cdcf76dbb16910bffec3f580a03c4084554de9a737721676b3b2b6e8ef1bf103c36d6a005d30f5ac1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
bb3db96ea4eaf877e9de8c0b4edd700f

SHA1
c0f656b5f0e5bdb17827f1b77b52100bfaca7845

SHA256
bd7654a6c58a788e32de9ede309376153c963136d45c901bcb3cc1fafd9866e5

SHA512
36e7eaa3b23deea097ee6d980aa4d9af449bbd080d0829a67d0604244b18db4a526ab8c22e0645f8a808bc430abf248739e026990995b775d80fcadac9d12dfa

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
f732061f92ed7a0c2e5fc6c3da55e2c5

SHA1
bae672633a0ec038f718368e33b58ce3b0a8f869

SHA256
0a4abebb2e89eba4754581d44b37a627bb513fe3460d2026fdae7582ac98c99b

SHA512
6a262931bb059084132968faf075506f8633d60ef5fd046bff06831900c6414700fbd3e29a20f7fe87c60f169e92d40c4b5efb0f4277a3cd9af4b2c7420312ab

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
7e96d0137bfd3f58ab2b03e947ccac7d

SHA1
b1255b3aaab8c99c0c1e816891293d3145ca6fcf

SHA256
65cdf96b4eb1ddc1d766639a9947d18ece399e60210bc50be64ebf43235dea00

SHA512
93b52fe5b72e88042ee545157af23b1408fdf2027d38301992c9d51e39a141754c06798c4b9419b913432630ff11826fac45e74880c40fea0e476f8eef239292

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
46f7c299706d8edad25771537a41384d

SHA1
ed5b458a2fb77a81c939f45df5decd49ec217df3

SHA256
709e09a186d206fbdcd722e0597526915818d978859fd232049df573e975fe70

SHA512
b74b00f72ac47657f891106cb4bc0b3b97cfae000cf01d12723708e7e30779e08c23abacbc00e47be9bd8f89d71032b76a19ad87b1409c2528651e97fd9a6d0f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
5b591ddf1158844cd35103fb8e55b781

SHA1
87ae451d6d9e94b7dfbc66c88f930cf778beac06

SHA256
ea933e877c499dd46c43de06306957f2194aef831273034faae9749788e9246f

SHA512
41bc2940d8f9460964edb62335351b513235279a9f84c6aea392990bfb09b3b52a1ab1b74adc65d799d92021da3e040f74727f2980f6960c73c219871fd216ef

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
a5759fe09272e5c66ea238374805cd7d

SHA1
d99464af53c388b34522fe1a62cf3de45c46171f

SHA256
de00e2624f7da2fe72fd2a83f5be0e06e09d95d6b69f3b86f5a0d183baf36351

SHA512
e35e69816b929eeaa81ce5e4a025f11110aa5f70c349b092bd7d34226294dcc1aa2e947a6f3bd2f4fcbebc8e6f42170c55656723f06426b432e61721c7b042ac

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
228KB

MD5
399b4b81865cdea1d66ad2f214563c3f

SHA1
73a252a6b05811c0dd18237fbed83237718ab16d

SHA256
bf2bc1056a7ed46f585807034c8f6cd05beea9834660883b67d3936dbe5113d9

SHA512
654b7efb5c6436cc463c3ba8ea79ed9aa074210a7b30b1bf069ac1ecfe01013020440fe06e8e918655bee9ea955e7dfeeeacae4c94f25fcbbcbd04a5a8c6888f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
227KB

MD5
c00f33f13b7a2c1062fd2808c0096d8e

SHA1
e4803d65d7b332263a9f4e9c42a9d7a9b53e1c6d

SHA256
ba654ace30e2d491e3860b5c1f8587c0f1042250df10a9b405de95050881e4f7

SHA512
eb088dd3d510d4e132c61aa117c34eafaa1a5188a80a352f5b5685bd804302782fdd176764eb6806b89b7ca356e44dd84f4064ead9957db1c14324eeddfec221

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
228KB

MD5
56b173eeaf53c4b2dbcee59c57663f70

SHA1
eea29b0a998ee6383774316fdc04fa6c61bcdde5

SHA256
79ef8121e2fd2d1411d27f990b3fca928b53676d8472cd60782cd0ea197b2638

SHA512
14b21c53b23558d548568820d6a7060ee733db14f855eb95364e5a808abde9b73a00e12ff9fe5447b8a2d41052ded4542d27836aa30c19de3afcec291f9cd306

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1

Filesize
264KB

MD5
801a693dfaba8668955b8a99433d24c9

SHA1
141eb7a6ef51a10c04bb7b71589de81809831e2b

SHA256
81b5d898f5f237262214157fa30d596681f850c0b805b024c6d6be0761a479d3

SHA512
19b2274c105cdd1f3fa241ca86e71b1f087db2bae53d35699bc44c62eb8d4aec3fdda3ceb4b330c08d65df0fa4fb072a98be28f000428468d996e834940e7740

Download Submit
C:\Users\Admin\AppData\Local\Server\AsyncRAT.exe_Url_bsozgjfh10ettuvlzzecwz2b2kv3ubbv\0.5.8.0\1hxpqs1k.newcfg

Filesize
565B

MD5
a04634c286eb4165e74e4b3e3d6177f2

SHA1
bbd1e6758cdd48ec0b1801013f0806ded000ba47

SHA256
8d4eb918c0b00e92d08aa270a855da1623cdaaf0baff70bc73eb03e1626580fe

SHA512
c908f63580a467dbae8d2dd153f6ea014b7456c675db9d131d9fa5b0ecac6a425089053c463c17ee9ca402dab089a07d358878f7e2d8a8ae72081dbfa99ef36d

Download Submit
C:\Users\Admin\AppData\Local\Server\AsyncRAT.exe_Url_bsozgjfh10ettuvlzzecwz2b2kv3ubbv\0.5.8.0\i12ojvmb.newcfg

Filesize
687B

MD5
823e86e7d2be671d68ed7349c309a46f

SHA1
a8b0b38be05c1ed635c490c705708eca66ee1a35

SHA256
75ad14411b5c594c518a15c7402e5f1f9bbf93e3888844728729c06529f8d780

SHA512
71a4561d310e6728a693ea4a4643b4b02263343b44420d04c71d1452d28adc6f062abf223126c81ff10aac2d8ace2161164038b9667aa54a031a444bd41d8334

Download Submit
C:\Users\Admin\AppData\Local\Server\AsyncRAT.exe_Url_bsozgjfh10ettuvlzzecwz2b2kv3ubbv\0.5.8.0\user.config

Filesize
319B

MD5
f71f55112253acc1ef2ecd0a61935970

SHA1
faa9d50656e386e460278d31b1d9247fdd947bb7

SHA256
d1ad588a08c8c0799d7a14509f1e0a7ae04c519102ed9d328a83fe65999e6179

SHA512
761b5c13e39bd4ae21d298084bbe747ae71c383fedf9a51fd5e9723a8b3b4547de459d82bac7f3f8f3bfc11cfb0528a4f1057b51996d7d046583109a53317b44

Download Submit
C:\Users\Admin\AppData\Local\Temp\AsyncRAT\ServerCertificate.p12

Filesize
4KB

MD5
ace36e2003dc247fd2b56633e796fb18

SHA1
d36e1a165b4049636b73e42e8d0dddf68a7272d5

SHA256
6b82bdec762250552f6c40eb3d93905517db7928dd4cf35784f266f6f9415b4f

SHA512
08e767d6a264a9eaf726146beb3b9a9663cc2576cd09e9f71b42e71059467328543be20868acf02fa6aa36355b102cc8744716967b9d1db241f8161a55c8ce3f

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpE0FB.tmp.bat

Filesize
145B

MD5
60b35d639fc18a871babf2c6b86e3b9a

SHA1
f488ab3aacf92ef6adf7b8bea303de35b307f29f

SHA256
e9b1b3666659413374045a17fd34facbd92b475d4c6845f15d85209043c439df

SHA512
57273e117163f359182323b26128adcfcae36d4418ed868081905401533b868c8881aa4dd34fbfdd23d187ada91834b1fc8def87b33b61a9e6ed1335367d6b2a

Download Submit
C:\Users\Admin\Desktop\AsyncClient.exe

Filesize
45KB

MD5
88cb549b969c7883c08fec83e9775915

SHA1
587aecd90ab860aa1cebb43fb3e09ddc963fbcc5

SHA256
2b6d1c8bfa1948ccf7e403da3c67b82789b4b00ebc907fff6b5a102384bb73b7

SHA512
d8b536cfeabda28f9c64eaeac64246cc5f95fef1a632edd5c8125a1f1f87b6197b9fbf8dca07e9322d65771027e060a9eaa7d62dec9f4e3c378881bc184c9d2c

Download Submit
\??\pipe\crashpad_2288_HOGNYSXAZBNRIURN

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/1420-3-0x000002595B6A0000-0x000002595B8F2000-memory.dmp

Filesize
2.3MB

Download
memory/1420-10-0x000002595BAA0000-0x000002595BAB2000-memory.dmp

Filesize
72KB

Download
memory/1420-35-0x00007FFF3D860000-0x00007FFF3E321000-memory.dmp

Filesize
10.8MB

Download
memory/1420-34-0x00007FFF3D860000-0x00007FFF3E321000-memory.dmp

Filesize
10.8MB

Download
memory/1420-33-0x00007FFF3D860000-0x00007FFF3E321000-memory.dmp

Filesize
10.8MB

Download
memory/1420-32-0x00007FFF3D860000-0x00007FFF3E321000-memory.dmp

Filesize
10.8MB

Download
memory/1420-347-0x0000025960620000-0x00000259606B5000-memory.dmp

Filesize
596KB

Download
memory/1420-12-0x00007FFF3D863000-0x00007FFF3D865000-memory.dmp

Filesize
8KB

Download
memory/1420-11-0x000002595EEE0000-0x000002595F160000-memory.dmp

Filesize
2.5MB

Download
memory/1420-1-0x0000025940A30000-0x000002594109A000-memory.dmp

Filesize
6.4MB

Download
memory/1420-7-0x00007FFF3D860000-0x00007FFF3E321000-memory.dmp

Filesize
10.8MB

Download
memory/1420-6-0x000002595BAF0000-0x000002595BAFA000-memory.dmp

Filesize
40KB

Download
memory/1420-5-0x00007FFF3D860000-0x00007FFF3E321000-memory.dmp

Filesize
10.8MB

Download
memory/1420-4-0x00007FFF3D860000-0x00007FFF3E321000-memory.dmp

Filesize
10.8MB

Download
memory/1420-310-0x0000025960620000-0x00000259606B5000-memory.dmp

Filesize
596KB

Download
memory/1420-37-0x000002595C470000-0x000002595C596000-memory.dmp

Filesize
1.1MB

Download
memory/1420-13-0x00007FFF3D860000-0x00007FFF3E321000-memory.dmp

Filesize
10.8MB

Download
memory/1420-0-0x00007FFF3D863000-0x00007FFF3D865000-memory.dmp

Filesize
8KB

Download
memory/1420-62-0x0000025960620000-0x00000259606B5000-memory.dmp

Filesize
596KB

Download
memory/1848-371-0x0000000007110000-0x0000000007150000-memory.dmp

Filesize
256KB

Download
memory/1848-361-0x0000000005C30000-0x00000000061D4000-memory.dmp

Filesize
5.6MB

Download
memory/1848-362-0x0000000005680000-0x00000000056E6000-memory.dmp

Filesize
408KB

Download
memory/1848-364-0x0000000006960000-0x00000000069D6000-memory.dmp

Filesize
472KB

Download
memory/1848-365-0x00000000068E0000-0x0000000006948000-memory.dmp

Filesize
416KB

Download
memory/1848-366-0x0000000006A30000-0x0000000006A4E000-memory.dmp

Filesize
120KB

Download
memory/1848-367-0x0000000006DE0000-0x0000000006E72000-memory.dmp

Filesize
584KB

Download
memory/1848-369-0x0000000006F10000-0x0000000006FAC000-memory.dmp

Filesize
624KB

Download
memory/1848-370-0x0000000006DD0000-0x0000000006DD8000-memory.dmp

Filesize
32KB

Download
memory/1848-372-0x0000000006FF0000-0x0000000006FFA000-memory.dmp

Filesize
40KB

Download
memory/1848-376-0x0000000007280000-0x0000000007312000-memory.dmp

Filesize
584KB

Download
memory/3052-351-0x0000000005630000-0x00000000056CC000-memory.dmp

Filesize
624KB

Download
memory/3052-350-0x0000000000C00000-0x0000000000C12000-memory.dmp

Filesize
72KB

Download

Analysis

Sharing

Errors

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads