asyncrat | 65f7aca2ea89920e1feacd898ca2245eee6d20e4da9e8c966379ff6477cb4d39

General

Target

XenoTempSpoofer.exe
Size

48KB
MD5

ae54752c7443d6ad7823c7d53378fad9
SHA1

857798291622e0f266687e92d78cf8b2fca59476
SHA256

65f7aca2ea89920e1feacd898ca2245eee6d20e4da9e8c966379ff6477cb4d39
SHA512

8ece3fcdc15951ce96703b10d02e8d5f3d820d7c50f1e9cc8159faf73955b7911396b91312a30ca5a7602554a8dcf85e7efbffc9573e135b4d5c4a0e75238942
SSDEEP

768:j1gpLqIL8Goo+jitcKK/rgibI98YbBguA0ecy5cvEgK/JuqVc6KN:j1CSgtclrkzbuHnc0cnkJuqVclN

Score

10^/10

asyncrat default rat

Malware Config

Extracted

Family

asyncrat

Version

1.0.7

Botnet

Default

C2

127.0.0.1:8848

Mutex

dll.sys

Attributes

delay
1
install
true
install_file
XenoTemp Spoofer.exe
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Asyncrat family
asyncrat

Async RAT payload 1 IoCs

rat

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Roaming\XenoTemp Spoofer.exe	family_asyncrat

Executes dropped EXE 1 IoCs

Processes:

XenoTemp Spoofer.exe

pid process

2820 XenoTemp Spoofer.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

2688 timeout.exe
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exe

pid process

2868 schtasks.exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

XenoTempSpoofer.exe

pid process

2116 XenoTempSpoofer.exe
2116 XenoTempSpoofer.exe
2116 XenoTempSpoofer.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

XenoTempSpoofer.exeXenoTemp Spoofer.exe

description pid process

Token: SeDebugPrivilege 2116 XenoTempSpoofer.exe
Token: SeDebugPrivilege 2820 XenoTemp Spoofer.exe

pid	process
2820	XenoTemp Spoofer.exe

pid	process
2688	timeout.exe

pid	process
2868	schtasks.exe

pid	process
2116	XenoTempSpoofer.exe
2116	XenoTempSpoofer.exe
2116	XenoTempSpoofer.exe

description	pid	process
Token: SeDebugPrivilege	2116	XenoTempSpoofer.exe
Token: SeDebugPrivilege	2820	XenoTemp Spoofer.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

XenoTempSpoofer.execmd.execmd.exe

description	pid	process	target process
PID 2116 wrote to memory of 2372	2116	XenoTempSpoofer.exe	cmd.exe
PID 2116 wrote to memory of 2372	2116	XenoTempSpoofer.exe	cmd.exe
PID 2116 wrote to memory of 2372	2116	XenoTempSpoofer.exe	cmd.exe
PID 2116 wrote to memory of 1488	2116	XenoTempSpoofer.exe	cmd.exe
PID 2116 wrote to memory of 1488	2116	XenoTempSpoofer.exe	cmd.exe
PID 2116 wrote to memory of 1488	2116	XenoTempSpoofer.exe	cmd.exe
PID 2372 wrote to memory of 2868	2372	cmd.exe	schtasks.exe
PID 2372 wrote to memory of 2868	2372	cmd.exe	schtasks.exe
PID 2372 wrote to memory of 2868	2372	cmd.exe	schtasks.exe
PID 1488 wrote to memory of 2688	1488	cmd.exe	timeout.exe
PID 1488 wrote to memory of 2688	1488	cmd.exe	timeout.exe
PID 1488 wrote to memory of 2688	1488	cmd.exe	timeout.exe
PID 1488 wrote to memory of 2820	1488	cmd.exe	XenoTemp Spoofer.exe
PID 1488 wrote to memory of 2820	1488	cmd.exe	XenoTemp Spoofer.exe
PID 1488 wrote to memory of 2820	1488	cmd.exe	XenoTemp Spoofer.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\XenoTempSpoofer.exe
"C:\Users\Admin\AppData\Local\Temp\XenoTempSpoofer.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2116

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "XenoTemp Spoofer" /tr '"C:\Users\Admin\AppData\Roaming\XenoTemp Spoofer.exe"' & exit
2⤵
- Suspicious use of WriteProcessMemory
PID:2372

C:\Windows\system32\schtasks.exe
schtasks /create /f /sc onlogon /rl highest /tn "XenoTemp Spoofer" /tr '"C:\Users\Admin\AppData\Roaming\XenoTemp Spoofer.exe"'
3⤵
- Scheduled Task/Job: Scheduled Task
PID:2868

C:\Windows\system32\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpCD2E.tmp.bat""
2⤵
- Suspicious use of WriteProcessMemory
PID:1488

C:\Windows\system32\timeout.exe
timeout 3
3⤵
- Delays execution with timeout.exe
PID:2688

C:\Users\Admin\AppData\Roaming\XenoTemp Spoofer.exe
"C:\Users\Admin\AppData\Roaming\XenoTemp Spoofer.exe"
3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2820

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpCD2E.tmp.bat

Filesize
160B

MD5
62a13950b953a04c521d84741715b83e

SHA1
07d75f3b4a5014b24d3a7200cfa73d825e98ee24

SHA256
50e71bf3581b92f355a166f4131f63619d384ff2b04020071e86eb40152ddf1e

SHA512
c3f9deea7da3b4d9dc14430a3d88f9a1711081be7c923c159d30a3d25b2e7b5b42e4d8b5607400c32ee3e1b75e1f8122a9f5f07a38b69b7192792d72e965a13f

Download Submit
C:\Users\Admin\AppData\Roaming\XenoTemp Spoofer.exe

Filesize
48KB

MD5
ae54752c7443d6ad7823c7d53378fad9

SHA1
857798291622e0f266687e92d78cf8b2fca59476

SHA256
65f7aca2ea89920e1feacd898ca2245eee6d20e4da9e8c966379ff6477cb4d39

SHA512
8ece3fcdc15951ce96703b10d02e8d5f3d820d7c50f1e9cc8159faf73955b7911396b91312a30ca5a7602554a8dcf85e7efbffc9573e135b4d5c4a0e75238942

Download Submit
memory/2116-0-0x000007FEF55B3000-0x000007FEF55B4000-memory.dmp

Filesize
4KB

Download
memory/2116-1-0x0000000001290000-0x00000000012A2000-memory.dmp

Filesize
72KB

Download
memory/2116-2-0x000007FEF55B0000-0x000007FEF5F9C000-memory.dmp

Filesize
9.9MB

Download
memory/2116-12-0x000007FEF55B0000-0x000007FEF5F9C000-memory.dmp

Filesize
9.9MB

Download
memory/2820-16-0x0000000001160000-0x0000000001172000-memory.dmp

Filesize
72KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads