asyncrat | 65f7aca2ea89920e1feacd898ca2245eee6d20e4da9e8c966379ff6477cb4d39

General

Target

XenoTempSpoofer.exe
Size

48KB
MD5

ae54752c7443d6ad7823c7d53378fad9
SHA1

857798291622e0f266687e92d78cf8b2fca59476
SHA256

65f7aca2ea89920e1feacd898ca2245eee6d20e4da9e8c966379ff6477cb4d39
SHA512

8ece3fcdc15951ce96703b10d02e8d5f3d820d7c50f1e9cc8159faf73955b7911396b91312a30ca5a7602554a8dcf85e7efbffc9573e135b4d5c4a0e75238942
SSDEEP

768:j1gpLqIL8Goo+jitcKK/rgibI98YbBguA0ecy5cvEgK/JuqVc6KN:j1CSgtclrkzbuHnc0cnkJuqVclN

Score

10^/10

asyncrat default rat

Malware Config

Extracted

Family

asyncrat

Version

1.0.7

Botnet

Default

C2

127.0.0.1:8848

Mutex

dll.sys

Attributes

delay
1
install
true
install_file
XenoTemp Spoofer.exe
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Asyncrat family
asyncrat

Async RAT payload 1 IoCs

rat

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Roaming\XenoTemp Spoofer.exe	family_asyncrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

XenoTempSpoofer.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	XenoTempSpoofer.exe

Executes dropped EXE 1 IoCs

Processes:

XenoTemp Spoofer.exe

pid process

1416 XenoTemp Spoofer.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

4816 timeout.exe
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exe

pid process

3068 schtasks.exe

pid	process
1416	XenoTemp Spoofer.exe

pid	process
4816	timeout.exe

pid	process
3068	schtasks.exe

Suspicious behavior: EnumeratesProcesses 23 IoCs

Processes:

XenoTempSpoofer.exe

pid	process
4572	XenoTempSpoofer.exe
4572	XenoTempSpoofer.exe
4572	XenoTempSpoofer.exe
4572	XenoTempSpoofer.exe
4572	XenoTempSpoofer.exe
4572	XenoTempSpoofer.exe
4572	XenoTempSpoofer.exe
4572	XenoTempSpoofer.exe
4572	XenoTempSpoofer.exe
4572	XenoTempSpoofer.exe
4572	XenoTempSpoofer.exe
4572	XenoTempSpoofer.exe
4572	XenoTempSpoofer.exe
4572	XenoTempSpoofer.exe
4572	XenoTempSpoofer.exe
4572	XenoTempSpoofer.exe
4572	XenoTempSpoofer.exe
4572	XenoTempSpoofer.exe
4572	XenoTempSpoofer.exe
4572	XenoTempSpoofer.exe
4572	XenoTempSpoofer.exe
4572	XenoTempSpoofer.exe
4572	XenoTempSpoofer.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

XenoTempSpoofer.exeXenoTemp Spoofer.exe

description pid process

Token: SeDebugPrivilege 4572 XenoTempSpoofer.exe
Token: SeDebugPrivilege 1416 XenoTemp Spoofer.exe

description	pid	process
Token: SeDebugPrivilege	4572	XenoTempSpoofer.exe
Token: SeDebugPrivilege	1416	XenoTemp Spoofer.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

XenoTempSpoofer.execmd.execmd.exe

description	pid	process	target process
PID 4572 wrote to memory of 488	4572	XenoTempSpoofer.exe	cmd.exe
PID 4572 wrote to memory of 488	4572	XenoTempSpoofer.exe	cmd.exe
PID 4572 wrote to memory of 3200	4572	XenoTempSpoofer.exe	cmd.exe
PID 4572 wrote to memory of 3200	4572	XenoTempSpoofer.exe	cmd.exe
PID 488 wrote to memory of 3068	488	cmd.exe	schtasks.exe
PID 488 wrote to memory of 3068	488	cmd.exe	schtasks.exe
PID 3200 wrote to memory of 4816	3200	cmd.exe	timeout.exe
PID 3200 wrote to memory of 4816	3200	cmd.exe	timeout.exe
PID 3200 wrote to memory of 1416	3200	cmd.exe	XenoTemp Spoofer.exe
PID 3200 wrote to memory of 1416	3200	cmd.exe	XenoTemp Spoofer.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\XenoTempSpoofer.exe
"C:\Users\Admin\AppData\Local\Temp\XenoTempSpoofer.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4572

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "XenoTemp Spoofer" /tr '"C:\Users\Admin\AppData\Roaming\XenoTemp Spoofer.exe"' & exit
2⤵
- Suspicious use of WriteProcessMemory
PID:488

C:\Windows\system32\schtasks.exe
schtasks /create /f /sc onlogon /rl highest /tn "XenoTemp Spoofer" /tr '"C:\Users\Admin\AppData\Roaming\XenoTemp Spoofer.exe"'
3⤵
- Scheduled Task/Job: Scheduled Task
PID:3068

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp8DE8.tmp.bat""
2⤵
- Suspicious use of WriteProcessMemory
PID:3200

C:\Windows\system32\timeout.exe
timeout 3
3⤵
- Delays execution with timeout.exe
PID:4816

C:\Users\Admin\AppData\Roaming\XenoTemp Spoofer.exe
"C:\Users\Admin\AppData\Roaming\XenoTemp Spoofer.exe"
3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1416

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp8DE8.tmp.bat

Filesize
160B

MD5
8dccb6279e7cedd3b820ec3a88589506

SHA1
b59bd2f22f03ec92640d7c2bcab697a310e7cd35

SHA256
6779c0d5093aec1534f6426ac515d495da79ec9b0d66827ee275084231527a75

SHA512
de1b7eb27043797c4c258bd2ca406a04587f596ed9a3fc357cb75d20e2f90c896ad4510f01e6fa5fe5fc06239519b630c89b1e00d00b599b032f5178799eec76

Download Submit
C:\Users\Admin\AppData\Roaming\XenoTemp Spoofer.exe

Filesize
48KB

MD5
ae54752c7443d6ad7823c7d53378fad9

SHA1
857798291622e0f266687e92d78cf8b2fca59476

SHA256
65f7aca2ea89920e1feacd898ca2245eee6d20e4da9e8c966379ff6477cb4d39

SHA512
8ece3fcdc15951ce96703b10d02e8d5f3d820d7c50f1e9cc8159faf73955b7911396b91312a30ca5a7602554a8dcf85e7efbffc9573e135b4d5c4a0e75238942

Download Submit
memory/4572-0-0x00007FFE6DBB3000-0x00007FFE6DBB5000-memory.dmp

Filesize
8KB

Download
memory/4572-1-0x0000000000670000-0x0000000000682000-memory.dmp

Filesize
72KB

Download
memory/4572-2-0x00007FFE6DBB0000-0x00007FFE6E671000-memory.dmp

Filesize
10.8MB

Download
memory/4572-7-0x00007FFE6DBB0000-0x00007FFE6E671000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads