asyncrat | 65f7aca2ea89920e1feacd898ca2245eee6d20e4da9e8c966379ff6477cb4d39

General

Target

Xeno Temp Spoofer.exe
Size

48KB
MD5

ae54752c7443d6ad7823c7d53378fad9
SHA1

857798291622e0f266687e92d78cf8b2fca59476
SHA256

65f7aca2ea89920e1feacd898ca2245eee6d20e4da9e8c966379ff6477cb4d39
SHA512

8ece3fcdc15951ce96703b10d02e8d5f3d820d7c50f1e9cc8159faf73955b7911396b91312a30ca5a7602554a8dcf85e7efbffc9573e135b4d5c4a0e75238942
SSDEEP

768:j1gpLqIL8Goo+jitcKK/rgibI98YbBguA0ecy5cvEgK/JuqVc6KN:j1CSgtclrkzbuHnc0cnkJuqVclN

Score

10^/10

asyncrat default rat

Malware Config

Extracted

Family

asyncrat

Version

1.0.7

Botnet

Default

C2

127.0.0.1:8848

Mutex

dll.sys

Attributes

delay
1
install
true
install_file
XenoTemp Spoofer.exe
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Asyncrat family
asyncrat

Async RAT payload 1 IoCs

rat

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Roaming\XenoTemp Spoofer.exe	family_asyncrat

Executes dropped EXE 1 IoCs

Processes:

XenoTemp Spoofer.exe

pid process

2492 XenoTemp Spoofer.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

2464 timeout.exe
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exe

pid process

2656 schtasks.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

Xeno Temp Spoofer.exe

pid process

1344 Xeno Temp Spoofer.exe
1344 Xeno Temp Spoofer.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Xeno Temp Spoofer.exeXenoTemp Spoofer.exe

description pid process

Token: SeDebugPrivilege 1344 Xeno Temp Spoofer.exe
Token: SeDebugPrivilege 2492 XenoTemp Spoofer.exe

pid	process
2492	XenoTemp Spoofer.exe

pid	process
2464	timeout.exe

pid	process
2656	schtasks.exe

pid	process
1344	Xeno Temp Spoofer.exe
1344	Xeno Temp Spoofer.exe

description	pid	process
Token: SeDebugPrivilege	1344	Xeno Temp Spoofer.exe
Token: SeDebugPrivilege	2492	XenoTemp Spoofer.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

Xeno Temp Spoofer.execmd.execmd.exe

description	pid	process	target process
PID 1344 wrote to memory of 2684	1344	Xeno Temp Spoofer.exe	cmd.exe
PID 1344 wrote to memory of 2684	1344	Xeno Temp Spoofer.exe	cmd.exe
PID 1344 wrote to memory of 2684	1344	Xeno Temp Spoofer.exe	cmd.exe
PID 1344 wrote to memory of 2612	1344	Xeno Temp Spoofer.exe	cmd.exe
PID 1344 wrote to memory of 2612	1344	Xeno Temp Spoofer.exe	cmd.exe
PID 1344 wrote to memory of 2612	1344	Xeno Temp Spoofer.exe	cmd.exe
PID 2612 wrote to memory of 2464	2612	cmd.exe	timeout.exe
PID 2612 wrote to memory of 2464	2612	cmd.exe	timeout.exe
PID 2612 wrote to memory of 2464	2612	cmd.exe	timeout.exe
PID 2684 wrote to memory of 2656	2684	cmd.exe	schtasks.exe
PID 2684 wrote to memory of 2656	2684	cmd.exe	schtasks.exe
PID 2684 wrote to memory of 2656	2684	cmd.exe	schtasks.exe
PID 2612 wrote to memory of 2492	2612	cmd.exe	XenoTemp Spoofer.exe
PID 2612 wrote to memory of 2492	2612	cmd.exe	XenoTemp Spoofer.exe
PID 2612 wrote to memory of 2492	2612	cmd.exe	XenoTemp Spoofer.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Xeno Temp Spoofer.exe
"C:\Users\Admin\AppData\Local\Temp\Xeno Temp Spoofer.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1344

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "XenoTemp Spoofer" /tr '"C:\Users\Admin\AppData\Roaming\XenoTemp Spoofer.exe"' & exit
2⤵
- Suspicious use of WriteProcessMemory
PID:2684

C:\Windows\system32\schtasks.exe
schtasks /create /f /sc onlogon /rl highest /tn "XenoTemp Spoofer" /tr '"C:\Users\Admin\AppData\Roaming\XenoTemp Spoofer.exe"'
3⤵
- Scheduled Task/Job: Scheduled Task
PID:2656

C:\Windows\system32\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp5090.tmp.bat""
2⤵
- Suspicious use of WriteProcessMemory
PID:2612

C:\Windows\system32\timeout.exe
timeout 3
3⤵
- Delays execution with timeout.exe
PID:2464

C:\Users\Admin\AppData\Roaming\XenoTemp Spoofer.exe
"C:\Users\Admin\AppData\Roaming\XenoTemp Spoofer.exe"
3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2492

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp5090.tmp.bat

Filesize
160B

MD5
0b9d62bb7fd7f511e75b57edd2a54c9b

SHA1
f7cb46a73d8b46f2aa38a36c3a07265e79052427

SHA256
cba2a8850efc8a993f875173da116fd769c2ef8db78cf17937eb12e7d78f5f08

SHA512
edb120e49f0c3ac8b48cf2e13bf85a2684f46d44657454e654da9874f4a5adb70a518ade141ad100c3fcf528440515c62a11a28b5839c6780751657ba834cfc5

Download Submit
C:\Users\Admin\AppData\Roaming\XenoTemp Spoofer.exe

Filesize
48KB

MD5
ae54752c7443d6ad7823c7d53378fad9

SHA1
857798291622e0f266687e92d78cf8b2fca59476

SHA256
65f7aca2ea89920e1feacd898ca2245eee6d20e4da9e8c966379ff6477cb4d39

SHA512
8ece3fcdc15951ce96703b10d02e8d5f3d820d7c50f1e9cc8159faf73955b7911396b91312a30ca5a7602554a8dcf85e7efbffc9573e135b4d5c4a0e75238942

Download Submit
memory/1344-0-0x000007FEF6363000-0x000007FEF6364000-memory.dmp

Filesize
4KB

Download
memory/1344-1-0x00000000001A0000-0x00000000001B2000-memory.dmp

Filesize
72KB

Download
memory/1344-2-0x000007FEF6360000-0x000007FEF6D4C000-memory.dmp

Filesize
9.9MB

Download
memory/1344-12-0x000007FEF6360000-0x000007FEF6D4C000-memory.dmp

Filesize
9.9MB

Download
memory/2492-16-0x00000000000C0000-0x00000000000D2000-memory.dmp

Filesize
72KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads