asyncrat | 65f7aca2ea89920e1feacd898ca2245eee6d20e4da9e8c966379ff6477cb4d39

General

Target

Xeno Temp Spoofer.exe
Size

48KB
MD5

ae54752c7443d6ad7823c7d53378fad9
SHA1

857798291622e0f266687e92d78cf8b2fca59476
SHA256

65f7aca2ea89920e1feacd898ca2245eee6d20e4da9e8c966379ff6477cb4d39
SHA512

8ece3fcdc15951ce96703b10d02e8d5f3d820d7c50f1e9cc8159faf73955b7911396b91312a30ca5a7602554a8dcf85e7efbffc9573e135b4d5c4a0e75238942
SSDEEP

768:j1gpLqIL8Goo+jitcKK/rgibI98YbBguA0ecy5cvEgK/JuqVc6KN:j1CSgtclrkzbuHnc0cnkJuqVclN

Score

10^/10

asyncrat default rat

Malware Config

Extracted

Family

asyncrat

Version

1.0.7

Botnet

Default

C2

127.0.0.1:8848

Mutex

dll.sys

Attributes

delay
1
install
true
install_file
XenoTemp Spoofer.exe
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Asyncrat family
asyncrat

Async RAT payload 1 IoCs

rat

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Roaming\XenoTemp Spoofer.exe	family_asyncrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Xeno Temp Spoofer.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	Xeno Temp Spoofer.exe

Executes dropped EXE 1 IoCs

Processes:

XenoTemp Spoofer.exe

pid process

3544 XenoTemp Spoofer.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

684 timeout.exe
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exe

pid process

3172 schtasks.exe

pid	process
3544	XenoTemp Spoofer.exe

pid	process
684	timeout.exe

pid	process
3172	schtasks.exe

Suspicious behavior: EnumeratesProcesses 25 IoCs

Processes:

Xeno Temp Spoofer.exe

pid	process
2584	Xeno Temp Spoofer.exe
2584	Xeno Temp Spoofer.exe
2584	Xeno Temp Spoofer.exe
2584	Xeno Temp Spoofer.exe
2584	Xeno Temp Spoofer.exe
2584	Xeno Temp Spoofer.exe
2584	Xeno Temp Spoofer.exe
2584	Xeno Temp Spoofer.exe
2584	Xeno Temp Spoofer.exe
2584	Xeno Temp Spoofer.exe
2584	Xeno Temp Spoofer.exe
2584	Xeno Temp Spoofer.exe
2584	Xeno Temp Spoofer.exe
2584	Xeno Temp Spoofer.exe
2584	Xeno Temp Spoofer.exe
2584	Xeno Temp Spoofer.exe
2584	Xeno Temp Spoofer.exe
2584	Xeno Temp Spoofer.exe
2584	Xeno Temp Spoofer.exe
2584	Xeno Temp Spoofer.exe
2584	Xeno Temp Spoofer.exe
2584	Xeno Temp Spoofer.exe
2584	Xeno Temp Spoofer.exe
2584	Xeno Temp Spoofer.exe
2584	Xeno Temp Spoofer.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Xeno Temp Spoofer.exeXenoTemp Spoofer.exe

description pid process

Token: SeDebugPrivilege 2584 Xeno Temp Spoofer.exe
Token: SeDebugPrivilege 3544 XenoTemp Spoofer.exe

description	pid	process
Token: SeDebugPrivilege	2584	Xeno Temp Spoofer.exe
Token: SeDebugPrivilege	3544	XenoTemp Spoofer.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

Xeno Temp Spoofer.execmd.execmd.exe

description	pid	process	target process
PID 2584 wrote to memory of 4016	2584	Xeno Temp Spoofer.exe	cmd.exe
PID 2584 wrote to memory of 4016	2584	Xeno Temp Spoofer.exe	cmd.exe
PID 2584 wrote to memory of 3536	2584	Xeno Temp Spoofer.exe	cmd.exe
PID 2584 wrote to memory of 3536	2584	Xeno Temp Spoofer.exe	cmd.exe
PID 4016 wrote to memory of 3172	4016	cmd.exe	schtasks.exe
PID 4016 wrote to memory of 3172	4016	cmd.exe	schtasks.exe
PID 3536 wrote to memory of 684	3536	cmd.exe	timeout.exe
PID 3536 wrote to memory of 684	3536	cmd.exe	timeout.exe
PID 3536 wrote to memory of 3544	3536	cmd.exe	XenoTemp Spoofer.exe
PID 3536 wrote to memory of 3544	3536	cmd.exe	XenoTemp Spoofer.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Xeno Temp Spoofer.exe
"C:\Users\Admin\AppData\Local\Temp\Xeno Temp Spoofer.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2584

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "XenoTemp Spoofer" /tr '"C:\Users\Admin\AppData\Roaming\XenoTemp Spoofer.exe"' & exit
2⤵
- Suspicious use of WriteProcessMemory
PID:4016

C:\Windows\system32\schtasks.exe
schtasks /create /f /sc onlogon /rl highest /tn "XenoTemp Spoofer" /tr '"C:\Users\Admin\AppData\Roaming\XenoTemp Spoofer.exe"'
3⤵
- Scheduled Task/Job: Scheduled Task
PID:3172

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp80E8.tmp.bat""
2⤵
- Suspicious use of WriteProcessMemory
PID:3536

C:\Windows\system32\timeout.exe
timeout 3
3⤵
- Delays execution with timeout.exe
PID:684

C:\Users\Admin\AppData\Roaming\XenoTemp Spoofer.exe
"C:\Users\Admin\AppData\Roaming\XenoTemp Spoofer.exe"
3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3544

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp80E8.tmp.bat

Filesize
160B

MD5
0f0b6c11c9338dd7d9b991c0fb0eb616

SHA1
66841b27ca0a6fc32d8022dc8a63eea8dba0d700

SHA256
dfdf29dc4dd72eac3eb6bf9851962789d51a9a3018954ee1611597622cca065f

SHA512
e211e42eecdbcf0dd67e6aa19b3358916e94ef61b50242c56feb664553ba5fc4cb85cacec5ae547b08c546a1e088d357cfed05b6c350a89cef5a192bc6d35e15

Download Submit
C:\Users\Admin\AppData\Roaming\XenoTemp Spoofer.exe

Filesize
48KB

MD5
ae54752c7443d6ad7823c7d53378fad9

SHA1
857798291622e0f266687e92d78cf8b2fca59476

SHA256
65f7aca2ea89920e1feacd898ca2245eee6d20e4da9e8c966379ff6477cb4d39

SHA512
8ece3fcdc15951ce96703b10d02e8d5f3d820d7c50f1e9cc8159faf73955b7911396b91312a30ca5a7602554a8dcf85e7efbffc9573e135b4d5c4a0e75238942

Download Submit
memory/2584-0-0x00007FF8E41C3000-0x00007FF8E41C5000-memory.dmp

Filesize
8KB

Download
memory/2584-1-0x0000000000FA0000-0x0000000000FB2000-memory.dmp

Filesize
72KB

Download
memory/2584-2-0x00007FF8E41C0000-0x00007FF8E4C81000-memory.dmp

Filesize
10.8MB

Download
memory/2584-7-0x00007FF8E41C0000-0x00007FF8E4C81000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads