asyncrat | bbd2b2f19bef121ba2bff9bc1a40227e8114494b55165f3cbd8e53e59fc9daec

Analysis

max time kernel
92s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
19-11-2024 07:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Test.exe
Size

4.0MB
MD5

55603e2a16f0a6d517d63ec1552e45ed
SHA1

2ebc5c1cbff5675f2c13f06e45e5039940107077
SHA256

bbd2b2f19bef121ba2bff9bc1a40227e8114494b55165f3cbd8e53e59fc9daec
SHA512

13475013baee647999c12ef8648492b7a841ed549582782ea45dccb0a5c4a05bcf3374374f1c72c5de8376741eb2ca5215f6d87a2802a4af49b56fd4cc2b7666
SSDEEP

768:WtoQVuOPx178nkC8A+XICpeyr61urX1+T4uoSBGHmDbDzph0oX3ZErGSucdpqKYC:WVxXPn0tYUbph93ZEFucdpqKmY7

Score

10^/10

asyncrat victim rat

Malware Config

Extracted

Family

asyncrat

Botnet

Victim

193.161.193.99:36700

Attributes

delay
1
install
true
install_file
sysvlrhp.exe
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Asyncrat family
asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral2/files/0x000d000000023b45-11.dat	family_asyncrat

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	Test.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	sysvlrhp.exe

Executes dropped EXE 1 IoCs

pid	Process
4904	sysvlrhp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Delays execution with timeout.exe 2 IoCs

evasion

pid	Process
1808	timeout.exe
4048	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1916	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3932	Test.exe
3932	Test.exe
3932	Test.exe
3932	Test.exe
3932	Test.exe
3932	Test.exe
3932	Test.exe
3932	Test.exe
3932	Test.exe
3932	Test.exe
3932	Test.exe
3932	Test.exe
3932	Test.exe
3932	Test.exe
3932	Test.exe
3932	Test.exe
3932	Test.exe
3932	Test.exe
3932	Test.exe
3932	Test.exe
3932	Test.exe
3932	Test.exe
3932	Test.exe
3932	Test.exe
3932	Test.exe
3932	Test.exe
3932	Test.exe
3932	Test.exe
3932	Test.exe
3932	Test.exe
4904	sysvlrhp.exe
4904	sysvlrhp.exe
4904	sysvlrhp.exe
4904	sysvlrhp.exe
4904	sysvlrhp.exe
4904	sysvlrhp.exe
4904	sysvlrhp.exe
4904	sysvlrhp.exe
4904	sysvlrhp.exe
4904	sysvlrhp.exe
4904	sysvlrhp.exe
4904	sysvlrhp.exe
4904	sysvlrhp.exe
4904	sysvlrhp.exe
4904	sysvlrhp.exe
4904	sysvlrhp.exe
4904	sysvlrhp.exe
4904	sysvlrhp.exe
4904	sysvlrhp.exe
4904	sysvlrhp.exe
4904	sysvlrhp.exe
4904	sysvlrhp.exe
4904	sysvlrhp.exe
4904	sysvlrhp.exe
4904	sysvlrhp.exe
4904	sysvlrhp.exe
4904	sysvlrhp.exe
4904	sysvlrhp.exe
4904	sysvlrhp.exe
4904	sysvlrhp.exe
4904	sysvlrhp.exe
4904	sysvlrhp.exe
4904	sysvlrhp.exe
4904	sysvlrhp.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3932	Test.exe
Token: SeDebugPrivilege	4904	sysvlrhp.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 3932 wrote to memory of 228	3932	Test.exe	86
PID 3932 wrote to memory of 228	3932	Test.exe	86
PID 3932 wrote to memory of 4884	3932	Test.exe	87
PID 3932 wrote to memory of 4884	3932	Test.exe	87
PID 4884 wrote to memory of 1808	4884	cmd.exe	90
PID 4884 wrote to memory of 1808	4884	cmd.exe	90
PID 228 wrote to memory of 1916	228	cmd.exe	91
PID 228 wrote to memory of 1916	228	cmd.exe	91
PID 4884 wrote to memory of 4904	4884	cmd.exe	96
PID 4884 wrote to memory of 4904	4884	cmd.exe	96
PID 4904 wrote to memory of 2000	4904	sysvlrhp.exe	102
PID 4904 wrote to memory of 2000	4904	sysvlrhp.exe	102
PID 4904 wrote to memory of 5008	4904	sysvlrhp.exe	104
PID 4904 wrote to memory of 5008	4904	sysvlrhp.exe	104
PID 2000 wrote to memory of 4308	2000	cmd.exe	106
PID 2000 wrote to memory of 4308	2000	cmd.exe	106
PID 5008 wrote to memory of 4048	5008	cmd.exe	107
PID 5008 wrote to memory of 4048	5008	cmd.exe	107

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Test.exe
"C:\Users\Admin\AppData\Local\Temp\Test.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3932
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "sysvlrhp" /tr '"C:\Users\Admin\AppData\Roaming\sysvlrhp.exe"' & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:228
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc onlogon /rl highest /tn "sysvlrhp" /tr '"C:\Users\Admin\AppData\Roaming\sysvlrhp.exe"'
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1916
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpAA78.tmp.bat""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4884
- - C:\Windows\system32\timeout.exe
    timeout 3
    3⤵
    - Delays execution with timeout.exe
    PID:1808
- - C:\Users\Admin\AppData\Roaming\sysvlrhp.exe
    "C:\Users\Admin\AppData\Roaming\sysvlrhp.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4904
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /delete /f /tn "sysvlrhp"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2000
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /delete /f /tn "sysvlrhp"
        5⤵
        
        PID:4308
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpBC46.tmp.bat""
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5008
    - - C:\Windows\system32\timeout.exe
        
        timeout 3
        5⤵
        Delays execution with timeout.exe
        
        PID:4048

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpAA78.tmp.bat

Filesize
152B

MD5
dde6a37365805627f26bd3af3cd42283

SHA1
c4c258ac646ff01ecb08a62b5a3ca0f8d2263419

SHA256
748599501b50b5fe42a4009a618601d4dc1af57782c249f24c1801b005319d6f

SHA512
efb8d5ce36dab138ef11e88eedcc4b12bb497c61b8f17e74a37f894047d48e2f55b043d13ef1ae88e4d0b2bb8ef27f7c6ca21be948c502a7b80e26637672451d

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpBC46.tmp.bat

Filesize
157B

MD5
38b7e9264d7758f2e7875cd51f12d107

SHA1
1f1812be70a34ad2c8fef562a9271c935d51d7b5

SHA256
75eb2a046e591eb207337fa7990740874b8a5da52f67099e183ff0b18a0c81af

SHA512
485df38c22bae906113c2cfba58dd352b1c277f1526fe4b6185168e202c689f38e9393836fa3e3373b5e113397790f5287d63e67fddbb1d5c192fa5be43a746d

Download Submit
C:\Users\Admin\AppData\Roaming\sysvlrhp.exe

Filesize
4.0MB

MD5
55603e2a16f0a6d517d63ec1552e45ed

SHA1
2ebc5c1cbff5675f2c13f06e45e5039940107077

SHA256
bbd2b2f19bef121ba2bff9bc1a40227e8114494b55165f3cbd8e53e59fc9daec

SHA512
13475013baee647999c12ef8648492b7a841ed549582782ea45dccb0a5c4a05bcf3374374f1c72c5de8376741eb2ca5215f6d87a2802a4af49b56fd4cc2b7666

Download Submit
memory/3932-0-0x00007FFE0B013000-0x00007FFE0B015000-memory.dmp

Filesize
8KB

Download
memory/3932-1-0x0000000000910000-0x0000000000926000-memory.dmp

Filesize
88KB

Download
memory/3932-2-0x00007FFE0B010000-0x00007FFE0BAD1000-memory.dmp

Filesize
10.8MB

Download
memory/3932-7-0x00007FFE0B010000-0x00007FFE0BAD1000-memory.dmp

Filesize
10.8MB

Download
memory/3932-8-0x00007FFE0B010000-0x00007FFE0BAD1000-memory.dmp

Filesize
10.8MB

Download
memory/4904-16-0x000000001D0E0000-0x000000001D192000-memory.dmp

Filesize
712KB

Download
memory/4904-15-0x000000001ADE0000-0x000000001AE56000-memory.dmp

Filesize
472KB

Download
memory/4904-17-0x0000000002560000-0x000000000257E000-memory.dmp

Filesize
120KB

Download