asyncrat | 50d0d7ddbaeca0765f06901ef050fc76a30153fb804f59d804abf60135fdf0ae

Analysis

max time kernel
117s
max time network
178s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19-11-2024 14:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NOTIFICACIÓN ELECTRÓNICA AGRADECEMOS CONFIRMAR RECIBIDO NUMERO DE RAD 456468 1531 6516 3213568 000 3546/ReFB.exe
Size

80KB
MD5

2a8613b7d99903516b8fe02fd820bf52
SHA1

78a96addcb556ab1d490fac80f929305263d06b9
SHA256

f1d68c5e7c7660d4f2ce412c109b7fe3e088872fa0ebe61ca9ab9dd92a496407
SHA512

af0902aeb6169ea507b787da7b61c3533df4610c3f51c1d8f65dfc9008c8ce2580f2d86a49a4d0acc2c51c731f3e4c447d0d1d8e779dc1c75e43d30b79c46436
SSDEEP

1536:9A8oAY5SXfidLez+Q+EGfdUHLLXJ+CqoVpPBucQwk7qnKXKo5OMY8xk03ben8TK:M7Ohz+Q+EGlUHLLXJ+CqoTPBucQwktXS

Score

10^/10

asyncrat *** 19 nov ***discovery rat

Malware Config

Extracted

Family

asyncrat

Version

| CRACKED BY https://t.me/xworm_v2

Botnet

*** 19 NOV ***

19nov2024.duckdns.org:9003

Mutex

AsyncMutex_6SI8OkPnk

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Asyncrat family
asyncrat

Executes dropped EXE 1 IoCs

pid	Process
2532	ReFB.exe

Loads dropped DLL 8 IoCs

pid	Process
1092	ReFB.exe
2532	ReFB.exe
2532	ReFB.exe
2532	ReFB.exe
2532	ReFB.exe
2532	ReFB.exe
2532	ReFB.exe
2344	cmd.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2532 set thread context of 2344	2532	ReFB.exe	31
PID 2344 set thread context of 2508	2344	cmd.exe	34

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ReFB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ReFB.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
1092	ReFB.exe
2532	ReFB.exe
2532	ReFB.exe
2344	cmd.exe
2344	cmd.exe

Suspicious behavior: MapViewOfSection 3 IoCs

pid	Process
2532	ReFB.exe
2344	cmd.exe
2344	cmd.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2508	MSBuild.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 1092 wrote to memory of 2532	1092	ReFB.exe	30
PID 1092 wrote to memory of 2532	1092	ReFB.exe	30
PID 1092 wrote to memory of 2532	1092	ReFB.exe	30
PID 1092 wrote to memory of 2532	1092	ReFB.exe	30
PID 2532 wrote to memory of 2344	2532	ReFB.exe	31
PID 2532 wrote to memory of 2344	2532	ReFB.exe	31
PID 2532 wrote to memory of 2344	2532	ReFB.exe	31
PID 2532 wrote to memory of 2344	2532	ReFB.exe	31
PID 2532 wrote to memory of 2344	2532	ReFB.exe	31
PID 2344 wrote to memory of 2508	2344	cmd.exe	34
PID 2344 wrote to memory of 2508	2344	cmd.exe	34
PID 2344 wrote to memory of 2508	2344	cmd.exe	34
PID 2344 wrote to memory of 2508	2344	cmd.exe	34
PID 2344 wrote to memory of 2508	2344	cmd.exe	34
PID 2344 wrote to memory of 2508	2344	cmd.exe	34

C:\Users\Admin\AppData\Local\Temp\NOTIFICACIÓN ELECTRÓNICA AGRADECEMOS CONFIRMAR RECIBIDO NUMERO DE RAD 456468 1531 6516 3213568 000 3546\ReFB.exe
"C:\Users\Admin\AppData\Local\Temp\NOTIFICACIÓN ELECTRÓNICA AGRADECEMOS CONFIRMAR RECIBIDO NUMERO DE RAD 456468 1531 6516 3213568 000 3546\ReFB.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1092
- C:\Users\Admin\AppData\Roaming\WriterFastv4_x64\ReFB.exe
  C:\Users\Admin\AppData\Roaming\WriterFastv4_x64\ReFB.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:2532
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\SysWOW64\cmd.exe
    3⤵
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:2344
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2508

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Cab6A2A.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\c55110cf

Filesize
777KB

MD5
13ed7d5b906de9beb1ffec77fcfdb4ce

SHA1
d47d7eac0068c571403f277e59dc7a78fd556954

SHA256
d5d9619ebc68f72aeda4f2debd326dc188aabe1460e724ccc49c118f4bcad567

SHA512
ca53937f68aae84b13fb64116da52d9f45a27be5b2a13144fc690831d6caf714ffad2acc3e0ee8c1216f7c7d341d4bfbf125ee423c03dec0b6124c2ad5f89da2

Download Submit
C:\Users\Admin\AppData\Roaming\WriterFastv4_x64\MSVCP100.dll

Filesize
411KB

MD5
03e9314004f504a14a61c3d364b62f66

SHA1
0aa3caac24fdf9d9d4c618e2bbf0a063036cd55d

SHA256
a3ba6421991241bea9c8334b62c3088f8f131ab906c3cc52113945d05016a35f

SHA512
2fcff4439d2759d93c57d49b24f28ae89b7698e284e76ac65fe2b50bdefc23a8cc3c83891d671de4e4c0f036cef810856de79ac2b028aa89a895bf35abff8c8d

Download Submit
C:\Users\Admin\AppData\Roaming\WriterFastv4_x64\MSVCR100.dll

Filesize
752KB

MD5
67ec459e42d3081dd8fd34356f7cafc1

SHA1
1738050616169d5b17b5adac3ff0370b8c642734

SHA256
1221a09484964a6f38af5e34ee292b9afefccb3dc6e55435fd3aaf7c235d9067

SHA512
9ed1c106df217e0b4e4fbd1f4275486ceba1d8a225d6c7e47b854b0b5e6158135b81be926f51db0ad5c624f9bd1d09282332cf064680dc9f7d287073b9686d33

Download Submit
C:\Users\Admin\AppData\Roaming\WriterFastv4_x64\QtCore4.dll

Filesize
2.5MB

MD5
14d40fbbb9f7da1a1b2f350b2ce557bc

SHA1
8352f74e75753e28df1874fcf4e841e49aab9172

SHA256
c84762d1bd4975173fcffc1cc27ef9289281061b97c39b6a300654c2293dfcf7

SHA512
e9e36bf39ece517c5af551414de84f8033e90265e0e97f4f7edf23f47540c5f8c019b501847b56d4c0095d8470b0f58c7871089b06eed68a50d9dcedf864fe07

Download Submit
C:\Users\Admin\AppData\Roaming\WriterFastv4_x64\QtGui4.dll

Filesize
8.2MB

MD5
831ba3a8c9d9916bdf82e07a3e8338cc

SHA1
6c89fd258937427d14d5042736fdfccd0049f042

SHA256
d2c8c8b6cc783e4c00a5ef3365457d776dfc1205a346b676915e39d434f5a52d

SHA512
beda57851e0e3781ece1d0ee53a3f86c52ba99cb045943227b6c8fc1848a452269f2768bf4c661e27ddfbe436df82cfd1de54706d814f81797a13fefec4602c5

Download Submit
C:\Users\Admin\AppData\Roaming\WriterFastv4_x64\QtNetwork4.dll

Filesize
1.0MB

MD5
8a2e025fd3ddd56c8e4f63416e46e2ec

SHA1
5f58feb11e84aa41d5548f5a30fc758221e9dd64

SHA256
52ae07d1d6a467283055a3512d655b6a43a42767024e57279784701206d97003

SHA512
8e3a449163e775dc000e9674bca81ffabc7fecd9278da5a40659620cfc9cc07f50cc29341e74176fe10717b2a12ea3d5148d1ffc906bc809b1cd5c8c59de7ba1

Download Submit
C:\Users\Admin\AppData\Roaming\WriterFastv4_x64\QtWebKit4.dll

Filesize
12.5MB

MD5
a9fd9dd23c03aed462127ecc3e262590

SHA1
a1e0c1dd566b54221a140103cb4443bb2f51decd

SHA256
732ebca9428519f3f191047b166281b2f5b0495ce7b254c79f713526ca5869fd

SHA512
80d955f0eb4ee48106766eec9e478630803c1b0df61f6dda8d44403f99b478d476a139e58dbb13f236aaa2412528d54f234a099395e6907ef39b59595bb08785

Download Submit
C:\Users\Admin\AppData\Roaming\WriterFastv4_x64\albloo

Filesize
18KB

MD5
c6e436a1a25350b8b6c4b3051baff7e3

SHA1
3205cd0b70801d49c0b800ddfc2b5dfce9a74e1a

SHA256
15cab77c30c2eb8036a5275de176942cc5096adfd9b9ef7c0a4d38939f29de47

SHA512
2677f4b588a8274cbf596911b096de450b68f991021dbd5893e0f9e821ed87e67b70179e8b788fbfc93d441613c89169f894e2228591105312c225aeefe67c9e

Download Submit
C:\Users\Admin\AppData\Roaming\WriterFastv4_x64\cict

Filesize
535KB

MD5
a3ce45da4a1b0d28dee15413e6f461fb

SHA1
e9facbe271bcf73b2d513ef7025cdffaed13931e

SHA256
894c39f6ed1760c33be3df2c566ba3dd2a6d26c43c2f21d59c7ba45e71d313a4

SHA512
f93ab7c977de1de92992b3d86d50b8370d5ed414c1c32d4c25cb6c410013e9f69ec2e17fb686e4a50dc251fe2135e315a238a5fa5b6ab30b514257f362cbc302

Download Submit
\Users\Admin\AppData\Roaming\WriterFastv4_x64\ReFB.exe

Filesize
80KB

MD5
2a8613b7d99903516b8fe02fd820bf52

SHA1
78a96addcb556ab1d490fac80f929305263d06b9

SHA256
f1d68c5e7c7660d4f2ce412c109b7fe3e088872fa0ebe61ca9ab9dd92a496407

SHA512
af0902aeb6169ea507b787da7b61c3533df4610c3f51c1d8f65dfc9008c8ce2580f2d86a49a4d0acc2c51c731f3e4c447d0d1d8e779dc1c75e43d30b79c46436

Download Submit
memory/1092-1-0x0000000077830000-0x00000000779D9000-memory.dmp

Filesize
1.7MB

Download
memory/1092-0-0x00000000743F0000-0x0000000074564000-memory.dmp

Filesize
1.5MB

Download
memory/2344-37-0x0000000077830000-0x00000000779D9000-memory.dmp

Filesize
1.7MB

Download
memory/2344-35-0x0000000074360000-0x00000000744D4000-memory.dmp

Filesize
1.5MB

Download
memory/2344-84-0x0000000074360000-0x00000000744D4000-memory.dmp

Filesize
1.5MB

Download
memory/2344-89-0x0000000074360000-0x00000000744D4000-memory.dmp

Filesize
1.5MB

Download
memory/2508-88-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2508-87-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2508-86-0x0000000072DB0000-0x0000000073E12000-memory.dmp

Filesize
16.4MB

Download
memory/2508-90-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/2532-31-0x0000000074373000-0x0000000074375000-memory.dmp

Filesize
8KB

Download
memory/2532-32-0x0000000074360000-0x00000000744D4000-memory.dmp

Filesize
1.5MB

Download
memory/2532-33-0x0000000074360000-0x00000000744D4000-memory.dmp

Filesize
1.5MB

Download
memory/2532-30-0x0000000077830000-0x00000000779D9000-memory.dmp

Filesize
1.7MB

Download
memory/2532-29-0x0000000074360000-0x00000000744D4000-memory.dmp

Filesize
1.5MB

Download