asyncrat | a1c7157e3d321dc5966c65601335e053edb2c4a1e6cf4f1f678b974a4f2dbf26

Analysis

max time kernel
139s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22-11-2024 07:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

623534bf150f2538edb27e51ed56b92f464adb5da8e2db378ec3a666fcb64772.vbs
Size

841KB
MD5

7ef40963a365cadbbc01e789477f9e6a
SHA1

df6e734860b53d92611fc32fd353a8df4aa19cd8
SHA256

623534bf150f2538edb27e51ed56b92f464adb5da8e2db378ec3a666fcb64772
SHA512

505e784ec07b5e29f975ac016495a607713f6c1cf6a2d9c6e380873943dd3d64f0ec950cf5f8569a0cef69b88d1cfce1642cdb16a9d989a510e024c2494a2e01
SSDEEP

384:obFjHXqpsYeHEtwKL8NPZj0avxavVoOJjhakb1iUOPLayavjPibWjbInejW3atjQ:obFjHXqpsYeHEtwKfisbW4X3E

Score

10^/10

asyncrat default discovery rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

Default

akconsult.linkpc.net:9872

Mutex

AsyncMutex_6SI8OkPnk

Attributes

delay
3
install
false
install_file
details.exe
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Asyncrat family
asyncrat
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

WScript.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation WScript.exe
Drops startup file 1 IoCs

Processes:

MSBuild.exe

description ioc process

File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Install.vbs MSBuild.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

MSBuild.exe

description pid process target process

PID 464 set thread context of 1904 464 MSBuild.exe MSBuild.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	WScript.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Install.vbs	MSBuild.exe

description	pid	process	target process
PID 464 set thread context of 1904	464	MSBuild.exe	MSBuild.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

MSBuild.execsc.execvtres.exeMSBuild.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

WScript.exeMSBuild.execsc.exe

description	pid	process	target process
PID 4412 wrote to memory of 464	4412	WScript.exe	MSBuild.exe
PID 4412 wrote to memory of 464	4412	WScript.exe	MSBuild.exe
PID 4412 wrote to memory of 464	4412	WScript.exe	MSBuild.exe
PID 464 wrote to memory of 1492	464	MSBuild.exe	csc.exe
PID 464 wrote to memory of 1492	464	MSBuild.exe	csc.exe
PID 464 wrote to memory of 1492	464	MSBuild.exe	csc.exe
PID 1492 wrote to memory of 4484	1492	csc.exe	cvtres.exe
PID 1492 wrote to memory of 4484	1492	csc.exe	cvtres.exe
PID 1492 wrote to memory of 4484	1492	csc.exe	cvtres.exe
PID 464 wrote to memory of 1904	464	MSBuild.exe	MSBuild.exe
PID 464 wrote to memory of 1904	464	MSBuild.exe	MSBuild.exe
PID 464 wrote to memory of 1904	464	MSBuild.exe	MSBuild.exe
PID 464 wrote to memory of 1904	464	MSBuild.exe	MSBuild.exe
PID 464 wrote to memory of 1904	464	MSBuild.exe	MSBuild.exe
PID 464 wrote to memory of 1904	464	MSBuild.exe	MSBuild.exe
PID 464 wrote to memory of 1904	464	MSBuild.exe	MSBuild.exe
PID 464 wrote to memory of 1904	464	MSBuild.exe	MSBuild.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\623534bf150f2538edb27e51ed56b92f464adb5da8e2db378ec3a666fcb64772.vbs"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4412
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" C:\Users\Public\Avast.xml
  2⤵
  - Drops startup file
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:464
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\tirtpg1x\tirtpg1x.cmdline"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1492
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB083.tmp" "c:\Users\Admin\AppData\Local\Temp\tirtpg1x\CSC6C0A8E5147A045B08C32B51C38CBAC9.TMP"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4484
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1904

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RESB083.tmp

Filesize
1KB

MD5
a799acd531014849ac1cae4fa4cc1be2

SHA1
a8d800c5d91821a1b62b37e9a2ebc692290225d7

SHA256
10e8687a0e8672fa2d9ec1f17b508d5affe25a516443b455af123ffee20f5e96

SHA512
5520ae0312d773bb12e362847d868df25943b496745f02874d01a7649745ac202b653678d03b4c502d35fecdf4bcc57412986a60d2c0684d086539c9da124eef

Download Submit
C:\Users\Admin\AppData\Local\Temp\tirtpg1x\tirtpg1x.dll

Filesize
35KB

MD5
a7d557a71f092b193f983613fe92653b

SHA1
38ce1b8e0ca2e4f3696a74af680cf0f27548a8a4

SHA256
4090ea618e88eafc62d11167c8ac211c473e9eb19d5d6abcd0b6a0b26d5aae1d

SHA512
1b268aee96bda9c6878537bf98a83671a6cb27b168b3a87a5e6837133ef9f539cee15a564ca248ba48dffbb534c7ad7be8a82d394ae433936928d5adbc9a23aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\tirtpg1x\tirtpg1x.pdb

Filesize
13KB

MD5
d23b15caf0a5e7eca1f3baae50ddf66b

SHA1
88e730af06e947120515a8f48213da423302c290

SHA256
a899fa624c884bb2efe9dca45077f31a729751b199bed321981c3831613ac142

SHA512
e4a5a92be130e9218848b89ce67379a21cd2bb8a9f5586c3d59ab8a2db251e04883c91b07d53c831443083d8de91246183b6bc939e7daba6538ea052a64b6b48

Download Submit
C:\Users\Public\Avast.xml

Filesize
107KB

MD5
34caa2941ff3b4fa2f405e812c1fdaf5

SHA1
54254bc40b8cad04a4d15d445455f85763519d79

SHA256
6e5735e27b99106d231b14d273e28cbbb21612a1018db90abb752a6d4fe2fa26

SHA512
346e07d22334da5f10aaed86d98fb765769b5a24812e95de675fabf52671c3c081919d669688547c64f4e3c71916c4a60ff6a241421a1e9d25a552ffffbc9386

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\tirtpg1x\CSC6C0A8E5147A045B08C32B51C38CBAC9.TMP

Filesize
652B

MD5
256da8d6e50bee4a0373cb7ffeef0358

SHA1
cbcfef23cd533b0ff88cc675ff45b0451d503fbc

SHA256
3d18d1b54b464fdc0e67ec9e8b45a7be8ef77d487332c343e905517c3ecedfcd

SHA512
18b362b13a56807e572dbf7ec416e82801e2c292ff326f5e7b688187f064d4192c02678ee9f85cf8ad465f91bdbff0982e4ca83ae190994ac884fbadedf11b11

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\tirtpg1x\tirtpg1x.0.cs

Filesize
106KB

MD5
1c0b791c7389870b8f9dd05767a44561

SHA1
35c1c2ecedb0e0e948e79e1f04c7af804acc3b21

SHA256
d46f4dc57accb0914ba1c4607603c74872a0dfc80d13e39690beb5c61c403604

SHA512
2bbde078531e24cda4699fcf90a00bc9c97c536f60d94cfcec5f99b0d573f516b1b958bc13a7f7c38a6cfb9192b5c140259a767dffc179981c1ea99899fe2354

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\tirtpg1x\tirtpg1x.cmdline

Filesize
660B

MD5
17ab3f6a003b7e3dfd936d8bcb18f7d1

SHA1
8fc0cdd124f7f91d5e4f4d22a07527b6b86a8361

SHA256
2e8867f457066231affabd94ea79e22dcdb9e6745adb1b01cc4c2abbc15ba9ff

SHA512
c5aeab8ce3f3f6561ebf4271bf18623f7ae37dbba4466a07fce6f05be38f0f758e8268590afac5d45cd2a8cbc29e8018d85aa8826501b8d8fd32236a375c319b

Download Submit
memory/464-6-0x0000000004ED0000-0x0000000004F00000-memory.dmp

Filesize
192KB

Download
memory/464-4-0x0000000004F10000-0x000000000506A000-memory.dmp

Filesize
1.4MB

Download
memory/464-10-0x0000000005DA0000-0x0000000005F1C000-memory.dmp

Filesize
1.5MB

Download
memory/464-11-0x0000000006110000-0x0000000006476000-memory.dmp

Filesize
3.4MB

Download
memory/464-8-0x0000000005B40000-0x0000000005C62000-memory.dmp

Filesize
1.1MB

Download
memory/464-1-0x000000007481E000-0x000000007481F000-memory.dmp

Filesize
4KB

Download
memory/464-5-0x0000000074810000-0x0000000074FC0000-memory.dmp

Filesize
7.7MB

Download
memory/464-9-0x0000000005A60000-0x0000000005AA4000-memory.dmp

Filesize
272KB

Download
memory/464-3-0x0000000004D80000-0x0000000004D9A000-memory.dmp

Filesize
104KB

Download
memory/464-2-0x0000000000470000-0x00000000004B0000-memory.dmp

Filesize
256KB

Download
memory/464-26-0x0000000005A30000-0x0000000005A40000-memory.dmp

Filesize
64KB

Download
memory/464-29-0x0000000005B50000-0x0000000005BEC000-memory.dmp

Filesize
624KB

Download
memory/464-30-0x0000000005BC0000-0x0000000005BCA000-memory.dmp

Filesize
40KB

Download
memory/464-33-0x0000000074810000-0x0000000074FC0000-memory.dmp

Filesize
7.7MB

Download
memory/1904-31-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download