asyncrat | hxxps://gofile[.]to/xWWm/asyncclient[.]exe

Analysis

max time kernel
208s
max time network
224s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241023-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
24-11-2024 10:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://gofile.to/xWWm/asyncclient.exe

Score

10^/10

asyncrat default discovery phishing rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

192.168.1.63:7118

192.168.1.63:37454

Mutex

4wMHcxbOKref

Attributes

delay
3
install
false
install_file
update
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Asyncrat family
asyncrat

Async RAT payload 1 IoCs

rat

Processes:

resource	yara_rule
C:\Users\Admin\Downloads\Unconfirmed 123895.crdownload	family_asyncrat

Downloads MZ/PE file
A potential corporate email address has been identified in the URL: [email protected]
phishing
A potential corporate email address has been identified in the URL: [email protected]
phishing
A potential corporate email address has been identified in the URL: sweetalert2@11
phishing
Executes dropped EXE 3 IoCs

Processes:

AsyncClient.exeAsyncClient.exeAsyncClient.exe

pid process

5328 AsyncClient.exe
5172 AsyncClient.exe
5996 AsyncClient.exe

pid	process
5328	AsyncClient.exe
5172	AsyncClient.exe
5996	AsyncClient.exe

Drops file in Program Files directory 2 IoCs

Processes:

setup.exe

description	ioc	process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\2ae3bd20-0aeb-4510-9001-6508b3281eaf.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20241124104823.pma	setup.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

AsyncClient.exeAsyncClient.exeAsyncClient.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AsyncClient.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AsyncClient.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AsyncClient.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

Processes:

msedge.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-4074627901-37362009-3519777259-1000_Classes\Local Settings msedge.exe
NTFS ADS 1 IoCs

Processes:

msedge.exe

description ioc process

File opened for modification C:\Users\Admin\Downloads\Unconfirmed 123895.crdownload:SmartScreen msedge.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4074627901-37362009-3519777259-1000_Classes\Local Settings	msedge.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 123895.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exemsedge.exe

pid	process
1908	msedge.exe
1908	msedge.exe
3788	msedge.exe
3788	msedge.exe
3956	identity_helper.exe
3956	identity_helper.exe
3048	msedge.exe
3048	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

Processes:

msedge.exe

pid	process
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe

Suspicious use of FindShellTrayWindow 35 IoCs

Processes:

msedge.exe

pid	process
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 3788 wrote to memory of 4296	3788	msedge.exe	msedge.exe
PID 3788 wrote to memory of 4296	3788	msedge.exe	msedge.exe
PID 3788 wrote to memory of 4668	3788	msedge.exe	msedge.exe
PID 3788 wrote to memory of 4668	3788	msedge.exe	msedge.exe
PID 3788 wrote to memory of 4668	3788	msedge.exe	msedge.exe
PID 3788 wrote to memory of 4668	3788	msedge.exe	msedge.exe
PID 3788 wrote to memory of 4668	3788	msedge.exe	msedge.exe
PID 3788 wrote to memory of 4668	3788	msedge.exe	msedge.exe
PID 3788 wrote to memory of 4668	3788	msedge.exe	msedge.exe
PID 3788 wrote to memory of 4668	3788	msedge.exe	msedge.exe
PID 3788 wrote to memory of 4668	3788	msedge.exe	msedge.exe
PID 3788 wrote to memory of 4668	3788	msedge.exe	msedge.exe
PID 3788 wrote to memory of 4668	3788	msedge.exe	msedge.exe
PID 3788 wrote to memory of 4668	3788	msedge.exe	msedge.exe
PID 3788 wrote to memory of 4668	3788	msedge.exe	msedge.exe
PID 3788 wrote to memory of 4668	3788	msedge.exe	msedge.exe
PID 3788 wrote to memory of 4668	3788	msedge.exe	msedge.exe
PID 3788 wrote to memory of 4668	3788	msedge.exe	msedge.exe
PID 3788 wrote to memory of 4668	3788	msedge.exe	msedge.exe
PID 3788 wrote to memory of 4668	3788	msedge.exe	msedge.exe
PID 3788 wrote to memory of 4668	3788	msedge.exe	msedge.exe
PID 3788 wrote to memory of 4668	3788	msedge.exe	msedge.exe
PID 3788 wrote to memory of 4668	3788	msedge.exe	msedge.exe
PID 3788 wrote to memory of 4668	3788	msedge.exe	msedge.exe
PID 3788 wrote to memory of 4668	3788	msedge.exe	msedge.exe
PID 3788 wrote to memory of 4668	3788	msedge.exe	msedge.exe
PID 3788 wrote to memory of 4668	3788	msedge.exe	msedge.exe
PID 3788 wrote to memory of 4668	3788	msedge.exe	msedge.exe
PID 3788 wrote to memory of 4668	3788	msedge.exe	msedge.exe
PID 3788 wrote to memory of 4668	3788	msedge.exe	msedge.exe
PID 3788 wrote to memory of 4668	3788	msedge.exe	msedge.exe
PID 3788 wrote to memory of 4668	3788	msedge.exe	msedge.exe
PID 3788 wrote to memory of 4668	3788	msedge.exe	msedge.exe
PID 3788 wrote to memory of 4668	3788	msedge.exe	msedge.exe
PID 3788 wrote to memory of 4668	3788	msedge.exe	msedge.exe
PID 3788 wrote to memory of 4668	3788	msedge.exe	msedge.exe
PID 3788 wrote to memory of 4668	3788	msedge.exe	msedge.exe
PID 3788 wrote to memory of 4668	3788	msedge.exe	msedge.exe
PID 3788 wrote to memory of 4668	3788	msedge.exe	msedge.exe
PID 3788 wrote to memory of 4668	3788	msedge.exe	msedge.exe
PID 3788 wrote to memory of 4668	3788	msedge.exe	msedge.exe
PID 3788 wrote to memory of 4668	3788	msedge.exe	msedge.exe
PID 3788 wrote to memory of 1908	3788	msedge.exe	msedge.exe
PID 3788 wrote to memory of 1908	3788	msedge.exe	msedge.exe
PID 3788 wrote to memory of 1100	3788	msedge.exe	msedge.exe
PID 3788 wrote to memory of 1100	3788	msedge.exe	msedge.exe
PID 3788 wrote to memory of 1100	3788	msedge.exe	msedge.exe
PID 3788 wrote to memory of 1100	3788	msedge.exe	msedge.exe
PID 3788 wrote to memory of 1100	3788	msedge.exe	msedge.exe
PID 3788 wrote to memory of 1100	3788	msedge.exe	msedge.exe
PID 3788 wrote to memory of 1100	3788	msedge.exe	msedge.exe
PID 3788 wrote to memory of 1100	3788	msedge.exe	msedge.exe
PID 3788 wrote to memory of 1100	3788	msedge.exe	msedge.exe
PID 3788 wrote to memory of 1100	3788	msedge.exe	msedge.exe
PID 3788 wrote to memory of 1100	3788	msedge.exe	msedge.exe
PID 3788 wrote to memory of 1100	3788	msedge.exe	msedge.exe
PID 3788 wrote to memory of 1100	3788	msedge.exe	msedge.exe
PID 3788 wrote to memory of 1100	3788	msedge.exe	msedge.exe
PID 3788 wrote to memory of 1100	3788	msedge.exe	msedge.exe
PID 3788 wrote to memory of 1100	3788	msedge.exe	msedge.exe
PID 3788 wrote to memory of 1100	3788	msedge.exe	msedge.exe
PID 3788 wrote to memory of 1100	3788	msedge.exe	msedge.exe
PID 3788 wrote to memory of 1100	3788	msedge.exe	msedge.exe
PID 3788 wrote to memory of 1100	3788	msedge.exe	msedge.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://gofile.to/xWWm/asyncclient.exe
1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ffb1b8246f8,0x7ffb1b824708,0x7ffb1b824718
  2⤵
  PID:4296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2216,4891618797517162087,15088883161149711115,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2228 /prefetch:2
  2⤵
  PID:4668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2216,4891618797517162087,15088883161149711115,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2284 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2216,4891618797517162087,15088883161149711115,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2844 /prefetch:8
  2⤵
  PID:1100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,4891618797517162087,15088883161149711115,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:1
  2⤵
  PID:4084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,4891618797517162087,15088883161149711115,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3408 /prefetch:1
  2⤵
  PID:4492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,4891618797517162087,15088883161149711115,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5292 /prefetch:1
  2⤵
  PID:2724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,4891618797517162087,15088883161149711115,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5068 /prefetch:1
  2⤵
  PID:228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,4891618797517162087,15088883161149711115,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5496 /prefetch:1
  2⤵
  PID:2264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,4891618797517162087,15088883161149711115,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6120 /prefetch:1
  2⤵
  PID:4044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,4891618797517162087,15088883161149711115,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5360 /prefetch:1
  2⤵
  PID:2504
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2216,4891618797517162087,15088883161149711115,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5548 /prefetch:8
  2⤵
  PID:3056
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
  2⤵
  - Drops file in Program Files directory
  PID:4488
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x24c,0x250,0x254,0x228,0x258,0x7ff71c495460,0x7ff71c495470,0x7ff71c495480
    3⤵
    PID:4252
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2216,4891618797517162087,15088883161149711115,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5548 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,4891618797517162087,15088883161149711115,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5752 /prefetch:1
  2⤵
  PID:820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,4891618797517162087,15088883161149711115,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6600 /prefetch:1
  2⤵
  PID:4012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,4891618797517162087,15088883161149711115,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4644 /prefetch:1
  2⤵
  PID:776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,4891618797517162087,15088883161149711115,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6248 /prefetch:1
  2⤵
  PID:1348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,4891618797517162087,15088883161149711115,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3716 /prefetch:1
  2⤵
  PID:5456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,4891618797517162087,15088883161149711115,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6952 /prefetch:1
  2⤵
  PID:5576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,4891618797517162087,15088883161149711115,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4876 /prefetch:1
  2⤵
  PID:5660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2216,4891618797517162087,15088883161149711115,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=7024 /prefetch:8
  2⤵
  PID:5784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,4891618797517162087,15088883161149711115,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7036 /prefetch:1
  2⤵
  PID:5792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2216,4891618797517162087,15088883161149711115,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6120 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2216,4891618797517162087,15088883161149711115,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7176 /prefetch:8
  2⤵
  PID:3444
- C:\Users\Admin\Downloads\AsyncClient.exe
  "C:\Users\Admin\Downloads\AsyncClient.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5328
- C:\Users\Admin\Downloads\AsyncClient.exe
  "C:\Users\Admin\Downloads\AsyncClient.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2216,4891618797517162087,15088883161149711115,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3100 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1628

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1800

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2596

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5576

C:\Users\Admin\Downloads\AsyncClient.exe
"C:\Users\Admin\Downloads\AsyncClient.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5996

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\AsyncClient.exe.log

Filesize
425B

MD5
8c7889bde41724ce3db7c67e730677f6

SHA1
485891cc9120cb2203a2483754dbd5e6ea24f28e

SHA256
83c70bfcb1b41892c9c50cabe9bc2d96b2f7420b28545afabd32f682ac62d0ad

SHA512
b7c3aab27fc924dcaef78987b492931e164b9e30b813c532fe87e1d40001ed1861c4b5ddbdd85cd2278681a22e32eee816877f4f63cecaa9972976d87e38f5cc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9d533e1f93a61b94eea29bf4313b0a8e

SHA1
96c1f0811d9e2fbf408e1b7186921b855fc891db

SHA256
ae95a7d192b6dfed1a8a5611850df994c63ba2038018901d59ef4dae64b74ed3

SHA512
b10de657d0cef4255e96daa1b6ad0c99c70b16c13b8e86790ea226e37e9ded1a8f8bed1e137f976d86ebc3ea9a4b5eb67ce2f5b0200025d35dc8e94c947ff3f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fccab8a2a3330ebd702a08d6cc6c1aee

SHA1
2d0ea7fa697cb1723d240ebf3c0781ce56273cf7

SHA256
fa39b46c6f11977f5a2e6f4cd495db424063320fbac26a2eae7466e82ffeb712

SHA512
5339b52bad5dff926b66044067aa3e1a6147c389a27ebd89b0f16e1267621d7ce7af9810010bee81cba7b08c77a33ede8ef4675fe049b9fb2ed510fcaef93d6e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index

Filesize
1KB

MD5
e613f4ac6a61cba33b3465e128762504

SHA1
b8c16a9ce20cba75e266252a4f74f710952fbf62

SHA256
a417d7db6f3f8f9c1cf01e3991897b6a8e92add41162b9b61efd0f00f5acf95f

SHA512
eb9a7312b1ccd81d79c70ead728b57d03d6cfab8103d7cd310074f3a6b2447686486a8113dae1aa28b8719549efd245bf3225369d36e7c0d64e3fd24f7f434be

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
48B

MD5
46753a922ae629379cbc2ef4354fa10f

SHA1
939af3de6e89c6b89bd8368a837bb37332c65192

SHA256
d8b344f888454ef31c651de74b0eda719c4500f739e16d4dc5bb5ec3850ba4e3

SHA512
c512a455a4b7bfa6f2d84d99e6436a0640f2104b6af14abc9721dd2ea13e4441ce585541ca4a54deeaa0348d0c55d738ffc0d0d293cfa0664983845e4bc7eeb4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
528B

MD5
44110b9cfb09da5ed098d946723b9ac0

SHA1
2ed19821ae4bc4aa4d8fe3f6af81c075e1f8ee71

SHA256
7da58286d1d183cf89e5a57cee389a38f5f2000ce52feb68dd6348994651c1d7

SHA512
08747790f441509acb4da8527b24b33d3c1e1aaf0873295f9328bd45e762213752ab547af1eb9f16c9a409831a6a7c2f8e74889e96605e0d0d5f678b4c7d8082

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
1a70cd8860f6f5d025a8a3f12040be69

SHA1
bd29c529a86b561d2ce55bbbb40a6a46adfacec2

SHA256
1e70130de245059ba4a1cfe9597249c2ee887e95fdbf173865681dccb9427e1b

SHA512
364214cdf72c08214f2d68ba80c6d318393d7d43a7f4270abd1fefdedc34a478e5f9fcbc4998336b47b316081b255c51706b8850394a519a5af346ee3cd82cd1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
14b8c3adfd5c0f5d970cf755ea9a4be4

SHA1
70a57260c863ec3f0707d0eea9b41e996a5f993a

SHA256
97d834397e045b9ce36c77b83bd57d431ede49d1af7c189c65fc8acb7dcaff79

SHA512
20b9e8c4df9e5e2138105f8b9e83b1a7114a19a051aa0cd5341d18df684132bed61ac3c57d34d0dae3494fb1f52fe4fef8e0eb5d74d60864efe01157b5630734

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
7e07e8491c0dde49fd307eb8b756e0b7

SHA1
bee67e6cde7f08bcd5ca10461d07c229a165493b

SHA256
ff17965263523b50554a1109f4635dcab73006993447f51398f9f81951446161

SHA512
c1b03e979e2d07ec12c2ed203ff87bda13088f7a9caa927469191477acca75ff2bba82d97ab3d4e0280484b0f8b9440bd2b7cd84c3e902fa9a5c4d900e0759d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a2092ef5e0785befcc1895812e340d4e

SHA1
0deb0f35ed670cd8c969469c5be480fd563dbd40

SHA256
5bfa7cc73d52e57eb47fe1d489c3f90ef614aa21900ca6af8a9bc7c6878b95f5

SHA512
9517cc2d0d332029fc57face4aa6512df22e5946ae14b5c61b457bc4ebeafcfef6444f74081bd9f518de487d32bdb97d8537d1e66ff374468292af5a477844a0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
ed659b1d7a51e558246bd24f62fff931

SHA1
84685d6f04379c290e4261ff04e9e1879d54d42c

SHA256
23fafd9073812d5ff8b523b84bc981e4cb410bebbf3675db2b29cfac0dae9690

SHA512
1c3203328583241895db9fb165fcfd595f642e218ee3a453ab6873cbac10ddab693cd2f913bab15c8bb7b5a12c5768b3dfcb278aad754dec1fbffe66b81843cc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
7ec09c7cbd7cb0b8a777b3a9e2a1892e

SHA1
3b07979e57b6c93be7d5a6cd8fa954dee91bd8dd

SHA256
a623633f34a241b0dbc9fd26f34446d716955f94e90b2ff9ac8b9df801bdae5e

SHA512
5fff0a38a3b6e4b29d402eef2650011e4d9df514e0624767c84ea31cb73cbba10c7e0b5711cb487976d637f0f60a85c431cf0db54b519411245684c116c07b7b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
e41efd6e75dd32ed5b938bd218b1703b

SHA1
f94a3c352a36bb7da4bd45e83232ba86f204b094

SHA256
dfc9087d846405e54b60c55992b58ad218a330ddb128d8afbc67d97a5f272c72

SHA512
7cd9474ed8592692d6ef40f5045a8a5d9a43ea93c32753e0c5c1137598cf03029c0899c0eb62c4b790bf008a67d1e749fb44311023c7486c406a3684b560f6e4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe584e1b.TMP

Filesize
1KB

MD5
2b9a421da5080e5af87280cb8a302cb9

SHA1
c909d198b4833b2e4f4415268fbcda3f4e8f2bad

SHA256
efe9b0477cc15e803f2016edf811ef602cbbd0bbb45f8cba098021593eac01d5

SHA512
3dd0333998e50cf040b95fc1cf26197e660e16e04ec8689101ee412c149eba87d5f085f79e52ef8d3d6717b575662f4ad3ae074c5b8224a2907f684195f19997

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
9bae7aa74198a55915a017fb00d945c2

SHA1
60f146f9745032ed02bfe02b24a418d2c5863011

SHA256
d05496020477ffb68f7a0cdda80336333920c89dd9bd98338ef5900e65ca31d4

SHA512
9d27c8cdd5566f9e5edfa3d68e9b912c81f63423cc2e3a76c59b32ba492aa13dd4cfc3b92e51d3c5332f1fc6947cab6b4df009768e7d31dabaecc7114712fdd8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
ee2e8764d9a09c4783a9b869c3f54211

SHA1
92968e444716be9a35665364bc15fb99253be5f1

SHA256
ed5dcacffbdf0eeff48e4a2879f2063cfff297371e8d996f4cc9d73e2fece188

SHA512
b8abac1bc26eb8620ecf3538eb064c4568b46e9ee295394286fc787ef28d980947614b0748848cbd2b982c31fe039db07d81a9d2af46bf4223844f68738949dd

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
786edff47aefae49eeec71af461ece28

SHA1
445c7b975eb3eb19ebbb9c941e8e7b6dce967242

SHA256
b34c6035389265ba8dc4f05535eefcac0d4cf0785de8e37d544f7cc138f2abd4

SHA512
aa20c46c48f035c714e08ae213b4def58639dd120522afeae6acf01141f5498e6084252850ebd48da4097fd2b44864419ba72888470fbeb12b9a20faefe7af2f

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms~RFe57b5f2.TMP

Filesize
3KB

MD5
05568d6e20e09cb2d78c15d395b80b61

SHA1
24346b64cc650b3e7115b8ca9e5ea00b1849e708

SHA256
cc87118df803a016ddd39ce2e923db18ab298f0eb1a960884138b37dd2768bbd

SHA512
7faf22390e3788072b2392feefe08bdbaabe48dea3299358ba408d24701ac0ced7f144b32e749e231fca0b576aefb46ee1f5db5ef5231bd8a13338bb7ebab126

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 123895.crdownload

Filesize
45KB

MD5
8da418f20ad17d1b2a8d9e431629cd6c

SHA1
44abd1a6047b73506d6c20de0bfa7f35d1e818ba

SHA256
4f965f3dc5e1a0027fdc9fd355435f2124d5fd034e72e85a1420463fe5757392

SHA512
001fa2d629c2f0e06ed84a74d0e9d3c32b533de6fb5abd988ddac54f20400c69ce63bea25c0bb2fe33ca47e377deb2e8899fe7fcd8c5ca2b1b2f3238a9e865e7

Download Submit
\??\pipe\LOCAL\crashpad_3788_MREVPWFTLJZYTWMT

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/5328-393-0x00000000001D0000-0x00000000001E2000-memory.dmp

Filesize
72KB

Download