Analysis
-
max time kernel
68s -
max time network
80s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
25-11-2024 03:13
Behavioral task
behavioral1
Sample
AsyncClient (1).exe
Resource
win10v2004-20241007-en
windows10-2004-x64
18 signatures
150 seconds
General
-
Target
AsyncClient (1).exe
-
Size
47KB
-
MD5
f65631d6798eaa350884e4f996f7f6a9
-
SHA1
a913ae3757728dc296bc1076147eb840e887d8fc
-
SHA256
e0f9ca55f06233cd4e2a7e4cf77fb678a9cff34b548c85ea7c2cdf7ede07270c
-
SHA512
e0c73a639c5236a9cb1800732c736c3a3071e50660495517e43b55b815eb99d0faf74f04e3de79e9fa112b6a09721d178f3b3929585fbfdb5bee2cda95b6bd0e
-
SSDEEP
768:xuyxNTAoZjRWUJd9bmo2qL5+Cr96UGMRPIom7e7PesJ0bFm3sJsynjSY1zeBDZMx:xuyxNTAGL2xuCMOom7ebRubFm3kZlMdO
Score
10/10
Malware Config
Extracted
Family
asyncrat
Version
0.5.8
Botnet
Default
C2
between-reprint.gl.at.ply.gg:5942
Mutex
CKnrCmvLB4KG
Attributes
-
delay
3
-
install
true
-
install_file
Windows.exe
-
install_folder
%AppData%
aes.plain
Signatures
-
Asyncrat family
-
Async RAT payload 1 IoCs
Processes:
resource yara_rule behavioral1/files/0x000a000000023b9e-25.dat family_asyncrat -
Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
Processes:
explorer.exedescription ioc Process Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
AsyncClient (1).exedescription ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation AsyncClient (1).exe -
Executes dropped EXE 1 IoCs
Processes:
Windows.exepid Process 540 Windows.exe -
Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
explorer.exedescription ioc Process File opened (read-only) \??\F: explorer.exe File opened (read-only) \??\D: explorer.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
cmd.exetimeout.exeschtasks.exeWindows.exeAsyncClient (1).execmd.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Windows.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AsyncClient (1).exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
taskmgr.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid Process 2108 timeout.exe -
Modifies registry class 10 IoCs
Processes:
explorer.exedescription ioc Process Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\ApplicationFrame\Microsoft.Windows.PeopleExperienceHos = 6801000088020000 explorer.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3442511616-637977696-3186306149-1000\{6BC21946-DFF2-4247-8CE9-51FDE6D47DB2} explorer.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
AsyncClient (1).exetaskmgr.exepid Process 4984 AsyncClient (1).exe 4984 AsyncClient (1).exe 4984 AsyncClient (1).exe 4984 AsyncClient (1).exe 4984 AsyncClient (1).exe 4984 AsyncClient (1).exe 4984 AsyncClient (1).exe 4984 AsyncClient (1).exe 4984 AsyncClient (1).exe 4984 AsyncClient (1).exe 4984 AsyncClient (1).exe 4984 AsyncClient (1).exe 4984 AsyncClient (1).exe 4984 AsyncClient (1).exe 4984 AsyncClient (1).exe 4984 AsyncClient (1).exe 4984 AsyncClient (1).exe 4984 AsyncClient (1).exe 4984 AsyncClient (1).exe 4984 AsyncClient (1).exe 4984 AsyncClient (1).exe 4984 AsyncClient (1).exe 4984 AsyncClient (1).exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 16 IoCs
Processes:
AsyncClient (1).exetaskmgr.exeWindows.exeexplorer.exedescription pid Process Token: SeDebugPrivilege 4984 AsyncClient (1).exe Token: SeDebugPrivilege 4828 taskmgr.exe Token: SeSystemProfilePrivilege 4828 taskmgr.exe Token: SeCreateGlobalPrivilege 4828 taskmgr.exe Token: SeDebugPrivilege 540 Windows.exe Token: SeDebugPrivilege 540 Windows.exe Token: SeShutdownPrivilege 2484 explorer.exe Token: SeCreatePagefilePrivilege 2484 explorer.exe Token: SeShutdownPrivilege 2484 explorer.exe Token: SeCreatePagefilePrivilege 2484 explorer.exe Token: SeShutdownPrivilege 2484 explorer.exe Token: SeCreatePagefilePrivilege 2484 explorer.exe Token: SeShutdownPrivilege 2484 explorer.exe Token: SeCreatePagefilePrivilege 2484 explorer.exe Token: SeShutdownPrivilege 2484 explorer.exe Token: SeCreatePagefilePrivilege 2484 explorer.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
taskmgr.exepid Process 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
Processes:
taskmgr.exepid Process 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
AsyncClient (1).execmd.execmd.exedescription pid Process procid_target PID 4984 wrote to memory of 4704 4984 AsyncClient (1).exe 86 PID 4984 wrote to memory of 4704 4984 AsyncClient (1).exe 86 PID 4984 wrote to memory of 4704 4984 AsyncClient (1).exe 86 PID 4984 wrote to memory of 1208 4984 AsyncClient (1).exe 88 PID 4984 wrote to memory of 1208 4984 AsyncClient (1).exe 88 PID 4984 wrote to memory of 1208 4984 AsyncClient (1).exe 88 PID 1208 wrote to memory of 2108 1208 cmd.exe 90 PID 1208 wrote to memory of 2108 1208 cmd.exe 90 PID 1208 wrote to memory of 2108 1208 cmd.exe 90 PID 4704 wrote to memory of 4368 4704 cmd.exe 91 PID 4704 wrote to memory of 4368 4704 cmd.exe 91 PID 4704 wrote to memory of 4368 4704 cmd.exe 91 PID 1208 wrote to memory of 540 1208 cmd.exe 94 PID 1208 wrote to memory of 540 1208 cmd.exe 94 PID 1208 wrote to memory of 540 1208 cmd.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\AsyncClient (1).exe"C:\Users\Admin\AppData\Local\Temp\AsyncClient (1).exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4984 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Windows" /tr '"C:\Users\Admin\AppData\Roaming\Windows.exe"' & exit2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4704 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "Windows" /tr '"C:\Users\Admin\AppData\Roaming\Windows.exe"'3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:4368
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp395D.tmp.bat""2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1208 -
C:\Windows\SysWOW64\timeout.exetimeout 33⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:2108
-
-
C:\Users\Admin\AppData\Roaming\Windows.exe"C:\Users\Admin\AppData\Roaming\Windows.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:540
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4828
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:2484
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:1340
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:1580
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:4416
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:1060
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:1180
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:2208
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:3860
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:4172
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:3612
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Active Setup
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Active Setup
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04
Filesize471B
MD599ba6b7f0f3ec8d66a8b6a80669c7b3d
SHA133ad0940219903cb4f9cf461b4f4bb711b9919f3
SHA256d3b813690dfc256c53b3af9fc4015f5aa3344abb4416ce0d79bc2ce6603d299b
SHA512eb9f31ef0c68f76f91ab1b0fe9d6c04237fa5dc1889d9ee31ae4186588d5da3903ccee6f8c25a9fd5c870364594798d3d5bcf462bef46cb301ae3acf29d4044c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04
Filesize412B
MD592ff4dd76890ee2b321f59bf2a3331fb
SHA18776d36e6f6f685f650f291a742d684090dc795c
SHA256f28431be94147c57367e0689d399352f4c1265ce63503054d549a7aa4eb66230
SHA5124c84248ea43f2e040173735edbf8f83894268bd15b49dc10f6bacc5810ec2ba0dd273f8c6819a6f00649d50744252dabce52afdd00268fa4b3983d8f7328ece4
-
Filesize
151B
MD52e3407a9905d00d93562843c8d557d3e
SHA105fdffcbff642d0c343d4005b377fcafe7c4b22f
SHA256dab8782afbd055e7ca6205df29f70d0ba5eaa658323a0923bd1b7c780b685278
SHA512d84d56b094e7f58a78bbc6e42647bd6a0a5866dc8e54ea8bbe31a40a3fa86515e0bd588782c268e9ad1d7a5f655697fac9f5ab9e34f0148563d5d1801f36cbc3
-
Filesize
47KB
MD5f65631d6798eaa350884e4f996f7f6a9
SHA1a913ae3757728dc296bc1076147eb840e887d8fc
SHA256e0f9ca55f06233cd4e2a7e4cf77fb678a9cff34b548c85ea7c2cdf7ede07270c
SHA512e0c73a639c5236a9cb1800732c736c3a3071e50660495517e43b55b815eb99d0faf74f04e3de79e9fa112b6a09721d178f3b3929585fbfdb5bee2cda95b6bd0e