asyncrat | 3193f135e199228a2d3b3a61e04ff5d82bf8669b1b3380b22f537ed7c7e06261

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
26-11-2024 04:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

rizz.exe
Size

72KB
MD5

b34928c5afd20368c2810613c4a550d2
SHA1

ac281837cacfc3409e7a41b7230989c3774ba4e2
SHA256

3193f135e199228a2d3b3a61e04ff5d82bf8669b1b3380b22f537ed7c7e06261
SHA512

a2661d23e15737fb1e069329f9527dcdc71b2332fc4dd2edd4910c4bccc474702e0c964a92ba4687b62dba37bf1da0935b8bd49374fdd0ceea7e6b1836647d10
SSDEEP

1536:ACyyQm2As0GWzbzXvMgYM51yVKNY9sUIdshOCOwX0ttdk61E8Ygiyw:ACyyZVGobzAAy0NFdsh/OXtdkqBS

Score

10^/10

asyncrat default defense_evasion discovery execution rat

Malware Config

Extracted

Family

asyncrat

Botnet

Default

comment-mar.gl.at.ply.gg:7052

Attributes

delay
1
install
true
install_file
regedit.exe
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Asyncrat family
asyncrat

Async RAT payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral1/files/0x00090000000162e4-13.dat	family_asyncrat

Executes dropped EXE 2 IoCs

Processes:

MulitiTool.exeregedit.exe

pid	Process
2352	MulitiTool.exe
2292	regedit.exe

Loads dropped DLL 1 IoCs

Processes:

rizz.exe

pid	Process
2148	rizz.exe

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

Processes:

powershell.exe

pid	Process
2304	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

powershell.exechcp.comrizz.exepowershell.execmd.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rizz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Delays execution with timeout.exe 1 IoCs

evasion

Processes:

timeout.exe

pid	Process
2660	timeout.exe

Runs regedit.exe 1 IoCs

Processes:

regedit.exe

pid	Process
2292	regedit.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

Processes:

schtasks.exe

pid	Process
2672	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

powershell.exepowershell.exeMulitiTool.exeregedit.exe

pid	Process
2304	powershell.exe
2060	powershell.exe
2352	MulitiTool.exe
2352	MulitiTool.exe
2352	MulitiTool.exe
2352	MulitiTool.exe
2352	MulitiTool.exe
2292	regedit.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

powershell.exepowershell.exeMulitiTool.exeregedit.exe

description	pid	Process
Token: SeDebugPrivilege	2304	powershell.exe
Token: SeDebugPrivilege	2060	powershell.exe
Token: SeDebugPrivilege	2352	MulitiTool.exe
Token: SeDebugPrivilege	2292	regedit.exe

Suspicious use of WriteProcessMemory 35 IoCs

Processes:

rizz.execmd.exeMulitiTool.execmd.execmd.exe

description	pid	Process	procid_target
PID 2148 wrote to memory of 2060	2148	rizz.exe	30
PID 2148 wrote to memory of 2060	2148	rizz.exe	30
PID 2148 wrote to memory of 2060	2148	rizz.exe	30
PID 2148 wrote to memory of 2060	2148	rizz.exe	30
PID 2148 wrote to memory of 2012	2148	rizz.exe	32
PID 2148 wrote to memory of 2012	2148	rizz.exe	32
PID 2148 wrote to memory of 2012	2148	rizz.exe	32
PID 2148 wrote to memory of 2012	2148	rizz.exe	32
PID 2148 wrote to memory of 2352	2148	rizz.exe	33
PID 2148 wrote to memory of 2352	2148	rizz.exe	33
PID 2148 wrote to memory of 2352	2148	rizz.exe	33
PID 2148 wrote to memory of 2352	2148	rizz.exe	33
PID 2012 wrote to memory of 2304	2012	cmd.exe	35
PID 2012 wrote to memory of 2304	2012	cmd.exe	35
PID 2012 wrote to memory of 2304	2012	cmd.exe	35
PID 2012 wrote to memory of 2304	2012	cmd.exe	35
PID 2352 wrote to memory of 2952	2352	MulitiTool.exe	36
PID 2352 wrote to memory of 2952	2352	MulitiTool.exe	36
PID 2352 wrote to memory of 2952	2352	MulitiTool.exe	36
PID 2352 wrote to memory of 1724	2352	MulitiTool.exe	38
PID 2352 wrote to memory of 1724	2352	MulitiTool.exe	38
PID 2352 wrote to memory of 1724	2352	MulitiTool.exe	38
PID 1724 wrote to memory of 2660	1724	cmd.exe	40
PID 1724 wrote to memory of 2660	1724	cmd.exe	40
PID 1724 wrote to memory of 2660	1724	cmd.exe	40
PID 2952 wrote to memory of 2672	2952	cmd.exe	41
PID 2952 wrote to memory of 2672	2952	cmd.exe	41
PID 2952 wrote to memory of 2672	2952	cmd.exe	41
PID 1724 wrote to memory of 2292	1724	cmd.exe	42
PID 1724 wrote to memory of 2292	1724	cmd.exe	42
PID 1724 wrote to memory of 2292	1724	cmd.exe	42
PID 2012 wrote to memory of 1800	2012	cmd.exe	44
PID 2012 wrote to memory of 1800	2012	cmd.exe	44
PID 2012 wrote to memory of 1800	2012	cmd.exe	44
PID 2012 wrote to memory of 1800	2012	cmd.exe	44

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\rizz.exe
"C:\Users\Admin\AppData\Local\Temp\rizz.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2148
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGUAcwB2ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAG4AbABsACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGUAagBnACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGIAegB0ACMAPgA="
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2060
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\Better penguin tool___.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2012
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    POWERSHELL.EXE -Command "Add-Type -AssemblyName System.Windows.Forms; [void][System.Windows.Forms.MessageBox]::show( 'You in my yippe u got this for free!', 'Welcome', 'OK', 'Warning' )"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2304
- - C:\Windows\SysWOW64\chcp.com
    chcp 65001
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1800
- C:\Users\Admin\AppData\Local\Temp\MulitiTool.exe
  "C:\Users\Admin\AppData\Local\Temp\MulitiTool.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2352
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "regedit" /tr '"C:\Users\Admin\AppData\Roaming\regedit.exe"' & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2952
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc onlogon /rl highest /tn "regedit" /tr '"C:\Users\Admin\AppData\Roaming\regedit.exe"'
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2672
- - C:\Windows\system32\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpBBFF.tmp.bat""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1724
  - - C:\Windows\system32\timeout.exe
      timeout 3
      4⤵
      Delays execution with timeout.exe
      PID:2660
  - - C:\Users\Admin\AppData\Roaming\regedit.exe
      "C:\Users\Admin\AppData\Roaming\regedit.exe"
      4⤵
      Executes dropped EXE
      Runs regedit.exe
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2292

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Better penguin tool___.bat

Filesize
3KB

MD5
f251a25604847cf77ef2409d23dc94be

SHA1
21c2d6af971aeea1afb8e12c9f5160a1b8d8123f

SHA256
89941ae9dd965d7e526eb452237211afbb74ed5d6448cf96a84fb050893a7c83

SHA512
d1be6c9150427f439b1e8fb986b1683c464063af95b560438f263fe6309d2b5bef00920c6eb976251b295c3add0a19f8eecea2446df05246dd66c420ffa47c6f

Download Submit
C:\Users\Admin\AppData\Local\Temp\MulitiTool.exe

Filesize
63KB

MD5
867d3df9508a810a4b6498db145508ce

SHA1
f7321cd91e4de91b7da39d5a2d25f126a77f6eb0

SHA256
bab521830c4069c60079884232777609ad392d385f323981eefb2c949a55d41b

SHA512
06e039153a01549534b62efb8e9a4d0bc57bc22b050a9822edf5cf42d2c77400657f73fd4ea4a9632e0cbb62d638e9983adaecd180d9d9835093c2874ad51712

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpBBFF.tmp.bat

Filesize
151B

MD5
7f4d5fe3360d8363b558061d822f31c2

SHA1
0dc1c7c1fa3b9be9ae813dc7217b62c6e93d35b6

SHA256
7e4867483d66d4bb8309c80f8169a8e82cda5459c622030d33322729861e7f7a

SHA512
9e866ec1330b0fcddebb59d6599517ae937851ce0bc82d48493ab106296723598e1951f4eca03526f9e7edc9c06c3eb7be78dd1351cc627f58dbd3ad93da1f4e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
4ccb7ab99e316ecb6673b296dca428d6

SHA1
4234bc22f7c807edae69813b263f7448bbe573dd

SHA256
9d160eff240ff889a41752db71c84fcc7fc11ef6fe2e147f39f4b1e98e3ef6a3

SHA512
0148434a38d7a8a6c468022ae89ae1fa9f2e398a6c044a52ca13e4abaaf7cf5d13afbd1d3851604b6b2e273101135049b4e40c5f828c9a40f107f65bc2b7df69

Download Submit
memory/2292-35-0x0000000001310000-0x0000000001326000-memory.dmp

Filesize
88KB

Download
memory/2352-22-0x0000000000380000-0x0000000000396000-memory.dmp

Filesize
88KB

Download