asyncrat | 18ed10ae7b3ed84595be2e012aa64544ba5751eca4edfa310d7de939f75e822f

Analysis

max time kernel
14s
max time network
16s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
02/12/2024, 18:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SolaraB2.exe
Size

48KB
MD5

71fe70139bb3fc78601c7c3da0df9cb2
SHA1

ed8a1fb5abd05d948d9adb4a8257788b768e3d38
SHA256

18ed10ae7b3ed84595be2e012aa64544ba5751eca4edfa310d7de939f75e822f
SHA512

173a90f29874165342764835bd25d3c10dd27f615015104367897a9a50ce4a5ddc9880e6468df7ccedcf6cf2d3f6a9c26d492b5a5dade8c8b0e9795b82c53f30
SSDEEP

768:euir1TUEFSuWUoV3kmo2qzHl7VZcJIPIKamfZ0bn9bmIA5WS9bdXm2BDZzN:euir1TUKP28cJtKa6ebnQbWmb9mYdzN

Score

10^/10

asyncrat default discovery rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

127.0.0.1:6606

127.0.0.1:7707

127.0.0.1:8808

Mutex

R3dAGQsLxm1j

Attributes

delay
3
install
true
install_file
solara.exe
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Asyncrat family
asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral2/files/0x0008000000023c94-18.dat	family_asyncrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	SolaraB2.exe

Executes dropped EXE 1 IoCs

pid	Process
1196	solara.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SolaraB2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	solara.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
4104	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1532	schtasks.exe

Suspicious behavior: EnumeratesProcesses 27 IoCs

pid	Process
4864	SolaraB2.exe
4864	SolaraB2.exe
4864	SolaraB2.exe
4864	SolaraB2.exe
4864	SolaraB2.exe
4864	SolaraB2.exe
4864	SolaraB2.exe
4864	SolaraB2.exe
4864	SolaraB2.exe
4864	SolaraB2.exe
4864	SolaraB2.exe
4864	SolaraB2.exe
4864	SolaraB2.exe
4864	SolaraB2.exe
4864	SolaraB2.exe
4864	SolaraB2.exe
4864	SolaraB2.exe
4864	SolaraB2.exe
4864	SolaraB2.exe
4864	SolaraB2.exe
4864	SolaraB2.exe
4864	SolaraB2.exe
4864	SolaraB2.exe
896	msedge.exe
896	msedge.exe
4400	msedge.exe
4400	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
4400	msedge.exe
4400	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4864	SolaraB2.exe
Token: SeDebugPrivilege	1196	solara.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4864 wrote to memory of 1948	4864	SolaraB2.exe	89
PID 4864 wrote to memory of 1948	4864	SolaraB2.exe	89
PID 4864 wrote to memory of 1948	4864	SolaraB2.exe	89
PID 4864 wrote to memory of 1564	4864	SolaraB2.exe	91
PID 4864 wrote to memory of 1564	4864	SolaraB2.exe	91
PID 4864 wrote to memory of 1564	4864	SolaraB2.exe	91
PID 1948 wrote to memory of 1532	1948	cmd.exe	93
PID 1948 wrote to memory of 1532	1948	cmd.exe	93
PID 1948 wrote to memory of 1532	1948	cmd.exe	93
PID 1564 wrote to memory of 4104	1564	cmd.exe	94
PID 1564 wrote to memory of 4104	1564	cmd.exe	94
PID 1564 wrote to memory of 4104	1564	cmd.exe	94
PID 4400 wrote to memory of 4904	4400	msedge.exe	98
PID 4400 wrote to memory of 4904	4400	msedge.exe	98
PID 1564 wrote to memory of 1196	1564	cmd.exe	99
PID 1564 wrote to memory of 1196	1564	cmd.exe	99
PID 1564 wrote to memory of 1196	1564	cmd.exe	99
PID 4400 wrote to memory of 3676	4400	msedge.exe	100
PID 4400 wrote to memory of 3676	4400	msedge.exe	100
PID 4400 wrote to memory of 3676	4400	msedge.exe	100
PID 4400 wrote to memory of 3676	4400	msedge.exe	100
PID 4400 wrote to memory of 3676	4400	msedge.exe	100
PID 4400 wrote to memory of 3676	4400	msedge.exe	100
PID 4400 wrote to memory of 3676	4400	msedge.exe	100
PID 4400 wrote to memory of 3676	4400	msedge.exe	100
PID 4400 wrote to memory of 3676	4400	msedge.exe	100
PID 4400 wrote to memory of 3676	4400	msedge.exe	100
PID 4400 wrote to memory of 3676	4400	msedge.exe	100
PID 4400 wrote to memory of 3676	4400	msedge.exe	100
PID 4400 wrote to memory of 3676	4400	msedge.exe	100
PID 4400 wrote to memory of 3676	4400	msedge.exe	100
PID 4400 wrote to memory of 3676	4400	msedge.exe	100
PID 4400 wrote to memory of 3676	4400	msedge.exe	100
PID 4400 wrote to memory of 3676	4400	msedge.exe	100
PID 4400 wrote to memory of 3676	4400	msedge.exe	100
PID 4400 wrote to memory of 3676	4400	msedge.exe	100
PID 4400 wrote to memory of 3676	4400	msedge.exe	100
PID 4400 wrote to memory of 3676	4400	msedge.exe	100
PID 4400 wrote to memory of 3676	4400	msedge.exe	100
PID 4400 wrote to memory of 3676	4400	msedge.exe	100
PID 4400 wrote to memory of 3676	4400	msedge.exe	100
PID 4400 wrote to memory of 3676	4400	msedge.exe	100
PID 4400 wrote to memory of 3676	4400	msedge.exe	100
PID 4400 wrote to memory of 3676	4400	msedge.exe	100
PID 4400 wrote to memory of 3676	4400	msedge.exe	100
PID 4400 wrote to memory of 3676	4400	msedge.exe	100
PID 4400 wrote to memory of 3676	4400	msedge.exe	100
PID 4400 wrote to memory of 3676	4400	msedge.exe	100
PID 4400 wrote to memory of 3676	4400	msedge.exe	100
PID 4400 wrote to memory of 3676	4400	msedge.exe	100
PID 4400 wrote to memory of 3676	4400	msedge.exe	100
PID 4400 wrote to memory of 3676	4400	msedge.exe	100
PID 4400 wrote to memory of 3676	4400	msedge.exe	100
PID 4400 wrote to memory of 3676	4400	msedge.exe	100
PID 4400 wrote to memory of 3676	4400	msedge.exe	100
PID 4400 wrote to memory of 3676	4400	msedge.exe	100
PID 4400 wrote to memory of 3676	4400	msedge.exe	100
PID 4400 wrote to memory of 896	4400	msedge.exe	101
PID 4400 wrote to memory of 896	4400	msedge.exe	101
PID 4400 wrote to memory of 3284	4400	msedge.exe	102
PID 4400 wrote to memory of 3284	4400	msedge.exe	102
PID 4400 wrote to memory of 3284	4400	msedge.exe	102
PID 4400 wrote to memory of 3284	4400	msedge.exe	102
PID 4400 wrote to memory of 3284	4400	msedge.exe	102

C:\Users\Admin\AppData\Local\Temp\SolaraB2.exe
"C:\Users\Admin\AppData\Local\Temp\SolaraB2.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4864
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "solara" /tr '"C:\Users\Admin\AppData\Roaming\solara.exe"' & exit
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1948
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /f /sc onlogon /rl highest /tn "solara" /tr '"C:\Users\Admin\AppData\Roaming\solara.exe"'
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1532
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpC294.tmp.bat""
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1564
- - C:\Windows\SysWOW64\timeout.exe
    timeout 3
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:4104
- - C:\Users\Admin\AppData\Roaming\solara.exe
    "C:\Users\Admin\AppData\Roaming\solara.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1196

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffa9b3846f8,0x7ffa9b384708,0x7ffa9b384718
  2⤵
  PID:4904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,16515426771358589686,553650005351740051,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
  2⤵
  PID:3676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,16515426771358589686,553650005351740051,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2240 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,16515426771358589686,553650005351740051,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2936 /prefetch:8
  2⤵
  PID:3284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,16515426771358589686,553650005351740051,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:2576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,16515426771358589686,553650005351740051,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:4384

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1940

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4364

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
34d2c4f40f47672ecdf6f66fea242f4a

SHA1
4bcad62542aeb44cae38a907d8b5a8604115ada2

SHA256
b214e3affb02a2ea4469a8bbdfa8a179e7cc57cababd83b4bafae9cdbe23fa33

SHA512
50fba54ec95d694211a005d0e3e6cf5b5677efa16989cbf854207a1a67e3a139f32b757c6f2ce824a48f621440b93fde60ad1dc790fcec4b76edddd0d92a75d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8749e21d9d0a17dac32d5aa2027f7a75

SHA1
a5d555f8b035c7938a4a864e89218c0402ab7cde

SHA256
915193bd331ee9ea7c750398a37fbb552b8c5a1d90edec6293688296bda6f304

SHA512
c645a41180ed01e854f197868283f9b40620dbbc813a1c122f6870db574ebc1c4917da4d320bdfd1cc67f23303a2c6d74e4f36dd9d3ffcfa92d3dfca3b7ca31a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
3196e969a76fab29171efe859e8ac50b

SHA1
0065cb84fce09b8834e974abf63f7e07cb77a045

SHA256
6905d656dd79d0985b86c079e86da1c8c4f6d77b8a0dc85ac931b3c5eb2a836d

SHA512
f37fc9f11a3f99740fe287c368b36d7fc0bcbdbbc080825571a1cc45ffced64eadaecb2265385a87f427203991621afbb4bd782fdb4d0805bf77ad1d1bdc0862

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
50eed378f0b6efd7bfa1b95745cf9fe2

SHA1
997a2a8e680854688d9db22c86abe182d5dca3e3

SHA256
e4d803ef89fcc5fcb4dd979b88ce431bac34954b13dbf41c2240f607c80919fd

SHA512
837a2b0b289444a8ed07242f4735d34e17f3e2948606fbf334622df200b621152d43249e9946a6f1c5857ed8cedbbd96823d54c7b17ebcf17b0c7a2106e1e2bf

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpC294.tmp.bat

Filesize
150B

MD5
a2711c835d1fd2e289a615b06a1159ad

SHA1
be005a4ffea44b744b400b60f5f4458b44272098

SHA256
468629649f658cbbcf0a16b8055ffbf394a4bf0942fcf36849ef4fa414418435

SHA512
412177f51eb625703947bce703f1fc6228f6150dcb757ece1d116d630cedfec1284ed900f23827e5596647df3821794bd58ff2bf82fc17e80bf1674add919547

Download Submit
C:\Users\Admin\AppData\Roaming\solara.exe

Filesize
48KB

MD5
71fe70139bb3fc78601c7c3da0df9cb2

SHA1
ed8a1fb5abd05d948d9adb4a8257788b768e3d38

SHA256
18ed10ae7b3ed84595be2e012aa64544ba5751eca4edfa310d7de939f75e822f

SHA512
173a90f29874165342764835bd25d3c10dd27f615015104367897a9a50ce4a5ddc9880e6468df7ccedcf6cf2d3f6a9c26d492b5a5dade8c8b0e9795b82c53f30

Download Submit
memory/1196-26-0x0000000074910000-0x00000000750C0000-memory.dmp

Filesize
7.7MB

Download
memory/4864-9-0x00000000749C0000-0x0000000075170000-memory.dmp

Filesize
7.7MB

Download
memory/4864-4-0x0000000004EE0000-0x0000000004F7C000-memory.dmp

Filesize
624KB

Download
memory/4864-0-0x00000000749CE000-0x00000000749CF000-memory.dmp

Filesize
4KB

Download
memory/4864-3-0x0000000004A30000-0x0000000004A96000-memory.dmp

Filesize
408KB

Download
memory/4864-2-0x00000000749C0000-0x0000000075170000-memory.dmp

Filesize
7.7MB

Download
memory/4864-1-0x0000000000060000-0x0000000000072000-memory.dmp

Filesize
72KB

Download