Analysis
-
max time kernel
93s -
max time network
133s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
14-12-2024 14:00
Behavioral task
behavioral1
Sample
AsyncClient.exe
Resource
win7-20240903-en
windows7-x64
12 signatures
150 seconds
General
-
Target
AsyncClient.exe
-
Size
47KB
-
MD5
f826bed80bd47afaae707ca60525087d
-
SHA1
cfc70fd56b4114cf146406a4ebbbfba25e5e97f0
-
SHA256
a58f4b7cff7b27cd1565c85f638071671cfe7fe40a162a365ad18512488dfb4d
-
SHA512
aa0ab0511fce8f520b7a501c15b673638cdaa1bd2d1e9e36e5c5b66d44fce62a67a02465c74edfdec88b2fd1727d1ed78c3200d410a88e9f75698028de848b01
-
SSDEEP
768:tuTAlTP3IwK2WUwv2Mmo2qBIWRoXXPILBO1d+iv0bI/1s+I06boqtmsvwO9lBDZZ:tuTAlTPrg2AoALkMbI/1OrMqtZDdvx
Malware Config
Extracted
Family
asyncrat
Version
0.5.8
Botnet
Default
C2
127.0.0.1:6606
127.0.0.1:7707
127.0.0.1:8808
Mutex
A5dbA4ZoyZMW
Attributes
-
delay
3
-
install
true
-
install_file
helloo.exe
-
install_folder
%AppData%
aes.plain
Signatures
-
Asyncrat family
-
Async RAT payload 1 IoCs
resource yara_rule behavioral2/files/0x000a000000023b8f-11.dat family_asyncrat -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation AsyncClient.exe -
Executes dropped EXE 1 IoCs
pid Process 1456 helloo.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language helloo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AsyncClient.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 3600 timeout.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings taskmgr.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3760 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3888 AsyncClient.exe 3888 AsyncClient.exe 3888 AsyncClient.exe 3888 AsyncClient.exe 3888 AsyncClient.exe 3888 AsyncClient.exe 3888 AsyncClient.exe 3888 AsyncClient.exe 3888 AsyncClient.exe 3888 AsyncClient.exe 3888 AsyncClient.exe 3888 AsyncClient.exe 3888 AsyncClient.exe 3888 AsyncClient.exe 3888 AsyncClient.exe 3888 AsyncClient.exe 3888 AsyncClient.exe 3888 AsyncClient.exe 3888 AsyncClient.exe 3888 AsyncClient.exe 3888 AsyncClient.exe 3888 AsyncClient.exe 3888 AsyncClient.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 640 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 3888 AsyncClient.exe Token: SeDebugPrivilege 640 taskmgr.exe Token: SeSystemProfilePrivilege 640 taskmgr.exe Token: SeCreateGlobalPrivilege 640 taskmgr.exe Token: SeDebugPrivilege 1456 helloo.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 3888 wrote to memory of 432 3888 AsyncClient.exe 83 PID 3888 wrote to memory of 432 3888 AsyncClient.exe 83 PID 3888 wrote to memory of 432 3888 AsyncClient.exe 83 PID 3888 wrote to memory of 592 3888 AsyncClient.exe 85 PID 3888 wrote to memory of 592 3888 AsyncClient.exe 85 PID 3888 wrote to memory of 592 3888 AsyncClient.exe 85 PID 592 wrote to memory of 3600 592 cmd.exe 87 PID 592 wrote to memory of 3600 592 cmd.exe 87 PID 592 wrote to memory of 3600 592 cmd.exe 87 PID 432 wrote to memory of 3760 432 cmd.exe 88 PID 432 wrote to memory of 3760 432 cmd.exe 88 PID 432 wrote to memory of 3760 432 cmd.exe 88 PID 592 wrote to memory of 1456 592 cmd.exe 90 PID 592 wrote to memory of 1456 592 cmd.exe 90 PID 592 wrote to memory of 1456 592 cmd.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\AsyncClient.exe"C:\Users\Admin\AppData\Local\Temp\AsyncClient.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3888 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "helloo" /tr '"C:\Users\Admin\AppData\Roaming\helloo.exe"' & exit2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:432 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "helloo" /tr '"C:\Users\Admin\AppData\Roaming\helloo.exe"'3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:3760
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp8B77.tmp.bat""2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:592 -
C:\Windows\SysWOW64\timeout.exetimeout 33⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:3600
-
-
C:\Users\Admin\AppData\Roaming\helloo.exe"C:\Users\Admin\AppData\Roaming\helloo.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1456
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:640
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:1496
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
150B
MD550b042d39e95f3fecb8a879d0feb0e20
SHA1a8abdcc477b55516edfb74935a3356dcb8b58697
SHA256218065c087f6bad09e4e4efe6ebab8690899fba87be9776a787ec9e27e8d8268
SHA5126e122cb73c82652af783dabc4dce30e28ccd3640077a47a33b4216e468fd55f7a080cdbd9cebcdffbfda3dbf60b23abd943b0ebec77fddb2115f7ac6c1c2f019
-
Filesize
47KB
MD5f826bed80bd47afaae707ca60525087d
SHA1cfc70fd56b4114cf146406a4ebbbfba25e5e97f0
SHA256a58f4b7cff7b27cd1565c85f638071671cfe7fe40a162a365ad18512488dfb4d
SHA512aa0ab0511fce8f520b7a501c15b673638cdaa1bd2d1e9e36e5c5b66d44fce62a67a02465c74edfdec88b2fd1727d1ed78c3200d410a88e9f75698028de848b01