asyncrat | 5b1a883fc342ab1654912c119190f04771ae47477f1a006b932150129675134c

Analysis

max time kernel
145s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
22/03/2025, 06:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

394f64ff5b12eab1067babefe641f23e.exe
Size

63KB
MD5

394f64ff5b12eab1067babefe641f23e
SHA1

204a1a4572c5545afd99b61a87174ca83596c0b8
SHA256

776e0900fa622854f9e032773e373017b9cd9d814e19703ad6f366c53fe0aa77
SHA512

a8dca3a1e3e0e4faefc678fbfb0def4588f111865669cd63f9c77f02658f9fedcc9c31e1b56f84429a459a02fecb606a7b43519e0472c27d72c3cf1136a1e60d
SSDEEP

1536:ghYRpM16zMsN2eeiIVrGbbXwz+rYNDwGWDpqKmY7:ghYRpM16/NveXGbbXyTIgz

Score

10^/10

asyncrat venom clients rat

Malware Config

Extracted

Family

asyncrat

Version

5.0.5

Botnet

Venom Clients

127.0.0.1:5050

127.0.0.1:3368

147.185.221.27:5050

147.185.221.27:3368

Mutex

Venom_RAT_HVNC_Mutex_Venom RAT_HVNC

Attributes

delay
1
install
true
install_file
Update.exe
install_folder
%Temp%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Asyncrat family
asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral24/files/0x0006000000021e21-11.dat	family_asyncrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\Control Panel\International\Geo\Nation	394f64ff5b12eab1067babefe641f23e.exe

Executes dropped EXE 1 IoCs

pid	Process
4540	Update.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
4044	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5740	schtasks.exe

Suspicious behavior: EnumeratesProcesses 23 IoCs

pid	Process
3628	394f64ff5b12eab1067babefe641f23e.exe
3628	394f64ff5b12eab1067babefe641f23e.exe
3628	394f64ff5b12eab1067babefe641f23e.exe
3628	394f64ff5b12eab1067babefe641f23e.exe
3628	394f64ff5b12eab1067babefe641f23e.exe
3628	394f64ff5b12eab1067babefe641f23e.exe
3628	394f64ff5b12eab1067babefe641f23e.exe
3628	394f64ff5b12eab1067babefe641f23e.exe
3628	394f64ff5b12eab1067babefe641f23e.exe
3628	394f64ff5b12eab1067babefe641f23e.exe
3628	394f64ff5b12eab1067babefe641f23e.exe
3628	394f64ff5b12eab1067babefe641f23e.exe
3628	394f64ff5b12eab1067babefe641f23e.exe
3628	394f64ff5b12eab1067babefe641f23e.exe
3628	394f64ff5b12eab1067babefe641f23e.exe
3628	394f64ff5b12eab1067babefe641f23e.exe
3628	394f64ff5b12eab1067babefe641f23e.exe
3628	394f64ff5b12eab1067babefe641f23e.exe
3628	394f64ff5b12eab1067babefe641f23e.exe
3628	394f64ff5b12eab1067babefe641f23e.exe
3628	394f64ff5b12eab1067babefe641f23e.exe
3628	394f64ff5b12eab1067babefe641f23e.exe
3628	394f64ff5b12eab1067babefe641f23e.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3628	394f64ff5b12eab1067babefe641f23e.exe
Token: SeDebugPrivilege	4540	Update.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 3628 wrote to memory of 2916	3628	394f64ff5b12eab1067babefe641f23e.exe	88
PID 3628 wrote to memory of 2916	3628	394f64ff5b12eab1067babefe641f23e.exe	88
PID 3628 wrote to memory of 2060	3628	394f64ff5b12eab1067babefe641f23e.exe	90
PID 3628 wrote to memory of 2060	3628	394f64ff5b12eab1067babefe641f23e.exe	90
PID 2916 wrote to memory of 5740	2916	cmd.exe	92
PID 2916 wrote to memory of 5740	2916	cmd.exe	92
PID 2060 wrote to memory of 4044	2060	cmd.exe	93
PID 2060 wrote to memory of 4044	2060	cmd.exe	93
PID 2060 wrote to memory of 4540	2060	cmd.exe	94
PID 2060 wrote to memory of 4540	2060	cmd.exe	94

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\394f64ff5b12eab1067babefe641f23e.exe
"C:\Users\Admin\AppData\Local\Temp\394f64ff5b12eab1067babefe641f23e.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3628
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Update" /tr '"C:\Users\Admin\AppData\Local\Temp\Update.exe"' & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2916
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc onlogon /rl highest /tn "Update" /tr '"C:\Users\Admin\AppData\Local\Temp\Update.exe"'
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5740
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp64D4.tmp.bat""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2060
- - C:\Windows\system32\timeout.exe
    timeout 3
    3⤵
    - Delays execution with timeout.exe
    PID:4044
- - C:\Users\Admin\AppData\Local\Temp\Update.exe
    "C:\Users\Admin\AppData\Local\Temp\Update.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:4540

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Update.exe

Filesize
63KB

MD5
394f64ff5b12eab1067babefe641f23e

SHA1
204a1a4572c5545afd99b61a87174ca83596c0b8

SHA256
776e0900fa622854f9e032773e373017b9cd9d814e19703ad6f366c53fe0aa77

SHA512
a8dca3a1e3e0e4faefc678fbfb0def4588f111865669cd63f9c77f02658f9fedcc9c31e1b56f84429a459a02fecb606a7b43519e0472c27d72c3cf1136a1e60d

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp64D4.tmp.bat

Filesize
153B

MD5
6279621cbb614b263294ba6402b9d7c6

SHA1
9b7a593ec6e07cd78b4815cf244010984d1cc8b3

SHA256
41a6499e4f3d07d3d5a72b4fc72d2526cd5ae6f6ed86a585e128a0453eb95f8a

SHA512
bf8b93b8104ca881b92aa49eabf59220824632f99d93fb7df46177074f7345ef4bb9a8318a957afd4bb010b89cbbe1a894736cd2ced91ad71481099bd413f0ac

Download Submit
memory/3628-0-0x00007FFA52E13000-0x00007FFA52E15000-memory.dmp

Filesize
8KB

Download
memory/3628-1-0x0000000000D70000-0x0000000000D86000-memory.dmp

Filesize
88KB

Download
memory/3628-2-0x00007FFA52E10000-0x00007FFA538D1000-memory.dmp

Filesize
10.8MB

Download
memory/3628-7-0x00007FFA52E10000-0x00007FFA538D1000-memory.dmp

Filesize
10.8MB

Download
memory/3628-12-0x00007FFA52E10000-0x00007FFA538D1000-memory.dmp

Filesize
10.8MB

Download