Analysis
-
max time kernel
55s -
max time network
53s -
platform
windows10-2004_x64 -
resource
win10v2004-20250410-en -
resource tags
-
submitted
20/04/2025, 19:15
General
-
Target
b8931d6b7ece78c94ba82511d7f85466c280e8b1059034637e0434a3dd221ed5.exe
-
Size
7.5MB
-
MD5
d7a4872df076123cffaa9d4088c6c9c2
-
SHA1
672ffdc2435f45707337d281da14c0675bdfa1be
-
SHA256
b8931d6b7ece78c94ba82511d7f85466c280e8b1059034637e0434a3dd221ed5
-
SHA512
c8eb46cf3d76f7fad8d43390208365a6ff2320664275df7b91427e1ea06e75c5e35791d1e38eb9b45425740f5590538ddc6590e0a75f1e2ef2c11a6811d62912
-
SSDEEP
98304:7XvvXbqLcfF4SNvJ7JuDjjCD2W8zhFxXTWgjY5z8D7PGPZs44bMHES3yFkwON:7HXbqLc26ijWGhFxXIz8D7PGPT4IhySx
Malware Config
Extracted
asyncrat
0.5.8
Default
127.0.0.1:6606
127.0.0.1:7707
127.0.0.1:8808
92agQQpzsyjf
-
delay
3
-
install
true
-
install_file
Roblox_HelloKitty_Backgrounds_v1.0.exe
-
install_folder
%AppData%
Signatures
-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
Asyncrat family
-
Async RAT payload 1 IoCs
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 4 IoCs
-
Loads dropped DLL 2 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 18 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Delays execution with timeout.exe 1 IoCs
-
Enumerates system info in registry 2 TTPs 2 IoCs
-
Modifies Internet Explorer settings 1 TTPs 6 IoCs
-
Modifies registry class 30 IoCs
-
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 24 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 23 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b8931d6b7ece78c94ba82511d7f85466c280e8b1059034637e0434a3dd221ed5.exe"C:\Users\Admin\AppData\Local\Temp\b8931d6b7ece78c94ba82511d7f85466c280e8b1059034637e0434a3dd221ed5.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Roblox_HelloKitty_Backgrounds_v1.0.png.exe"C:\Users\Admin\AppData\Local\Temp\Roblox_HelloKitty_Backgrounds_v1.0.png.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Roblox_HelloKitty_Backgrounds_v1.0" /tr '"C:\Users\Admin\AppData\Roaming\Roblox_HelloKitty_Backgrounds_v1.0.exe"' & exit3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "Roblox_HelloKitty_Backgrounds_v1.0" /tr '"C:\Users\Admin\AppData\Roaming\Roblox_HelloKitty_Backgrounds_v1.0.exe"'4⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpA2A8.tmp.bat""3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 34⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
-
-
C:\Users\Admin\AppData\Roaming\Roblox_HelloKitty_Backgrounds_v1.0.exe"C:\Users\Admin\AppData\Roaming\Roblox_HelloKitty_Backgrounds_v1.0.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RobloxPlayerInstaller.exe"C:\Users\Admin\AppData\Local\Temp\RobloxPlayerInstaller.exe"2⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Roblox\Versions\version-1e91b4133e334c9c\RobloxPlayerBeta.exe"C:\Program Files (x86)\Roblox\Versions\version-1e91b4133e334c9c\RobloxPlayerBeta.exe" -app -clientLaunchTimeEpochMs 0 -isInstallerLaunch 31283⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
7.7MB
MD598470b34e4752682f06e15073cc49eb3
SHA112cb5e490824d96c864d20082e61f93dcbdd91c1
SHA2562efb688d19dc2d13df27632f58695ba8f812dd7fef3f60c814d732161781a91a
SHA512a9612ed980e6b4b22e71b5c6d09a521526aae6edc8f3c24a02e39a93acceecc9149b364191f5116cc7ac4b18d0d88239c18b317d18cc6ed40f2003a4c4f158bc
-
Filesize
14.0MB
MD59b3e160b27743f5959535bb9bb957199
SHA115c6b9c7102e705d45264b95c7391591b884d867
SHA2565a0671c14f26a5d54fce080b24c7c557064deb8d20b8b5ef5a487a104509a3b3
SHA51286810b8027f78cfd7521cbade46eda15ba591f3b6d29ce374489d5c90e8bf567c9a9ac889330c2357a9902a337cef4d0d3fb0a55ebb9012a5fd085fd7845b0bb
-
Filesize
154KB
MD5577f05cd683ed0577f6c970ea57129e0
SHA1aedf54a8976f0f8ff5588447c344595e3c468925
SHA2567127f20daa0a0a74e120ab7423dd1b30c45908f8ee929f0c6cd2312b41c5bddf
SHA5122d1aea243938a6a1289cf4efcd541f28ab370a85ef05ed27b7b6d81ce43cea671e06a0959994807923b1dfec3b382ee95bd6f9489b74bba59239601756082047
-
Filesize
8.0MB
MD5cf350be4f188c4f251231836d414c407
SHA19449bfef03203338a6566fa8b7552a8a3f7ae23e
SHA2568c1bfedf69218adab627f9c394c9e05aba5459709ffda07047c054986d15a28d
SHA512a23ee905c1087f8cec7d152ca9c9237992b7f792af02c38850601044883a2020239c76e7995af45c2389eec13a5fec23bb1f0d9d8347ef1f0d05baa951596038
-
Filesize
7.3MB
MD5027183c8f1be3ad3b30d3c8cf7332988
SHA1a7de0320e768d2f737c30e77be4ca5043c3dbe55
SHA2565f02e34dc5d7a478675fef3b4bfa9ed321bf6b6f8d6804aef7b243e360fba2fd
SHA51266aefb4f2295d66da768ada2849e498145ef0f8d1e2e4c4bb7daa1745b6937742451c2f1eaf3dad35833096179e4b9d123487d744106a709f34c6a7bc8f589ac
-
Filesize
175KB
MD519fdb6c0b5f1f446749a45c5e5e0562d
SHA140d2ede657cc2f4b503fffe83282aac93b760fc2
SHA25694049485675d5d01b7287a0347643297acaad21b1904b88ce0271e93feee8cfe
SHA512fd8fffeaa7f605ce0353ea42e269fe105c1abc3708f9b4d03eb882e641b9f5b2ecef14531f4588276dfb5089bbcbbebbd38fe5516210b70bc64e218a69954270
-
Filesize
178B
MD5d936da17fe38e3450451be315602e7ac
SHA15080fdbc2a73c94580c2da7758fa76f27a22288f
SHA256e91475531c819647683724a25e3953c92b7bb6b622fa414d9941f044dae9b0e4
SHA51225e5e9b0a5e5f472ecc46cd8c03983105ccae0054a223324642ece6d9ad7e9accc43aeda272b65bafde8078ac70f1c68bf504a173991b989a6984a4dd0352b15
-
Filesize
4KB
-
Filesize
200KB
-
Filesize
624KB
-
Filesize
192KB
-
Filesize
56KB
-
Filesize
192KB
-
Filesize
192KB
-
Filesize
64KB
-
Filesize
192KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
192KB
-
Filesize
192KB
-
Filesize
192KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
192KB
-
Filesize
20KB
-
Filesize
64KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
192KB
-
Filesize
56KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
44KB
-
Filesize
44KB
-
Filesize
44KB
-
Filesize
44KB
-
Filesize
44KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
152KB
-
Filesize
152KB
-
Filesize
152KB
-
Filesize
152KB
-
Filesize
152KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
156KB
-
Filesize
156KB
-
Filesize
156KB
-
Filesize
156KB
-
Filesize
156KB
-
Filesize
156KB
-
Filesize
156KB
-
Filesize
136KB
-
Filesize
136KB
-
Filesize
136KB
-
Filesize
136KB
-
Filesize
136KB
-
Filesize
192KB
-
Filesize
7.5MB
