asyncrat | 058171b49194033b274276750264f1dfc027248b948335902e54b23f76fa700a

General

Target
Exodus FN.exe
Size 895KB
Sample260816-twddlsste1
SHA256 058171b49194033b274276750264f1dfc027248b948335902e54b23f76fa700a
MD5 d1abac15743b5e6bbba8fe120f5281d4
SHA1 2e301d7cb9dc958c5d5fe3f8289e1a8c3676e565
SHA512 14a5ae51c5c920ab2795fa625eab7797101ad66e70c316efc051e0f3962e5ef80dea56f0bb1c987bca2bad66ee2151b7d45fac7e174475ef517ba67b26ad12c9
SSDEEP 12288:HmiMZvN43+u85Bpw+YMRkc9lNo/nmzzoyXoqCBqxjRPKSU1GN9e0o9+d4:GnvS+55BpfRX9lNovmzzZYqbJU12oYy
TLSH
T10E15D009D7E404F9E1B7E278CD534D02EB767C5947A1E68F03A4A9A61F332909D3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

Mutex

XDnMRoMxvCmp

Attributes

delay
3
install
true
install_file
Exodus FN.exe
install_folder
%AppData%
local_host
127.0.0.1

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral1/files/0x000700000001e6bc-6.dat	family_asyncrat

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	Exodus FN.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	Exodus Beta.exe

Executes dropped EXE 4 IoCs

pid	Process
3392	Exodus Beta.exe
4584	project.exe
4304	Exodus FN.exe
4996	Exodus FN.exe

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\__tmp_rar_sfx_access_check_240649156	Exodus FN.exe
File created	C:\Program Files (x86)\Microsoft\Exodus Beta.exe	Exodus FN.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Exodus Beta.exe	Exodus FN.exe
File created	C:\Program Files (x86)\Microsoft\project.exe	Exodus FN.exe
File opened for modification	C:\Program Files (x86)\Microsoft\project.exe	Exodus FN.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3680	cmd.exe
1056	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Exodus FN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Exodus FN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Exodus Beta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
4488	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4408	schtasks.exe

Suspicious behavior: EnumeratesProcesses 23 IoCs

pid	Process
3392	Exodus Beta.exe
3392	Exodus Beta.exe
3392	Exodus Beta.exe
3392	Exodus Beta.exe
3392	Exodus Beta.exe
3392	Exodus Beta.exe
3392	Exodus Beta.exe
3392	Exodus Beta.exe
3392	Exodus Beta.exe
3392	Exodus Beta.exe
3392	Exodus Beta.exe
3392	Exodus Beta.exe
3392	Exodus Beta.exe
3392	Exodus Beta.exe
3392	Exodus Beta.exe
3392	Exodus Beta.exe
3392	Exodus Beta.exe
3392	Exodus Beta.exe
3392	Exodus Beta.exe
3392	Exodus Beta.exe
3392	Exodus Beta.exe
3392	Exodus Beta.exe
3392	Exodus Beta.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4584	project.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3392	Exodus Beta.exe
Token: SeDebugPrivilege	4304	Exodus FN.exe
Token: SeDebugPrivilege	4304	Exodus FN.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4584	project.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3840 wrote to memory of 3392	3840	Exodus FN.exe	87
PID 3840 wrote to memory of 4584	3840	Exodus FN.exe	89
PID 3392 wrote to memory of 3680	3392	Exodus Beta.exe	91
PID 3392 wrote to memory of 1056	3392	Exodus Beta.exe	93
PID 1056 wrote to memory of 4488	1056	cmd.exe	95
PID 3680 wrote to memory of 4408	3680	cmd.exe	96
PID 1056 wrote to memory of 4996	1056	cmd.exe	99

C:\Users\Admin\AppData\Local\Temp\Exodus FN.exe
"C:\Users\Admin\AppData\Local\Temp\Exodus FN.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:3840
- C:\Program Files (x86)\Microsoft\Exodus Beta.exe
  "C:\Program Files (x86)\Microsoft\Exodus Beta.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3392
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Exodus FN" /tr '"C:\Users\Admin\AppData\Roaming\Exodus FN.exe"' & exit
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3680
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /f /sc onlogon /rl highest /tn "Exodus FN" /tr '"C:\Users\Admin\AppData\Roaming\Exodus FN.exe"'
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:4408
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp199E.tmp.bat""
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1056
  - - C:\Windows\SysWOW64\timeout.exe
      timeout 3
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:4488
  - - C:\Users\Admin\AppData\Roaming\Exodus FN.exe
      "C:\Users\Admin\AppData\Roaming\Exodus FN.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4996
- C:\Program Files (x86)\Microsoft\project.exe
  "C:\Program Files (x86)\Microsoft\project.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:4584

C:\Users\Admin\AppData\Roaming\Exodus FN.exe
"C:\Users\Admin\AppData\Roaming\Exodus FN.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4304

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Exodus Beta.exe

Path C:\Program Files (x86)\Microsoft\Exodus Beta.exe
Size 45KB
SHA256 d97f005b6609a88f5b4d1c8723abf65d9b59fbb3a7b3d57eff9ff5f644b98df8
MD5 1a8d99109a3468cc2d0c479c8af47952
SHA1 499cbed1193987037311ac208d8952000be60c7c
SHA512 5f53fb78918a201669f170cd4fe410d6a7b40b50d2e3e0c7687b16a454c720aae10a5ee59afef23b1be591cdbc7acdfc82394101e073205137ac4443bb3ed4f4
SSDEEP 768:eu2etT/EBIeUEWUKbSOmo2qsBGbDcPIB/jbEgX3iYoDiDdDZBDZc/:eu2etT/+No2lSVBLbLXSv2ZDHdc/
TLSH
T189232A003BE9852BF2BE4FB899F26145867AF1A33603D64D1CC441D75613FC68A42AFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

project.exe

Path C:\Program Files (x86)\Microsoft\project.exe
Size 934KB
SHA256 938e57b0de5017c032f2ae7a3e6af1f5ee91b931af30515faeff8ba35d432c06
MD5 c9cd2f0cc292458996b7be7b8788e33d
SHA1 4e0c7461d0bf5331bf7c5bf6926c0ef5dcc7d365
SHA512 a95df58eab881bafc7d9cfd006885a8c4971723c9c79c6bbdde13113c31ff7e0aad4afc0d49a05ac8470cd5e1263a3b6dd90463358c3f1b0df5d736dfb2e3bfc
SSDEEP 12288:aNUJp2uPhDY2zk3j+o96EiBLOthnUdtv4ihlrtjJqc3a4fQsdQ2i/nqE3i:aNUp95K+o96EmOtBUL3tjJTxbi/n3y
TLSH
T111158D01F2D502ACD07B5934DAB2E22BE73578906B3482CF77C5196CAFB76E046B2716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmp199E.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmp199E.tmp.bat
Size 153B
SHA256 5a9cff3a60f2bf7fd2a4b2ac74100afd2a58221831736a55bbdcb5a9c841266c
MD5 3c6a126bf7703c777357df0da8e249ba
SHA1 938ca84a00e4fb407e0b747a3a4a0a5966b7239e
SHA512 cabbbd8f0ee34bc97d8d9871016c2f63518bca5f1f685b1c2ba4b78fc7b90e7ed196133c6e80a00ca170408885df862060b409886c3ce97a4b7338554b8fdc13
TLSH
T1ADC02B4251CAEA0F280924530BFBE98D927A6C1D3F84BF40C7049D0D13C0848F4D9381
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3392-21-0x0000000000370000-0x0000000000382000-memory.dmp

Download

memory/3392-22-0x0000000004CF0000-0x0000000004D56000-memory.dmp

Download

memory/3392-23-0x00000000051C0000-0x000000000525C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads