asyncrat | 1379e10d0f09454dec7701917db4752dabbe57bac4381d4c9a4c105244612374

Analysis

max time kernel
151s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
30-06-2024 18:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1379e10d0f09454dec7701917db4752dabbe57bac4381d4c9a4c105244612374.exe
Size

73KB
MD5

af90f03a23c6af39ca50fc618b066c2b
SHA1

955cf4e596dd113ea97d8bd234e09cc4a4584ad9
SHA256

1379e10d0f09454dec7701917db4752dabbe57bac4381d4c9a4c105244612374
SHA512

15f383e541c3bc9c2143adda1dbfad2ca2114264a2a05d623404a8439567bd33a59136833976b4bdbebf4b0b012af39bc136b74b9ac187a3b4d9ec083e1df5ff
SSDEEP

1536:oUYccx4y3lCl6PMVp7TNyIB21bl/5OdxQzc33VclN:oUlcx4yVy6PMVp7Bl21blCQSlY

Score

10^/10

asyncrat default discovery rat

Malware Config

Extracted

Family

asyncrat

Version

Venom RAT + HVNC + Stealer + Grabber v6.0.3

Botnet

Default

147.185.221.20:46193

Mutex

tesargwffegsrgdrtgr5eg4re5gy756u6j7

Attributes

delay
1
install
true
install_file
12345.exe
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Detects executables attemping to enumerate video devices using WMI 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3292-1-0x00000000001A0000-0x00000000001B6000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice
C:\Users\Admin\AppData\Roaming\12345.exe	INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

1379e10d0f09454dec7701917db4752dabbe57bac4381d4c9a4c105244612374.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	1379e10d0f09454dec7701917db4752dabbe57bac4381d4c9a4c105244612374.exe

Executes dropped EXE 1 IoCs

Processes:

12345.exe

pid process

3576 12345.exe
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

1580 timeout.exe
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exe

pid process

1108 schtasks.exe

pid	process
3576	12345.exe

pid	process
1580	timeout.exe

pid	process
1108	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

1379e10d0f09454dec7701917db4752dabbe57bac4381d4c9a4c105244612374.exe12345.exe

pid	process
3292	1379e10d0f09454dec7701917db4752dabbe57bac4381d4c9a4c105244612374.exe
3292	1379e10d0f09454dec7701917db4752dabbe57bac4381d4c9a4c105244612374.exe
3292	1379e10d0f09454dec7701917db4752dabbe57bac4381d4c9a4c105244612374.exe
3292	1379e10d0f09454dec7701917db4752dabbe57bac4381d4c9a4c105244612374.exe
3292	1379e10d0f09454dec7701917db4752dabbe57bac4381d4c9a4c105244612374.exe
3292	1379e10d0f09454dec7701917db4752dabbe57bac4381d4c9a4c105244612374.exe
3292	1379e10d0f09454dec7701917db4752dabbe57bac4381d4c9a4c105244612374.exe
3292	1379e10d0f09454dec7701917db4752dabbe57bac4381d4c9a4c105244612374.exe
3292	1379e10d0f09454dec7701917db4752dabbe57bac4381d4c9a4c105244612374.exe
3292	1379e10d0f09454dec7701917db4752dabbe57bac4381d4c9a4c105244612374.exe
3292	1379e10d0f09454dec7701917db4752dabbe57bac4381d4c9a4c105244612374.exe
3292	1379e10d0f09454dec7701917db4752dabbe57bac4381d4c9a4c105244612374.exe
3292	1379e10d0f09454dec7701917db4752dabbe57bac4381d4c9a4c105244612374.exe
3292	1379e10d0f09454dec7701917db4752dabbe57bac4381d4c9a4c105244612374.exe
3292	1379e10d0f09454dec7701917db4752dabbe57bac4381d4c9a4c105244612374.exe
3292	1379e10d0f09454dec7701917db4752dabbe57bac4381d4c9a4c105244612374.exe
3292	1379e10d0f09454dec7701917db4752dabbe57bac4381d4c9a4c105244612374.exe
3292	1379e10d0f09454dec7701917db4752dabbe57bac4381d4c9a4c105244612374.exe
3292	1379e10d0f09454dec7701917db4752dabbe57bac4381d4c9a4c105244612374.exe
3292	1379e10d0f09454dec7701917db4752dabbe57bac4381d4c9a4c105244612374.exe
3292	1379e10d0f09454dec7701917db4752dabbe57bac4381d4c9a4c105244612374.exe
3292	1379e10d0f09454dec7701917db4752dabbe57bac4381d4c9a4c105244612374.exe
3292	1379e10d0f09454dec7701917db4752dabbe57bac4381d4c9a4c105244612374.exe
3292	1379e10d0f09454dec7701917db4752dabbe57bac4381d4c9a4c105244612374.exe
3292	1379e10d0f09454dec7701917db4752dabbe57bac4381d4c9a4c105244612374.exe
3292	1379e10d0f09454dec7701917db4752dabbe57bac4381d4c9a4c105244612374.exe
3292	1379e10d0f09454dec7701917db4752dabbe57bac4381d4c9a4c105244612374.exe
3292	1379e10d0f09454dec7701917db4752dabbe57bac4381d4c9a4c105244612374.exe
3292	1379e10d0f09454dec7701917db4752dabbe57bac4381d4c9a4c105244612374.exe
3292	1379e10d0f09454dec7701917db4752dabbe57bac4381d4c9a4c105244612374.exe
3292	1379e10d0f09454dec7701917db4752dabbe57bac4381d4c9a4c105244612374.exe
3292	1379e10d0f09454dec7701917db4752dabbe57bac4381d4c9a4c105244612374.exe
3292	1379e10d0f09454dec7701917db4752dabbe57bac4381d4c9a4c105244612374.exe
3292	1379e10d0f09454dec7701917db4752dabbe57bac4381d4c9a4c105244612374.exe
3292	1379e10d0f09454dec7701917db4752dabbe57bac4381d4c9a4c105244612374.exe
3576	12345.exe
3576	12345.exe
3576	12345.exe
3576	12345.exe
3576	12345.exe
3576	12345.exe
3576	12345.exe
3576	12345.exe
3576	12345.exe
3576	12345.exe
3576	12345.exe
3576	12345.exe
3576	12345.exe
3576	12345.exe
3576	12345.exe
3576	12345.exe
3576	12345.exe
3576	12345.exe
3576	12345.exe
3576	12345.exe
3576	12345.exe
3576	12345.exe
3576	12345.exe
3576	12345.exe
3576	12345.exe
3576	12345.exe
3576	12345.exe
3576	12345.exe
3576	12345.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

1379e10d0f09454dec7701917db4752dabbe57bac4381d4c9a4c105244612374.exe12345.exe

description pid process

Token: SeDebugPrivilege 3292 1379e10d0f09454dec7701917db4752dabbe57bac4381d4c9a4c105244612374.exe
Token: SeDebugPrivilege 3576 12345.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

12345.exe

pid process

3576 12345.exe

description	pid	process
Token: SeDebugPrivilege	3292	1379e10d0f09454dec7701917db4752dabbe57bac4381d4c9a4c105244612374.exe
Token: SeDebugPrivilege	3576	12345.exe

pid	process
3576	12345.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

1379e10d0f09454dec7701917db4752dabbe57bac4381d4c9a4c105244612374.execmd.execmd.exe

description	pid	process	target process
PID 3292 wrote to memory of 3432	3292	1379e10d0f09454dec7701917db4752dabbe57bac4381d4c9a4c105244612374.exe	cmd.exe
PID 3292 wrote to memory of 3432	3292	1379e10d0f09454dec7701917db4752dabbe57bac4381d4c9a4c105244612374.exe	cmd.exe
PID 3292 wrote to memory of 1404	3292	1379e10d0f09454dec7701917db4752dabbe57bac4381d4c9a4c105244612374.exe	cmd.exe
PID 3292 wrote to memory of 1404	3292	1379e10d0f09454dec7701917db4752dabbe57bac4381d4c9a4c105244612374.exe	cmd.exe
PID 3432 wrote to memory of 1108	3432	cmd.exe	schtasks.exe
PID 3432 wrote to memory of 1108	3432	cmd.exe	schtasks.exe
PID 1404 wrote to memory of 1580	1404	cmd.exe	timeout.exe
PID 1404 wrote to memory of 1580	1404	cmd.exe	timeout.exe
PID 1404 wrote to memory of 3576	1404	cmd.exe	12345.exe
PID 1404 wrote to memory of 3576	1404	cmd.exe	12345.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\1379e10d0f09454dec7701917db4752dabbe57bac4381d4c9a4c105244612374.exe
"C:\Users\Admin\AppData\Local\Temp\1379e10d0f09454dec7701917db4752dabbe57bac4381d4c9a4c105244612374.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3292

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "12345" /tr '"C:\Users\Admin\AppData\Roaming\12345.exe"' & exit
2⤵
- Suspicious use of WriteProcessMemory
PID:3432

C:\Windows\system32\schtasks.exe
schtasks /create /f /sc onlogon /rl highest /tn "12345" /tr '"C:\Users\Admin\AppData\Roaming\12345.exe"'
3⤵
- Scheduled Task/Job: Scheduled Task
PID:1108

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp171D.tmp.bat""
2⤵
- Suspicious use of WriteProcessMemory
PID:1404

C:\Windows\system32\timeout.exe
timeout 3
3⤵
- Delays execution with timeout.exe
PID:1580

C:\Users\Admin\AppData\Roaming\12345.exe
"C:\Users\Admin\AppData\Roaming\12345.exe"
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3576

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4240 --field-trial-handle=2656,i,16940681401824032220,151921362336696246,262144 --variations-seed-version /prefetch:8
1⤵
PID:2440

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp171D.tmp.bat
Filesize
149B

MD5
82d76aff7726990ceeb0e55f493c4eeb

SHA1
54ac80cc56753a3f10fded13a805cc1fcb2f8edb

SHA256
7c403b7e836c01a418b2c03a6c38bc84e3c584d83a3b9cf43b8d11d1e1c23166

SHA512
146426ce6a228265bb64dd5e1cd1925227ef5fd60b4da5dfb9ab94efcb7c19e4e28a58c5d4f2cb234ba0813b7463821d2ccd645cabb272f8b68f73570a7a14e4

Download Submit
C:\Users\Admin\AppData\Roaming\12345.exe
Filesize
73KB

MD5
af90f03a23c6af39ca50fc618b066c2b

SHA1
955cf4e596dd113ea97d8bd234e09cc4a4584ad9

SHA256
1379e10d0f09454dec7701917db4752dabbe57bac4381d4c9a4c105244612374

SHA512
15f383e541c3bc9c2143adda1dbfad2ca2114264a2a05d623404a8439567bd33a59136833976b4bdbebf4b0b012af39bc136b74b9ac187a3b4d9ec083e1df5ff

Download Submit
C:\Users\Admin\AppData\Roaming\MyData\DataLogs.conf
Filesize
8B

MD5
cf759e4c5f14fe3eec41b87ed756cea8

SHA1
c27c796bb3c2fac929359563676f4ba1ffada1f5

SHA256
c9f9f193409217f73cc976ad078c6f8bf65d3aabcf5fad3e5a47536d47aa6761

SHA512
c7f832aee13a5eb36d145f35d4464374a9e12fa2017f3c2257442d67483b35a55eccae7f7729243350125b37033e075efbc2303839fd86b81b9b4dca3626953b

Download Submit
memory/3292-0-0x00007FFCA3103000-0x00007FFCA3105000-memory.dmp

Filesize
8KB

Download
memory/3292-1-0x00000000001A0000-0x00000000001B6000-memory.dmp

Filesize
88KB

Download
memory/3292-3-0x00007FFCA3100000-0x00007FFCA3BC1000-memory.dmp

Filesize
10.8MB

Download
memory/3292-8-0x00007FFCA3100000-0x00007FFCA3BC1000-memory.dmp

Filesize
10.8MB

Download
memory/3292-9-0x00007FFCA3100000-0x00007FFCA3BC1000-memory.dmp

Filesize
10.8MB

Download