asyncrat | becf832ddc730f55b034b135640ba2149334c29eca1291509d64c35bcf2a6ce9

Analysis

max time kernel
147s
max time network
120s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
01-07-2024 02:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

becf832ddc730f55b034b135640ba2149334c29eca1291509d64c35bcf2a6ce9.exe
Size

266KB
MD5

d65b5445fa5e3736626098ef689331c5
SHA1

b62313172586337872dd25b1ecb968c9c5a9010e
SHA256

becf832ddc730f55b034b135640ba2149334c29eca1291509d64c35bcf2a6ce9
SHA512

769adc82278c4dbce0a42769119d7ca7fca17712d4ae6a7669ae95d54060e0fa89d142479d080b7c569142d6471f25697324277c3619d0fb3ede78ce8a8e0337
SSDEEP

3072:WdvzDqxs8ORikgogWfiuRXd3YmSffdTKXNXANewGBvskX1pWA/s8w:WFzDqa86hV6uRRqX1evPlwAEJ

Score

10^/10

asyncrat persistence rat

Malware Config

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Contains code to disable Windows Defender 5 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

Processes:

resource	yara_rule
behavioral1/memory/2796-36-0x0000000000400000-0x0000000000430000-memory.dmp	disable_win_def
behavioral1/memory/2796-35-0x0000000000400000-0x0000000000430000-memory.dmp	disable_win_def
behavioral1/memory/2796-34-0x0000000000400000-0x0000000000430000-memory.dmp	disable_win_def
behavioral1/memory/2796-29-0x0000000000400000-0x0000000000430000-memory.dmp	disable_win_def
behavioral1/memory/2796-31-0x0000000000400000-0x0000000000430000-memory.dmp	disable_win_def

Detects Windows executables referencing non-Windows User-Agents 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2796-36-0x0000000000400000-0x0000000000430000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral1/memory/2796-35-0x0000000000400000-0x0000000000430000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral1/memory/2796-34-0x0000000000400000-0x0000000000430000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral1/memory/2796-29-0x0000000000400000-0x0000000000430000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral1/memory/2796-31-0x0000000000400000-0x0000000000430000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Detects executables containing artifacts associated with disabling Widnows Defender 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2796-36-0x0000000000400000-0x0000000000430000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral1/memory/2796-35-0x0000000000400000-0x0000000000430000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral1/memory/2796-34-0x0000000000400000-0x0000000000430000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral1/memory/2796-29-0x0000000000400000-0x0000000000430000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral1/memory/2796-31-0x0000000000400000-0x0000000000430000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender

Detects executables embedding registry key / value combination indicative of disabling Windows Defender features 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2796-36-0x0000000000400000-0x0000000000430000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral1/memory/2796-35-0x0000000000400000-0x0000000000430000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral1/memory/2796-34-0x0000000000400000-0x0000000000430000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral1/memory/2796-29-0x0000000000400000-0x0000000000430000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral1/memory/2796-31-0x0000000000400000-0x0000000000430000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

Detects file containing reversed ASEP Autorun registry keys 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2796-36-0x0000000000400000-0x0000000000430000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse
behavioral1/memory/2796-35-0x0000000000400000-0x0000000000430000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse
behavioral1/memory/2796-34-0x0000000000400000-0x0000000000430000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse
behavioral1/memory/2796-29-0x0000000000400000-0x0000000000430000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse
behavioral1/memory/2796-31-0x0000000000400000-0x0000000000430000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse

Executes dropped EXE 1 IoCs

Processes:

HiPatchService.exe

pid process

2968 HiPatchService.exe
Loads dropped DLL 1 IoCs

Processes:

becf832ddc730f55b034b135640ba2149334c29eca1291509d64c35bcf2a6ce9.exe

pid process

2056 becf832ddc730f55b034b135640ba2149334c29eca1291509d64c35bcf2a6ce9.exe

pid	process
2968	HiPatchService.exe

pid	process
2056	becf832ddc730f55b034b135640ba2149334c29eca1291509d64c35bcf2a6ce9.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

becf832ddc730f55b034b135640ba2149334c29eca1291509d64c35bcf2a6ce9.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\HiPatch = "C:\\Users\\Admin\\AppData\\Roaming\\HiPatch\\HiPatchService.exe"	becf832ddc730f55b034b135640ba2149334c29eca1291509d64c35bcf2a6ce9.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

HiPatchService.exe

description pid process target process

PID 2968 set thread context of 2796 2968 HiPatchService.exe RegAsm.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

RegAsm.exe

pid process

2796 RegAsm.exe
2796 RegAsm.exe
2796 RegAsm.exe
2796 RegAsm.exe
2796 RegAsm.exe
2796 RegAsm.exe
2796 RegAsm.exe
2796 RegAsm.exe
2796 RegAsm.exe
2796 RegAsm.exe

description	pid	process	target process
PID 2968 set thread context of 2796	2968	HiPatchService.exe	RegAsm.exe

pid	process
2796	RegAsm.exe
2796	RegAsm.exe
2796	RegAsm.exe
2796	RegAsm.exe
2796	RegAsm.exe
2796	RegAsm.exe
2796	RegAsm.exe
2796	RegAsm.exe
2796	RegAsm.exe
2796	RegAsm.exe

Suspicious use of WriteProcessMemory 26 IoCs

Processes:

becf832ddc730f55b034b135640ba2149334c29eca1291509d64c35bcf2a6ce9.exeHiPatchService.exe

description	pid	process	target process
PID 2056 wrote to memory of 2968	2056	becf832ddc730f55b034b135640ba2149334c29eca1291509d64c35bcf2a6ce9.exe	HiPatchService.exe
PID 2056 wrote to memory of 2968	2056	becf832ddc730f55b034b135640ba2149334c29eca1291509d64c35bcf2a6ce9.exe	HiPatchService.exe
PID 2056 wrote to memory of 2968	2056	becf832ddc730f55b034b135640ba2149334c29eca1291509d64c35bcf2a6ce9.exe	HiPatchService.exe
PID 2056 wrote to memory of 2968	2056	becf832ddc730f55b034b135640ba2149334c29eca1291509d64c35bcf2a6ce9.exe	HiPatchService.exe
PID 2056 wrote to memory of 2968	2056	becf832ddc730f55b034b135640ba2149334c29eca1291509d64c35bcf2a6ce9.exe	HiPatchService.exe
PID 2056 wrote to memory of 2968	2056	becf832ddc730f55b034b135640ba2149334c29eca1291509d64c35bcf2a6ce9.exe	HiPatchService.exe
PID 2056 wrote to memory of 2968	2056	becf832ddc730f55b034b135640ba2149334c29eca1291509d64c35bcf2a6ce9.exe	HiPatchService.exe
PID 2056 wrote to memory of 2612	2056	becf832ddc730f55b034b135640ba2149334c29eca1291509d64c35bcf2a6ce9.exe	cmd.exe
PID 2056 wrote to memory of 2612	2056	becf832ddc730f55b034b135640ba2149334c29eca1291509d64c35bcf2a6ce9.exe	cmd.exe
PID 2056 wrote to memory of 2612	2056	becf832ddc730f55b034b135640ba2149334c29eca1291509d64c35bcf2a6ce9.exe	cmd.exe
PID 2056 wrote to memory of 2612	2056	becf832ddc730f55b034b135640ba2149334c29eca1291509d64c35bcf2a6ce9.exe	cmd.exe
PID 2056 wrote to memory of 2612	2056	becf832ddc730f55b034b135640ba2149334c29eca1291509d64c35bcf2a6ce9.exe	cmd.exe
PID 2056 wrote to memory of 2612	2056	becf832ddc730f55b034b135640ba2149334c29eca1291509d64c35bcf2a6ce9.exe	cmd.exe
PID 2056 wrote to memory of 2612	2056	becf832ddc730f55b034b135640ba2149334c29eca1291509d64c35bcf2a6ce9.exe	cmd.exe
PID 2968 wrote to memory of 2796	2968	HiPatchService.exe	RegAsm.exe
PID 2968 wrote to memory of 2796	2968	HiPatchService.exe	RegAsm.exe
PID 2968 wrote to memory of 2796	2968	HiPatchService.exe	RegAsm.exe
PID 2968 wrote to memory of 2796	2968	HiPatchService.exe	RegAsm.exe
PID 2968 wrote to memory of 2796	2968	HiPatchService.exe	RegAsm.exe
PID 2968 wrote to memory of 2796	2968	HiPatchService.exe	RegAsm.exe
PID 2968 wrote to memory of 2796	2968	HiPatchService.exe	RegAsm.exe
PID 2968 wrote to memory of 2796	2968	HiPatchService.exe	RegAsm.exe
PID 2968 wrote to memory of 2796	2968	HiPatchService.exe	RegAsm.exe
PID 2968 wrote to memory of 2796	2968	HiPatchService.exe	RegAsm.exe
PID 2968 wrote to memory of 2796	2968	HiPatchService.exe	RegAsm.exe
PID 2968 wrote to memory of 2796	2968	HiPatchService.exe	RegAsm.exe

C:\Users\Admin\AppData\Local\Temp\becf832ddc730f55b034b135640ba2149334c29eca1291509d64c35bcf2a6ce9.exe
"C:\Users\Admin\AppData\Local\Temp\becf832ddc730f55b034b135640ba2149334c29eca1291509d64c35bcf2a6ce9.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2056

C:\Users\Admin\AppData\Roaming\HiPatch\HiPatchService.exe
"C:\Users\Admin\AppData\Roaming\HiPatch\HiPatchService.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2968

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:2796

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Roaming\HiPatch\HiPatchService.bat""
2⤵
PID:2612

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:1644

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\HiPatch\HiPatchService.bat
Filesize
213B

MD5
0955cb4b691d44b37f8b6fad48a33b8e

SHA1
9dae759ae014cc124ab6eed7c8035788c124ae4a

SHA256
9092dbb1ca1767d1966b7f79349dd95a802a68248251bf070c0f1d74d5681d71

SHA512
08b868a028c1e8d29ed643416850df16f58d44668f9193b46bd3934965e5617a0a4015fc52815c5456023dbde01023450d295b76d936a936f26b602e764b0235

Download Submit
C:\Users\Admin\AppData\Roaming\HiPatch\HiPatchService.exe
Filesize
266KB

MD5
a3d1269bb2740b85f4d93fba6eb4cdbe

SHA1
8a9792062ff93024924867d075f22bbe7a54f84c

SHA256
c787362a07ada43f574252d5a4d8a650f423699fd9b21e503455aa9b3760d88a

SHA512
5ff77e2a305eb2bc7b09786a949c738187518e4f9dabfb94c167fa78b5bec61bc9b6348893d5db2078b01284c470121f1b890e76129ad1797d0fd64691697292

Download Submit
memory/2056-3-0x0000000074CF0000-0x00000000753DE000-memory.dmp

Filesize
6.9MB

Download
memory/2056-2-0x0000000000240000-0x000000000024A000-memory.dmp

Filesize
40KB

Download
memory/2056-0-0x0000000074CFE000-0x0000000074CFF000-memory.dmp

Filesize
4KB

Download
memory/2056-1-0x0000000000E70000-0x0000000000EB6000-memory.dmp

Filesize
280KB

Download
memory/2056-24-0x0000000074CF0000-0x00000000753DE000-memory.dmp

Filesize
6.9MB

Download
memory/2796-29-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2796-35-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2796-36-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2796-34-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2796-33-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2796-27-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2796-31-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2796-25-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2968-23-0x0000000074CF0000-0x00000000753DE000-memory.dmp

Filesize
6.9MB

Download
memory/2968-21-0x0000000000980000-0x00000000009C6000-memory.dmp

Filesize
280KB

Download
memory/2968-37-0x0000000074CF0000-0x00000000753DE000-memory.dmp

Filesize
6.9MB

Download