AsyncRAT Crusade: Detections and Defense | Splunk

MITRE Techniques

• [T1566.004] Phishing: Spear Phishing Attachment – The malicious OneNote document lures the targeted user to click and view the document. Quote: “The malicious OneNote document will lure the targeted user to click through the warning to view the document as seen in Figure 2.”
• [T1218.005] System Binary Proxy Execution: Mshta – The embedded HTA file downloads the second stage of the infection chain. Quote: “The .HTA file embedded to the .one file is responsible for downloading a second stage of this infection chain.”
• [T1059.003] Command and Scripting Interpreter: Windows Command Shell – A BAT script stager is dropped and obfuscated to generate a PowerShell loader. Quote: “The .bat script dropped in the%temp% folder is obfuscated to evade antivirus or other security products… to generate the PowerShell script loader.”
• [T1059.001] Command and Scripting Interpreter: PowerShell – The PowerShell loader decodes/ decrypts payload via BASE64, AES and gzip, then loads it via .NET Reflection. Quote: “The PowerShell script generated and executed by the .bat script mentioned earlier performs the following steps…”
• [T1027] Obfuscated/Compressed Files and Information – The loader decodes BASE64, decrypts with AES, and decompresses with GZIP to extract the payload. Quote: “It decodes the BASE64 encoded comment string… uses AES cryptography… decompresses it using the GZIP algorithm to extract the malware executable.”
• [T1053.005] Scheduled Task – AsyncRAT creates Windows Scheduled Tasks using SchTasks.exe with highest runlevel privileges. Quote: “add Windows Scheduled Tasks using SchTasks.exe with highest runlevel privileges…”
• [T1547.001] Registry Run Keys/Startup Folder – If not running with admin privileges, AsyncRAT uses the Run Key for persistence. Quote: “If AsyncRAT is not running with administrative privileges, it will use Registry Run Key.”
• [T1548.002] Abuse Elevation Control Mechanism: Privilege Escalation – The malware adjusts its process token to gain SeDebugPrivilege. Quote: “adjust its process token privileges with the “SeDebugPrivilege” token to gain more privileges.”
• [T1497] Virtualization/Sandbox Evasion – Anti-VM and sandbox checks (e.g., WMIC query for VM detection) and Sandboxie DLL checks. Quote: “antiVM Check if its process is running in VirtualBox or VMware by running WMIC query…”; “Check if Sbiedll.dll is loaded, which is a module of sandboxie sandbox.”
• [T1562.001] Impair Defenses – Anti-debugging and sandbox checks (CheckRemoteDebuggerPresent, drive size checks, OS version checks). Quote: “CheckRemoteDebuggerPresent… Check if the size of the disk drive…”; “Check if its process is running in XP Windows Operating System.”
• [T1071.001] Application Layer Protocol: Web Protocols – C2 communications are AES-encrypted with a defined port and IP address for C2. Quote: “decrypt its AES encrypted configuration data including the port (6606) and c2 ip-address (43.138[.]160.55) that will be used for C2 communication.”
• [T1221] Template Injection – Abusing .rels XML template injection to reference remote resources and download payloads. Quote: “Abusing the footer2.xml rels properties of this Office document to connect to a malicious link to download another .xll…”
• [T1059.005] VBScript – .VBS DynamicWrapperX Loader that writes dynwrapx.dll to disk to load and execute payload via DynamicWrapperX. Quote: “the .vbs script loader that writes dynwrapx.dll to disk to be able to use DynamicWrapperX Object to inject or execute the actual payload.”
• [T1059.001] PowerShell – Additional PowerShell-based loaders operate on hex-to-binary conversion to load the AsyncRAT via .NET reflection. Quote: “Another instance we found was an obfuscated PowerShell script… convert a large hex string to binary bytes which is the .NET compiled AsyncRAT…”