asyncrat | 8be860472e72eae45034f553b53dc883fa99292a2b54ef2a57614fcf8e600790

General

Target

FA2020.06.85569.DOCX.exe
Size

188KB
MD5

2698aef990026c034352cc9e5b6fb4f8
SHA1

29b12cb2e71ed287a1e4bdcab3b22ff500f74392
SHA256

8be860472e72eae45034f553b53dc883fa99292a2b54ef2a57614fcf8e600790
SHA512

f210c00727df295705facfd7f107ead737b1f77f55776916d8acb9d6b884333d29332a7b186b0ef27f02d9795bf81a4dc4f00c7edc9bb66164a70a88a5f60a6c

Score

10^/10

asyncrat persistence rat spyware

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

C2

null:null

Mutex

AsyncMutex_6SI8OkPnk

Attributes

aes_key
DHyXENUbuF7kz7qg9whtglVdx8ChMDvS
anti_detection
false
autorun
false
bdos
false
delay
Default
host
null
hwid
3
install_file
install_folder
%AppData%
mutex
AsyncMutex_6SI8OkPnk
pastebin_config
https://pastebin.com/raw/63NgqBcT
port
null
version
0.5.7B

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
rat asyncrat

Async RAT payload 4 IoCs

rat

resource	yara_rule
behavioral1/memory/1612-14-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat
behavioral1/memory/1612-15-0x000000000040D0BE-mapping.dmp	asyncrat
behavioral1/memory/1612-17-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat
behavioral1/memory/1612-18-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat

Executes dropped EXE 2 IoCs

pid	Process
1688	sgvu.exe
1612	InstallUtil.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sgvu.exe	FA2020.06.85569.DOCX.exe

Loads dropped DLL 2 IoCs

pid	Process
1456	FA2020.06.85569.DOCX.exe
1688	sgvu.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\sgvu.exe = "C:\\Windows\\system32\\pcalua.exe -a C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\sgvu.exe"	reg.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1688 set thread context of 1612	1688	sgvu.exe	30

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1456	FA2020.06.85569.DOCX.exe
1456	FA2020.06.85569.DOCX.exe
1456	FA2020.06.85569.DOCX.exe
1688	sgvu.exe
1688	sgvu.exe
1688	sgvu.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1456	FA2020.06.85569.DOCX.exe
Token: SeDebugPrivilege	1688	sgvu.exe
Token: SeDebugPrivilege	1612	InstallUtil.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 1456 wrote to memory of 788	1456	FA2020.06.85569.DOCX.exe	24
PID 1456 wrote to memory of 788	1456	FA2020.06.85569.DOCX.exe	24
PID 1456 wrote to memory of 788	1456	FA2020.06.85569.DOCX.exe	24
PID 1456 wrote to memory of 788	1456	FA2020.06.85569.DOCX.exe	24
PID 788 wrote to memory of 1032	788	cmd.exe	26
PID 788 wrote to memory of 1032	788	cmd.exe	26
PID 788 wrote to memory of 1032	788	cmd.exe	26
PID 788 wrote to memory of 1032	788	cmd.exe	26
PID 1456 wrote to memory of 1688	1456	FA2020.06.85569.DOCX.exe	27
PID 1456 wrote to memory of 1688	1456	FA2020.06.85569.DOCX.exe	27
PID 1456 wrote to memory of 1688	1456	FA2020.06.85569.DOCX.exe	27
PID 1456 wrote to memory of 1688	1456	FA2020.06.85569.DOCX.exe	27
PID 1688 wrote to memory of 1612	1688	sgvu.exe	30
PID 1688 wrote to memory of 1612	1688	sgvu.exe	30
PID 1688 wrote to memory of 1612	1688	sgvu.exe	30
PID 1688 wrote to memory of 1612	1688	sgvu.exe	30
PID 1688 wrote to memory of 1612	1688	sgvu.exe	30
PID 1688 wrote to memory of 1612	1688	sgvu.exe	30
PID 1688 wrote to memory of 1612	1688	sgvu.exe	30
PID 1688 wrote to memory of 1612	1688	sgvu.exe	30
PID 1688 wrote to memory of 1612	1688	sgvu.exe	30
PID 1688 wrote to memory of 1612	1688	sgvu.exe	30
PID 1688 wrote to memory of 1612	1688	sgvu.exe	30
PID 1688 wrote to memory of 1612	1688	sgvu.exe	30

C:\Users\Admin\AppData\Local\Temp\FA2020.06.85569.DOCX.exe
"C:\Users\Admin\AppData\Local\Temp\FA2020.06.85569.DOCX.exe"
1⤵
- Drops startup file
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1456
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v sgvu.exe /t REG_SZ /d C:\Windows\system32\pcalua.exe" -a C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sgvu.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:788
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v sgvu.exe /t REG_SZ /d C:\Windows\system32\pcalua.exe" -a C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sgvu.exe"
    3⤵
    - Adds Run key to start application
    PID:1032
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sgvu.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sgvu.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1688
- - C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe
    "C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:1612

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

Web Service

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1612-14-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1612-17-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1612-18-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download

Analysis

Sharing