asyncrat | bade3d7ef0b9a41875bf73ae0c390e015ba88d4245c40af4dc8ec9358fcaf022

General

Target

PO# 329UUV11772020,pdf.scr
Size

388KB
MD5

63389d983d9437251db5a2eaaa37a162
SHA1

6eadc7d0b7a0802e936369917b10828cff6f0edb
SHA256

bade3d7ef0b9a41875bf73ae0c390e015ba88d4245c40af4dc8ec9358fcaf022
SHA512

b6c71135bd586e383afd3bbca5addf388dcc7a1822f25c77796aba26b8900585b1dc32f7a1b9fd3923e9e7026a75f5f713e5f7ac8d1976ecafa22de6e5590f58

Score

10^/10

asyncrat persistence rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

C2

206.123.129.103:5456

Mutex

AsyncMutex_6SI8OkPnk

Attributes

aes_key
ryZCn1ygjcLoNCnkQ835nGRczqsX5iGY
anti_detection
false
autorun
false
bdos
false
delay
Default
host
206.123.129.103
hwid
3
install_file
install_folder
%AppData%
mutex
AsyncMutex_6SI8OkPnk
pastebin_config
null
port
5456
version
0.5.7B

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
rat asyncrat

Async RAT payload 7 IoCs

rat

resource	yara_rule
behavioral1/files/0x00040000000131a8-5.dat	asyncrat
behavioral1/files/0x00040000000131a8-7.dat	asyncrat
behavioral1/files/0x00040000000131a8-8.dat	asyncrat
behavioral1/memory/1884-14-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat
behavioral1/memory/1884-15-0x000000000040C72E-mapping.dmp	asyncrat
behavioral1/memory/1884-17-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat
behavioral1/memory/1884-18-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat

Executes dropped EXE 2 IoCs

pid	Process
1816	Registry.exe
1884	InstallUtil.exe

Loads dropped DLL 2 IoCs

pid	Process
1196	PO# 329UUV11772020,pdf.scr
1816	Registry.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\Registry = "C:\\Windows\\system32\\pcalua.exe -a C:\\Users\\Admin\\Music\\Registry.exe"	reg.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1816 set thread context of 1884	1816	Registry.exe	30

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1196	PO# 329UUV11772020,pdf.scr
1196	PO# 329UUV11772020,pdf.scr
1196	PO# 329UUV11772020,pdf.scr
1816	Registry.exe
1816	Registry.exe
1816	Registry.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1196	PO# 329UUV11772020,pdf.scr
Token: SeDebugPrivilege	1816	Registry.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 1196 wrote to memory of 908	1196	PO# 329UUV11772020,pdf.scr	24
PID 1196 wrote to memory of 908	1196	PO# 329UUV11772020,pdf.scr	24
PID 1196 wrote to memory of 908	1196	PO# 329UUV11772020,pdf.scr	24
PID 1196 wrote to memory of 908	1196	PO# 329UUV11772020,pdf.scr	24
PID 908 wrote to memory of 540	908	cmd.exe	26
PID 908 wrote to memory of 540	908	cmd.exe	26
PID 908 wrote to memory of 540	908	cmd.exe	26
PID 908 wrote to memory of 540	908	cmd.exe	26
PID 1196 wrote to memory of 1816	1196	PO# 329UUV11772020,pdf.scr	27
PID 1196 wrote to memory of 1816	1196	PO# 329UUV11772020,pdf.scr	27
PID 1196 wrote to memory of 1816	1196	PO# 329UUV11772020,pdf.scr	27
PID 1196 wrote to memory of 1816	1196	PO# 329UUV11772020,pdf.scr	27
PID 1816 wrote to memory of 1884	1816	Registry.exe	30
PID 1816 wrote to memory of 1884	1816	Registry.exe	30
PID 1816 wrote to memory of 1884	1816	Registry.exe	30
PID 1816 wrote to memory of 1884	1816	Registry.exe	30
PID 1816 wrote to memory of 1884	1816	Registry.exe	30
PID 1816 wrote to memory of 1884	1816	Registry.exe	30
PID 1816 wrote to memory of 1884	1816	Registry.exe	30
PID 1816 wrote to memory of 1884	1816	Registry.exe	30
PID 1816 wrote to memory of 1884	1816	Registry.exe	30
PID 1816 wrote to memory of 1884	1816	Registry.exe	30
PID 1816 wrote to memory of 1884	1816	Registry.exe	30
PID 1816 wrote to memory of 1884	1816	Registry.exe	30

C:\Users\Admin\AppData\Local\Temp\PO# 329UUV11772020,pdf.scr
"C:\Users\Admin\AppData\Local\Temp\PO# 329UUV11772020,pdf.scr" /S
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1196
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v Registry /t REG_SZ /d C:\Windows\system32\pcalua.exe" -a C:\Users\Admin\Music\Registry.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:908
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v Registry /t REG_SZ /d C:\Windows\system32\pcalua.exe" -a C:\Users\Admin\Music\Registry.exe"
    3⤵
    - Adds Run key to start application
    PID:540
- C:\Users\Admin\Music\Registry.exe
  "C:\Users\Admin\Music\Registry.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1816
- - C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe
    "C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe"
    3⤵
    - Executes dropped EXE
    PID:1884

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1884-14-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1884-17-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1884-18-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download

Analysis

Sharing