asyncrat | c208e1ec65a3bbfa95c6afc65532d2aeacf5a32baf4904853fee56f8b827e020

General

Target
bash.exe
Size 437KB
Sample201005-jnamtkz2n2
SHA256 c208e1ec65a3bbfa95c6afc65532d2aeacf5a32baf4904853fee56f8b827e020
MD5 6d27ac6f92afb382bcb38a9f2b1315ae
SHA1 34b02a543a0147a245861c0b9df756e81561fd70
SHA512 38b029ac5906bb99a96dc1458732a37c91a119d39c43aff37d85ab157e41b51349cd38a11ddfa2d3aa07c6f84c210e1ac51243101689882a029683569aca9ea0
MD5 SHA1 SHA512

Score

10^/10

asyncrat rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

C2

hiveys.duckdns.org:6606
hiveys.duckdns.org:7707
hiveys.duckdns.org:8808
hiveys.duckdns.org:9909

Mutex

AsyncMutex_6SI8OkPnk

Attributes

aes_key
1NRde4PpcUsLOjuj9rUGJvoz4rtCeAM9
anti_detection
false
autorun
false
bdos
false
delay
Default
host
hiveys.duckdns.org
hwid
3
install_file
install_folder
%AppData%
mutex
AsyncMutex_6SI8OkPnk
pastebin_config
null
port
6606,7707,8808,9909
version
0.5.7B

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
rat asyncrat

Async RAT payload 3 IoCs

rat

resource	yara_rule
behavioral1/memory/820-41-0x000000000040D0BE-mapping.dmp	asyncrat
behavioral1/memory/820-42-0x0000000000090000-0x00000000000A2000-memory.dmp	asyncrat
behavioral1/memory/820-43-0x0000000000090000-0x00000000000A2000-memory.dmp	asyncrat

Executes dropped EXE 1 IoCs

pid	Process
2004	svchst.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchst.lnk	svchst.exe

Loads dropped DLL 2 IoCs

pid	Process
1936	cmd.exe
2004	svchst.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2004 set thread context of 820	2004	svchst.exe	33

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2004	svchst.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1436	bash.exe
Token: SeDebugPrivilege	2004	svchst.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 1436 wrote to memory of 1564	1436	bash.exe	28
PID 1436 wrote to memory of 1564	1436	bash.exe	28
PID 1436 wrote to memory of 1564	1436	bash.exe	28
PID 1436 wrote to memory of 1564	1436	bash.exe	28
PID 1436 wrote to memory of 1936	1436	bash.exe	30
PID 1436 wrote to memory of 1936	1436	bash.exe	30
PID 1436 wrote to memory of 1936	1436	bash.exe	30
PID 1436 wrote to memory of 1936	1436	bash.exe	30
PID 1936 wrote to memory of 2004	1936	cmd.exe	32
PID 1936 wrote to memory of 2004	1936	cmd.exe	32
PID 1936 wrote to memory of 2004	1936	cmd.exe	32
PID 1936 wrote to memory of 2004	1936	cmd.exe	32
PID 2004 wrote to memory of 820	2004	svchst.exe	33
PID 2004 wrote to memory of 820	2004	svchst.exe	33
PID 2004 wrote to memory of 820	2004	svchst.exe	33
PID 2004 wrote to memory of 820	2004	svchst.exe	33
PID 2004 wrote to memory of 820	2004	svchst.exe	33
PID 2004 wrote to memory of 820	2004	svchst.exe	33
PID 2004 wrote to memory of 820	2004	svchst.exe	33
PID 2004 wrote to memory of 820	2004	svchst.exe	33
PID 2004 wrote to memory of 820	2004	svchst.exe	33
PID 2004 wrote to memory of 820	2004	svchst.exe	33
PID 2004 wrote to memory of 820	2004	svchst.exe	33
PID 2004 wrote to memory of 820	2004	svchst.exe	33

C:\Users\Admin\AppData\Local\Temp\bash.exe
"C:\Users\Admin\AppData\Local\Temp\bash.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1436
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\bash.exe" "C:\Users\Admin\AppData\Roaming\svchst.exe"
  2⤵
  PID:1564
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c, "C:\Users\Admin\AppData\Roaming\svchst.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1936
- - C:\Users\Admin\AppData\Roaming\svchst.exe
    "C:\Users\Admin\AppData\Roaming\svchst.exe"
    3⤵
    - Executes dropped EXE
    - Drops startup file
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2004
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
      4⤵
      PID:820

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/820-45-0x0000000000090000-0x0000000000092000-memory.dmp

Download

memory/820-44-0x0000000074820000-0x0000000074F0E000-memory.dmp

Download

memory/820-43-0x0000000000090000-0x00000000000A2000-memory.dmp

Download

memory/820-42-0x0000000000090000-0x00000000000A2000-memory.dmp

Download

memory/1436-0-0x0000000074820000-0x0000000074F0E000-memory.dmp

Download

memory/1436-4-0x0000000000730000-0x000000000074F000-memory.dmp

Download

memory/1436-3-0x00000000004B0000-0x00000000004CF000-memory.dmp

Download

memory/1436-1-0x00000000002B0000-0x00000000002B1000-memory.dmp

Download

memory/2004-36-0x0000000000640000-0x000000000064A000-memory.dmp

Download

memory/2004-14-0x0000000000BD0000-0x0000000000BD1000-memory.dmp

Download

memory/2004-13-0x0000000074820000-0x0000000074F0E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads