asyncrat | c208e1ec65a3bbfa95c6afc65532d2aeacf5a32baf4904853fee56f8b827e020

General

Target
bash.exe
Size 437KB
Sample201005-jnamtkz2n2
SHA256 c208e1ec65a3bbfa95c6afc65532d2aeacf5a32baf4904853fee56f8b827e020
MD5 6d27ac6f92afb382bcb38a9f2b1315ae
SHA1 34b02a543a0147a245861c0b9df756e81561fd70
SHA512 38b029ac5906bb99a96dc1458732a37c91a119d39c43aff37d85ab157e41b51349cd38a11ddfa2d3aa07c6f84c210e1ac51243101689882a029683569aca9ea0
MD5 SHA1 SHA512

Score

10^/10

asyncrat rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

C2

hiveys.duckdns.org:6606
hiveys.duckdns.org:7707
hiveys.duckdns.org:8808
hiveys.duckdns.org:9909

Mutex

AsyncMutex_6SI8OkPnk

Attributes

aes_key
1NRde4PpcUsLOjuj9rUGJvoz4rtCeAM9
anti_detection
false
autorun
false
bdos
false
delay
Default
host
hiveys.duckdns.org
hwid
3
install_file
install_folder
%AppData%
mutex
AsyncMutex_6SI8OkPnk
pastebin_config
null
port
6606,7707,8808,9909
version
0.5.7B

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
rat asyncrat

Async RAT payload 2 IoCs

rat

resource	yara_rule
behavioral2/memory/1860-23-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat
behavioral2/memory/1860-24-0x000000000040D0BE-mapping.dmp	asyncrat

Executes dropped EXE 1 IoCs

pid	Process
2692	svchst.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchst.lnk	svchst.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2692 set thread context of 1860	2692	svchst.exe	81

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2692	svchst.exe
2692	svchst.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2600	bash.exe
Token: SeDebugPrivilege	2692	svchst.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 2600 wrote to memory of 1740	2600	bash.exe	76
PID 2600 wrote to memory of 1740	2600	bash.exe	76
PID 2600 wrote to memory of 1740	2600	bash.exe	76
PID 2600 wrote to memory of 2408	2600	bash.exe	78
PID 2600 wrote to memory of 2408	2600	bash.exe	78
PID 2600 wrote to memory of 2408	2600	bash.exe	78
PID 2408 wrote to memory of 2692	2408	cmd.exe	80
PID 2408 wrote to memory of 2692	2408	cmd.exe	80
PID 2408 wrote to memory of 2692	2408	cmd.exe	80
PID 2692 wrote to memory of 1860	2692	svchst.exe	81
PID 2692 wrote to memory of 1860	2692	svchst.exe	81
PID 2692 wrote to memory of 1860	2692	svchst.exe	81
PID 2692 wrote to memory of 1860	2692	svchst.exe	81
PID 2692 wrote to memory of 1860	2692	svchst.exe	81
PID 2692 wrote to memory of 1860	2692	svchst.exe	81
PID 2692 wrote to memory of 1860	2692	svchst.exe	81
PID 2692 wrote to memory of 1860	2692	svchst.exe	81

C:\Users\Admin\AppData\Local\Temp\bash.exe
"C:\Users\Admin\AppData\Local\Temp\bash.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2600
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\bash.exe" "C:\Users\Admin\AppData\Roaming\svchst.exe"
  2⤵
  PID:1740
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c, "C:\Users\Admin\AppData\Roaming\svchst.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2408
- - C:\Users\Admin\AppData\Roaming\svchst.exe
    "C:\Users\Admin\AppData\Roaming\svchst.exe"
    3⤵
    - Executes dropped EXE
    - Drops startup file
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2692
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
      4⤵
      PID:1860

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1860-25-0x0000000073630000-0x0000000073D1E000-memory.dmp

Download

memory/1860-23-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/2600-5-0x0000000007B70000-0x0000000007B8F000-memory.dmp

Download

memory/2600-7-0x0000000009EB0000-0x0000000009EB1000-memory.dmp

Download

memory/2600-6-0x000000000A2D0000-0x000000000A2D1000-memory.dmp

Download

memory/2600-0-0x0000000073630000-0x0000000073D1E000-memory.dmp

Download

memory/2600-4-0x0000000002900000-0x000000000291F000-memory.dmp

Download

memory/2600-3-0x0000000004EF0000-0x0000000004EF1000-memory.dmp

Download

memory/2600-1-0x0000000000500000-0x0000000000501000-memory.dmp

Download

memory/2692-13-0x0000000073630000-0x0000000073D1E000-memory.dmp

Download

memory/2692-21-0x0000000004E70000-0x0000000004E7A000-memory.dmp

Download

memory/2692-22-0x0000000005330000-0x0000000005331000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads