asyncrat | d7448da27fa5cbe7df2df781ef5763cdcbb31f6e99d756a03fb1ff577e7043a2

Analysis

max time kernel
149s
max time network
151s
platform
windows7_x64
resource
win7v200722
submitted
12/10/2020, 06:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Transaksi_0936787812728921.pdf.exe
Size 3.8MB
Sample201012-sys4lnhwq2
SHA256 d7448da27fa5cbe7df2df781ef5763cdcbb31f6e99d756a03fb1ff577e7043a2
MD5 1e3bc8b421bce427b81de5ecfb182a1a
SHA1 6b4bfd551ee0bf1268432cb01e2ce8f8b7b5b905
SHA512 4a63a926e8c3a0cb0cc499a95248ede45aa4f9fa1b8ffd530e14f3b20ecc8e01627feaa3694d0b34336539fd0b2f7aa72ef156a1926ec28f14b3509198fec6aa
MD5 SHA1 SHA512

Score

10^/10

rat asyncrat spyware

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

185.244.30.121:7882

Mutex

AsyncMutex_6SI8OkPnk

Attributes

aes_key
7waMnQU7XKn0KiCxCoUXlyImOaz9FZeu
anti_detection
false
autorun
false
bdos
false
delay
Default
host
185.244.30.121
hwid
3
install_file
install_folder
%AppData%
mutex
AsyncMutex_6SI8OkPnk
pastebin_config
null
port
7882
version
0.5.7B

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
rat asyncrat

Async RAT payload 3 IoCs

rat

resource	yara_rule
behavioral1/memory/972-321-0x000000000040C70E-mapping.dmp	asyncrat
behavioral1/memory/972-322-0x0000000000090000-0x00000000000A2000-memory.dmp	asyncrat
behavioral1/memory/972-323-0x0000000000090000-0x00000000000A2000-memory.dmp	asyncrat

Executes dropped EXE 4 IoCs

pid	Process
1604	my pic002.exe
1108	msg01.exe
572	A.exe
1660	B.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\msg01.lnk	msg01.exe

Loads dropped DLL 7 IoCs

pid	Process
1372	cmd.exe
696	cmd.exe
1452	cmd.exe
1452	cmd.exe
1108	msg01.exe
1644	cmd.exe
1644	cmd.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1604 set thread context of 1652	1604	my pic002.exe	34
PID 1108 set thread context of 972	1108	msg01.exe	43

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\msg01.exe	cmd.exe
File opened for modification	C:\Program Files (x86)\msg01.exe	cmd.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
1296	Transaksi_0936787812728921.pdf.exe
1604	my pic002.exe
572	A.exe
1108	msg01.exe
572	A.exe
1108	msg01.exe
1108	msg01.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1296	Transaksi_0936787812728921.pdf.exe
Token: SeDebugPrivilege	1604	my pic002.exe
Token: SeDebugPrivilege	1108	msg01.exe

Suspicious use of WriteProcessMemory 59 IoCs

description	pid	Process	procid_target
PID 1296 wrote to memory of 1372	1296	Transaksi_0936787812728921.pdf.exe	28
PID 1296 wrote to memory of 1372	1296	Transaksi_0936787812728921.pdf.exe	28
PID 1296 wrote to memory of 1372	1296	Transaksi_0936787812728921.pdf.exe	28
PID 1296 wrote to memory of 1372	1296	Transaksi_0936787812728921.pdf.exe	28
PID 1372 wrote to memory of 1604	1372	cmd.exe	30
PID 1372 wrote to memory of 1604	1372	cmd.exe	30
PID 1372 wrote to memory of 1604	1372	cmd.exe	30
PID 1372 wrote to memory of 1604	1372	cmd.exe	30
PID 1296 wrote to memory of 1236	1296	Transaksi_0936787812728921.pdf.exe	32
PID 1296 wrote to memory of 1236	1296	Transaksi_0936787812728921.pdf.exe	32
PID 1296 wrote to memory of 1236	1296	Transaksi_0936787812728921.pdf.exe	32
PID 1296 wrote to memory of 1236	1296	Transaksi_0936787812728921.pdf.exe	32
PID 1604 wrote to memory of 1652	1604	my pic002.exe	34
PID 1604 wrote to memory of 1652	1604	my pic002.exe	34
PID 1604 wrote to memory of 1652	1604	my pic002.exe	34
PID 1604 wrote to memory of 1652	1604	my pic002.exe	34
PID 1604 wrote to memory of 1652	1604	my pic002.exe	34
PID 1604 wrote to memory of 1652	1604	my pic002.exe	34
PID 1604 wrote to memory of 1652	1604	my pic002.exe	34
PID 1604 wrote to memory of 1652	1604	my pic002.exe	34
PID 1604 wrote to memory of 1652	1604	my pic002.exe	34
PID 1604 wrote to memory of 1652	1604	my pic002.exe	34
PID 1604 wrote to memory of 1652	1604	my pic002.exe	34
PID 1296 wrote to memory of 696	1296	Transaksi_0936787812728921.pdf.exe	36
PID 1296 wrote to memory of 696	1296	Transaksi_0936787812728921.pdf.exe	36
PID 1296 wrote to memory of 696	1296	Transaksi_0936787812728921.pdf.exe	36
PID 1296 wrote to memory of 696	1296	Transaksi_0936787812728921.pdf.exe	36
PID 696 wrote to memory of 1108	696	cmd.exe	38
PID 696 wrote to memory of 1108	696	cmd.exe	38
PID 696 wrote to memory of 1108	696	cmd.exe	38
PID 696 wrote to memory of 1108	696	cmd.exe	38
PID 1652 wrote to memory of 1452	1652	mscorsvw.exe	40
PID 1652 wrote to memory of 1452	1652	mscorsvw.exe	40
PID 1652 wrote to memory of 1452	1652	mscorsvw.exe	40
PID 1652 wrote to memory of 1452	1652	mscorsvw.exe	40
PID 1452 wrote to memory of 572	1452	cmd.exe	42
PID 1452 wrote to memory of 572	1452	cmd.exe	42
PID 1452 wrote to memory of 572	1452	cmd.exe	42
PID 1452 wrote to memory of 572	1452	cmd.exe	42
PID 1108 wrote to memory of 972	1108	msg01.exe	43
PID 1108 wrote to memory of 972	1108	msg01.exe	43
PID 1108 wrote to memory of 972	1108	msg01.exe	43
PID 1108 wrote to memory of 972	1108	msg01.exe	43
PID 1108 wrote to memory of 972	1108	msg01.exe	43
PID 1108 wrote to memory of 972	1108	msg01.exe	43
PID 1108 wrote to memory of 972	1108	msg01.exe	43
PID 1108 wrote to memory of 972	1108	msg01.exe	43
PID 1108 wrote to memory of 972	1108	msg01.exe	43
PID 1108 wrote to memory of 972	1108	msg01.exe	43
PID 1108 wrote to memory of 972	1108	msg01.exe	43
PID 1108 wrote to memory of 972	1108	msg01.exe	43
PID 1652 wrote to memory of 1644	1652	mscorsvw.exe	44
PID 1652 wrote to memory of 1644	1652	mscorsvw.exe	44
PID 1652 wrote to memory of 1644	1652	mscorsvw.exe	44
PID 1652 wrote to memory of 1644	1652	mscorsvw.exe	44
PID 1644 wrote to memory of 1660	1644	cmd.exe	46
PID 1644 wrote to memory of 1660	1644	cmd.exe	46
PID 1644 wrote to memory of 1660	1644	cmd.exe	46
PID 1644 wrote to memory of 1660	1644	cmd.exe	46

C:\Users\Admin\AppData\Local\Temp\Transaksi_0936787812728921.pdf.exe
"C:\Users\Admin\AppData\Local\Temp\Transaksi_0936787812728921.pdf.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1296
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c, "C:\Users\Admin\Pictures\my pic002.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1372
- - C:\Users\Admin\Pictures\my pic002.exe
    "C:\Users\Admin\Pictures\my pic002.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1604
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1652
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c A.exe /stext A.txt
        5⤵
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:1452
      - C:\Users\Admin\AppData\Local\Temp\A.exe
        
        A.exe /stext A.txt
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:572
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c B.exe /stext B.txt
        5⤵
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:1644
      - C:\Users\Admin\AppData\Local\Temp\B.exe
        
        B.exe /stext B.txt
        6⤵
        Executes dropped EXE
        
        PID:1660
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\Transaksi_0936787812728921.pdf.exe" "C:\Program Files (x86)\msg01.exe"
  2⤵
  - Drops file in Program Files directory
  PID:1236
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c, "C:\Program Files (x86)\msg01.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:696
- - C:\Program Files (x86)\msg01.exe
    "C:\Program Files (x86)\msg01.exe"
    3⤵
    - Executes dropped EXE
    - Drops startup file
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1108
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
      4⤵
      PID:972

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/972-323-0x0000000000090000-0x00000000000A2000-memory.dmp

Download

memory/972-324-0x00000000739F0000-0x00000000740DE000-memory.dmp

Download

memory/972-325-0x0000000000090000-0x0000000000092000-memory.dmp

Download

memory/972-322-0x0000000000090000-0x00000000000A2000-memory.dmp

Download

memory/1108-300-0x0000000000930000-0x0000000000931000-memory.dmp

Download

memory/1108-299-0x00000000739F0000-0x00000000740DE000-memory.dmp

Download

memory/1168-291-0x000007FEF70C0000-0x000007FEF733A000-memory.dmp

Download

memory/1296-4-0x0000000000490000-0x00000000004AF000-memory.dmp

Download

memory/1296-3-0x0000000000330000-0x0000000000347000-memory.dmp

Download

memory/1296-0-0x0000000074670000-0x0000000074D5E000-memory.dmp

Download

memory/1296-7-0x00000000006A0000-0x00000000006A6000-memory.dmp

Download

memory/1296-1-0x0000000001290000-0x0000000001291000-memory.dmp

Download

memory/1604-49-0x0000000000450000-0x0000000000460000-memory.dmp

Download

memory/1604-123-0x0000000000450000-0x0000000000460000-memory.dmp

Download

memory/1604-12-0x0000000074670000-0x0000000074D5E000-memory.dmp

Download

memory/1604-287-0x0000000000450000-0x000000000045A000-memory.dmp

Download

memory/1604-279-0x0000000000450000-0x0000000000460000-memory.dmp

Download

memory/1604-278-0x0000000000450000-0x0000000000460000-memory.dmp

Download

memory/1604-235-0x0000000000450000-0x0000000000460000-memory.dmp

Download

memory/1604-233-0x0000000000450000-0x0000000000460000-memory.dmp

Download

memory/1604-144-0x0000000000450000-0x0000000000460000-memory.dmp

Download

memory/1604-143-0x0000000000450000-0x0000000000460000-memory.dmp

Download

memory/1604-13-0x00000000011D0000-0x00000000011D1000-memory.dmp

Download

memory/1604-118-0x0000000000450000-0x0000000000460000-memory.dmp

Download

memory/1604-47-0x0000000000450000-0x0000000000460000-memory.dmp

Download

memory/1604-117-0x0000000000450000-0x0000000000460000-memory.dmp

Download

memory/1604-74-0x0000000000450000-0x0000000000460000-memory.dmp

Download

memory/1604-73-0x0000000000450000-0x0000000000460000-memory.dmp

Download

memory/1604-48-0x0000000000450000-0x0000000000460000-memory.dmp

Download

memory/1604-50-0x0000000000450000-0x0000000000460000-memory.dmp

Download

memory/1652-290-0x0000000000400000-0x00000000004E1000-memory.dmp

Download

memory/1652-288-0x0000000000400000-0x00000000004E1000-memory.dmp

Download