asyncrat | d7448da27fa5cbe7df2df781ef5763cdcbb31f6e99d756a03fb1ff577e7043a2

Analysis

max time kernel
148s
max time network
152s
platform
windows10_x64
resource
win10v200722
submitted
12/10/2020, 06:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Transaksi_0936787812728921.pdf.exe
Size 3.8MB
Sample201012-sys4lnhwq2
SHA256 d7448da27fa5cbe7df2df781ef5763cdcbb31f6e99d756a03fb1ff577e7043a2
MD5 1e3bc8b421bce427b81de5ecfb182a1a
SHA1 6b4bfd551ee0bf1268432cb01e2ce8f8b7b5b905
SHA512 4a63a926e8c3a0cb0cc499a95248ede45aa4f9fa1b8ffd530e14f3b20ecc8e01627feaa3694d0b34336539fd0b2f7aa72ef156a1926ec28f14b3509198fec6aa
MD5 SHA1 SHA512

Score

10^/10

rat spyware asyncrat

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

185.244.30.121:7882

Mutex

AsyncMutex_6SI8OkPnk

Attributes

aes_key
7waMnQU7XKn0KiCxCoUXlyImOaz9FZeu
anti_detection
false
autorun
false
bdos
false
delay
Default
host
185.244.30.121
hwid
3
install_file
install_folder
%AppData%
mutex
AsyncMutex_6SI8OkPnk
pastebin_config
null
port
7882
version
0.5.7B

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
rat asyncrat

Async RAT payload 2 IoCs

rat

resource	yara_rule
behavioral2/memory/384-290-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat
behavioral2/memory/384-291-0x000000000040C70E-mapping.dmp	asyncrat

Executes dropped EXE 4 IoCs

pid	Process
1820	my pic002.exe
1516	A.exe
188	msg01.exe
2904	B.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\msg01.lnk	msg01.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1820 set thread context of 3372	1820	my pic002.exe	79
PID 188 set thread context of 384	188	msg01.exe	91

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\msg01.exe	cmd.exe
File opened for modification	C:\Program Files (x86)\msg01.exe	cmd.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
1820	my pic002.exe
964	Transaksi_0936787812728921.pdf.exe
1516	A.exe
1516	A.exe
1516	A.exe
1516	A.exe
188	msg01.exe
188	msg01.exe
188	msg01.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	964	Transaksi_0936787812728921.pdf.exe
Token: SeDebugPrivilege	1820	my pic002.exe
Token: SeDebugPrivilege	188	msg01.exe

Suspicious use of WriteProcessMemory 45 IoCs

description	pid	Process	procid_target
PID 964 wrote to memory of 1500	964	Transaksi_0936787812728921.pdf.exe	72
PID 964 wrote to memory of 1500	964	Transaksi_0936787812728921.pdf.exe	72
PID 964 wrote to memory of 1500	964	Transaksi_0936787812728921.pdf.exe	72
PID 1500 wrote to memory of 1820	1500	cmd.exe	74
PID 1500 wrote to memory of 1820	1500	cmd.exe	74
PID 1500 wrote to memory of 1820	1500	cmd.exe	74
PID 1820 wrote to memory of 3372	1820	my pic002.exe	79
PID 1820 wrote to memory of 3372	1820	my pic002.exe	79
PID 1820 wrote to memory of 3372	1820	my pic002.exe	79
PID 1820 wrote to memory of 3372	1820	my pic002.exe	79
PID 1820 wrote to memory of 3372	1820	my pic002.exe	79
PID 1820 wrote to memory of 3372	1820	my pic002.exe	79
PID 1820 wrote to memory of 3372	1820	my pic002.exe	79
PID 1820 wrote to memory of 3372	1820	my pic002.exe	79
PID 1820 wrote to memory of 3372	1820	my pic002.exe	79
PID 1820 wrote to memory of 3372	1820	my pic002.exe	79
PID 964 wrote to memory of 1712	964	Transaksi_0936787812728921.pdf.exe	80
PID 964 wrote to memory of 1712	964	Transaksi_0936787812728921.pdf.exe	80
PID 964 wrote to memory of 1712	964	Transaksi_0936787812728921.pdf.exe	80
PID 3372 wrote to memory of 752	3372	mscorsvw.exe	82
PID 3372 wrote to memory of 752	3372	mscorsvw.exe	82
PID 3372 wrote to memory of 752	3372	mscorsvw.exe	82
PID 752 wrote to memory of 1516	752	cmd.exe	84
PID 752 wrote to memory of 1516	752	cmd.exe	84
PID 752 wrote to memory of 1516	752	cmd.exe	84
PID 964 wrote to memory of 2276	964	Transaksi_0936787812728921.pdf.exe	85
PID 964 wrote to memory of 2276	964	Transaksi_0936787812728921.pdf.exe	85
PID 964 wrote to memory of 2276	964	Transaksi_0936787812728921.pdf.exe	85
PID 2276 wrote to memory of 188	2276	cmd.exe	87
PID 2276 wrote to memory of 188	2276	cmd.exe	87
PID 2276 wrote to memory of 188	2276	cmd.exe	87
PID 3372 wrote to memory of 3916	3372	mscorsvw.exe	88
PID 3372 wrote to memory of 3916	3372	mscorsvw.exe	88
PID 3372 wrote to memory of 3916	3372	mscorsvw.exe	88
PID 3916 wrote to memory of 2904	3916	cmd.exe	90
PID 3916 wrote to memory of 2904	3916	cmd.exe	90
PID 3916 wrote to memory of 2904	3916	cmd.exe	90
PID 188 wrote to memory of 384	188	msg01.exe	91
PID 188 wrote to memory of 384	188	msg01.exe	91
PID 188 wrote to memory of 384	188	msg01.exe	91
PID 188 wrote to memory of 384	188	msg01.exe	91
PID 188 wrote to memory of 384	188	msg01.exe	91
PID 188 wrote to memory of 384	188	msg01.exe	91
PID 188 wrote to memory of 384	188	msg01.exe	91
PID 188 wrote to memory of 384	188	msg01.exe	91

C:\Users\Admin\AppData\Local\Temp\Transaksi_0936787812728921.pdf.exe
"C:\Users\Admin\AppData\Local\Temp\Transaksi_0936787812728921.pdf.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:964
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c, "C:\Users\Admin\Pictures\my pic002.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1500
- - C:\Users\Admin\Pictures\my pic002.exe
    "C:\Users\Admin\Pictures\my pic002.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1820
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3372
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c A.exe /stext A.txt
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:752
      - C:\Users\Admin\AppData\Local\Temp\A.exe
        
        A.exe /stext A.txt
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:1516
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c B.exe /stext B.txt
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3916
      - C:\Users\Admin\AppData\Local\Temp\B.exe
        
        B.exe /stext B.txt
        6⤵
        Executes dropped EXE
        
        PID:2904
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\Transaksi_0936787812728921.pdf.exe" "C:\Program Files (x86)\msg01.exe"
  2⤵
  - Drops file in Program Files directory
  PID:1712
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c, "C:\Program Files (x86)\msg01.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2276
- - C:\Program Files (x86)\msg01.exe
    "C:\Program Files (x86)\msg01.exe"
    3⤵
    - Executes dropped EXE
    - Drops startup file
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:188
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
      4⤵
      PID:384

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/188-273-0x00000000732A0000-0x000000007398E000-memory.dmp

Download

memory/384-292-0x00000000732A0000-0x000000007398E000-memory.dmp

Download

memory/384-290-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/964-5-0x0000000005630000-0x000000000564F000-memory.dmp

Download

memory/964-1-0x0000000000A90000-0x0000000000A91000-memory.dmp

Download

memory/964-32-0x00000000058D0000-0x00000000058D2000-memory.dmp

Download

memory/964-42-0x00000000058D0000-0x00000000058D2000-memory.dmp

Download

memory/964-146-0x00000000058D0000-0x00000000058D2000-memory.dmp

Download

memory/964-224-0x00000000058D0000-0x00000000058D2000-memory.dmp

Download

memory/964-10-0x00000000073F0000-0x00000000073F1000-memory.dmp

Download

memory/964-9-0x0000000007370000-0x0000000007376000-memory.dmp

Download

memory/964-26-0x00000000058D0000-0x00000000058D2000-memory.dmp

Download

memory/964-0-0x00000000732A0000-0x000000007398E000-memory.dmp

Download

memory/964-3-0x0000000005670000-0x0000000005671000-memory.dmp

Download

memory/964-4-0x00000000030A0000-0x00000000030B7000-memory.dmp

Download

memory/964-24-0x0000000007950000-0x0000000007951000-memory.dmp

Download

memory/964-6-0x0000000008390000-0x0000000008391000-memory.dmp

Download

memory/964-7-0x0000000007F70000-0x0000000007F71000-memory.dmp

Download

memory/1820-15-0x0000000000DC0000-0x0000000000DC1000-memory.dmp

Download

memory/1820-14-0x00000000732A0000-0x000000007398E000-memory.dmp

Download

memory/1820-259-0x00000000097A0000-0x00000000097A1000-memory.dmp

Download

memory/1820-258-0x0000000009620000-0x000000000962A000-memory.dmp

Download

memory/3372-263-0x0000000000400000-0x00000000004E1000-memory.dmp

Download

memory/3372-261-0x0000000000400000-0x00000000004E1000-memory.dmp

Download