asyncrat | 55b779f35f7ba5b7e409de245f0c6c8c2f7f38292f7d33b42e65f1fe4cbe6ee9

Analysis

max time kernel
145s
max time network
148s
platform
windows10_x64
resource
win10
submitted
14/10/2020, 15:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
CT558801294_504670_03732174347.PDF.exe
Size 3.2MB
Sample201014-z4wtem7the
SHA256 55b779f35f7ba5b7e409de245f0c6c8c2f7f38292f7d33b42e65f1fe4cbe6ee9
MD5 e23cff81572101abd02dadc9f6269b6e
SHA1 4c06a1a5471ebdba8669981e9a50de00a09bf120
SHA512 4a5c62c3b72229e4cad99ccbbd9f5532d269392e87b76216d0a055855dbc888a70df168a895ebe7abf7905b9120f5a018e1d6c4e7ead7007cbdcde64f58e014c
MD5 SHA1 SHA512

Score

10^/10

rat asyncrat

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

185.244.30.121:7882

Mutex

AsyncMutex_6SI8OkPnk

Attributes

aes_key
7waMnQU7XKn0KiCxCoUXlyImOaz9FZeu
anti_detection
false
autorun
false
bdos
false
delay
Default
host
185.244.30.121
hwid
3
install_file
install_folder
%AppData%
mutex
AsyncMutex_6SI8OkPnk
pastebin_config
null
port
7882
version
0.5.7B

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
rat asyncrat

Async RAT payload 2 IoCs

rat

resource	yara_rule
behavioral2/memory/2584-47-0x000000000040C70E-mapping.dmp	asyncrat
behavioral2/memory/2584-49-0x0000000000720000-0x0000000000732000-memory.dmp	asyncrat

ServiceHost packer 4 IoCs

Detects ServiceHost packer used for .NET malware

resource	yara_rule
behavioral2/memory/972-27-0x0000000000426BF7-mapping.dmp	servicehost
behavioral2/memory/972-28-0x0000000000426BF7-mapping.dmp	servicehost
behavioral2/memory/972-29-0x0000000000426BF7-mapping.dmp	servicehost
behavioral2/memory/972-30-0x0000000000426BF7-mapping.dmp	servicehost

Executes dropped EXE 2 IoCs

pid	Process
1868	tree3.exe
1428	scan21.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scan21.lnk	scan21.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\scan21.exe	cmd.exe
File opened for modification	C:\Windows\SysWOW64\scan21.exe	cmd.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1868 set thread context of 972	1868	tree3.exe	81
PID 1428 set thread context of 2584	1428	scan21.exe	87

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2420	972	WerFault.exe	81

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
2420	WerFault.exe
2420	WerFault.exe
2420	WerFault.exe
2420	WerFault.exe
2420	WerFault.exe
2420	WerFault.exe
2420	WerFault.exe
2420	WerFault.exe
2420	WerFault.exe
2420	WerFault.exe
2420	WerFault.exe
2420	WerFault.exe
2420	WerFault.exe
2420	WerFault.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	3932	CT558801294_504670_03732174347.PDF.exe
Token: SeDebugPrivilege	1868	tree3.exe
Token: SeRestorePrivilege	2420	WerFault.exe
Token: SeBackupPrivilege	2420	WerFault.exe
Token: SeDebugPrivilege	2420	WerFault.exe
Token: SeDebugPrivilege	1428	scan21.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 3932 wrote to memory of 1648	3932	CT558801294_504670_03732174347.PDF.exe	75
PID 3932 wrote to memory of 1648	3932	CT558801294_504670_03732174347.PDF.exe	75
PID 3932 wrote to memory of 1648	3932	CT558801294_504670_03732174347.PDF.exe	75
PID 1648 wrote to memory of 1868	1648	cmd.exe	77
PID 1648 wrote to memory of 1868	1648	cmd.exe	77
PID 1648 wrote to memory of 1868	1648	cmd.exe	77
PID 3932 wrote to memory of 2756	3932	CT558801294_504670_03732174347.PDF.exe	79
PID 3932 wrote to memory of 2756	3932	CT558801294_504670_03732174347.PDF.exe	79
PID 3932 wrote to memory of 2756	3932	CT558801294_504670_03732174347.PDF.exe	79
PID 1868 wrote to memory of 972	1868	tree3.exe	81
PID 1868 wrote to memory of 972	1868	tree3.exe	81
PID 1868 wrote to memory of 972	1868	tree3.exe	81
PID 1868 wrote to memory of 972	1868	tree3.exe	81
PID 1868 wrote to memory of 972	1868	tree3.exe	81
PID 1868 wrote to memory of 972	1868	tree3.exe	81
PID 1868 wrote to memory of 972	1868	tree3.exe	81
PID 1868 wrote to memory of 972	1868	tree3.exe	81
PID 1868 wrote to memory of 972	1868	tree3.exe	81
PID 1868 wrote to memory of 972	1868	tree3.exe	81
PID 3932 wrote to memory of 3856	3932	CT558801294_504670_03732174347.PDF.exe	84
PID 3932 wrote to memory of 3856	3932	CT558801294_504670_03732174347.PDF.exe	84
PID 3932 wrote to memory of 3856	3932	CT558801294_504670_03732174347.PDF.exe	84
PID 3856 wrote to memory of 1428	3856	cmd.exe	86
PID 3856 wrote to memory of 1428	3856	cmd.exe	86
PID 3856 wrote to memory of 1428	3856	cmd.exe	86
PID 1428 wrote to memory of 2584	1428	scan21.exe	87
PID 1428 wrote to memory of 2584	1428	scan21.exe	87
PID 1428 wrote to memory of 2584	1428	scan21.exe	87
PID 1428 wrote to memory of 2584	1428	scan21.exe	87
PID 1428 wrote to memory of 2584	1428	scan21.exe	87
PID 1428 wrote to memory of 2584	1428	scan21.exe	87
PID 1428 wrote to memory of 2584	1428	scan21.exe	87
PID 1428 wrote to memory of 2584	1428	scan21.exe	87

C:\Users\Admin\AppData\Local\Temp\CT558801294_504670_03732174347.PDF.exe
"C:\Users\Admin\AppData\Local\Temp\CT558801294_504670_03732174347.PDF.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3932
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c, "C:\Users\Admin\Pictures\tree3.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1648
- - C:\Users\Admin\Pictures\tree3.exe
    "C:\Users\Admin\Pictures\tree3.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1868
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe"
      4⤵
      PID:972
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 972 -s 584
        5⤵
        Program crash
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2420
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\CT558801294_504670_03732174347.PDF.exe" "C:\Windows\system32\scan21.exe"
  2⤵
  - Drops file in System32 directory
  PID:2756
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c, "C:\Windows\system32\scan21.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3856
- - C:\Windows\SysWOW64\scan21.exe
    "C:\Windows\system32\scan21.exe"
    3⤵
    - Executes dropped EXE
    - Drops startup file
    - Suspicious use of SetThreadContext
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1428
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
      4⤵
      PID:2584

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/972-25-0x0000000000730000-0x0000000000811000-memory.dmp

Download

memory/1428-36-0x0000000073530000-0x0000000073C1E000-memory.dmp

Download

memory/1868-22-0x0000000000D10000-0x0000000000D11000-memory.dmp

Download

memory/1868-13-0x00000000001B0000-0x00000000001B1000-memory.dmp

Download

memory/1868-12-0x0000000073630000-0x0000000073D1E000-memory.dmp

Download

memory/1868-21-0x0000000000CD0000-0x0000000000CDA000-memory.dmp

Download

memory/2420-26-0x0000000004610000-0x0000000004611000-memory.dmp

Download

memory/2420-31-0x0000000004C40000-0x0000000004C41000-memory.dmp

Download

memory/2584-49-0x0000000000720000-0x0000000000732000-memory.dmp

Download

memory/2584-48-0x0000000073530000-0x0000000073C1E000-memory.dmp

Download

memory/3932-6-0x0000000008450000-0x0000000008451000-memory.dmp

Download

memory/3932-4-0x0000000001870000-0x0000000001887000-memory.dmp

Download

memory/3932-3-0x00000000057C0000-0x00000000057C1000-memory.dmp

Download

memory/3932-1-0x0000000000BB0000-0x0000000000BB1000-memory.dmp

Download

memory/3932-5-0x0000000001A40000-0x0000000001A5F000-memory.dmp

Download

memory/3932-7-0x0000000008030000-0x0000000008031000-memory.dmp

Download

memory/3932-0-0x0000000073630000-0x0000000073D1E000-memory.dmp

Download