asyncrat | ac016f9b1592fb93fe1117f2a2e20b383944828d649f1ba33ecf831a78537b78

General

Target

SAFETYMATERIAL-COVERALL-MASKPPENh3nfndGkgptXUf.exe
Size

401KB
MD5

8b0fb5064ee0361249dc6ff3aa94c584
SHA1

869a8a7ddbdef0840bbc44f5c6cc0cc043059731
SHA256

ac016f9b1592fb93fe1117f2a2e20b383944828d649f1ba33ecf831a78537b78
SHA512

f6070df027d4977216833afcdb429e70e699deb2f230fb3b797b1e486e893cd5915a2d88a4e1d06bb87342d9e246fc2b17a7a6d373267bd08868f0f2e7cc7d63

Score

10^/10

asyncrat coreentity rat rezer0

Malware Config

Extracted

Family

asyncrat

Version

0.5.6D

C2

185.165.153.215:6606

Mutex

uqeolevmck

Attributes

aes_key
5eoiILw5GAY7OkbkZoi8uQvz2qpV60Nt
anti_detection
false
autorun
false
bdos
false
delay
sunday
host
185.165.153.215
hwid
1
install_file
install_folder
%AppData%
mutex
uqeolevmck
pastebin_config
null
port
6606
version
0.5.6D

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
rat asyncrat

CoreEntity .NET Packer 1 IoCs

A .NET packer called CoreEntity where it has embedded the payload as a BitMap object which is later decrypted.

coreentity

Processes:

resource	yara_rule
behavioral1/memory/1676-4-0x00000000003B0000-0x00000000003B3000-memory.dmp	coreentity

Async RAT payload 4 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1552-8-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat
behavioral1/memory/1552-9-0x000000000040C60E-mapping.dmp	asyncrat
behavioral1/memory/1552-10-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat
behavioral1/memory/1552-11-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat

rezer0 1 IoCs

Detects ReZer0, a packer with multiple versions used in various campaigns.

rezer0

Processes:

resource	yara_rule
behavioral1/memory/1676-5-0x0000000000530000-0x0000000000543000-memory.dmp	rezer0

Suspicious use of SetThreadContext 1 IoCs

Processes:

SAFETYMATERIAL-COVERALL-MASKPPENh3nfndGkgptXUf.exe

description	pid	process	target process
PID 1676 set thread context of 1552	1676	SAFETYMATERIAL-COVERALL-MASKPPENh3nfndGkgptXUf.exe	SAFETYMATERIAL-COVERALL-MASKPPENh3nfndGkgptXUf.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1164 schtasks.exe

pid	process
1164	schtasks.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

SAFETYMATERIAL-COVERALL-MASKPPENh3nfndGkgptXUf.exe

pid	process
1676	SAFETYMATERIAL-COVERALL-MASKPPENh3nfndGkgptXUf.exe
1676	SAFETYMATERIAL-COVERALL-MASKPPENh3nfndGkgptXUf.exe
1676	SAFETYMATERIAL-COVERALL-MASKPPENh3nfndGkgptXUf.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

SAFETYMATERIAL-COVERALL-MASKPPENh3nfndGkgptXUf.exe

description pid process

Token: SeDebugPrivilege 1676 SAFETYMATERIAL-COVERALL-MASKPPENh3nfndGkgptXUf.exe

description	pid	process
Token: SeDebugPrivilege	1676	SAFETYMATERIAL-COVERALL-MASKPPENh3nfndGkgptXUf.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

SAFETYMATERIAL-COVERALL-MASKPPENh3nfndGkgptXUf.exe

description	pid	process	target process
PID 1676 wrote to memory of 1164	1676	SAFETYMATERIAL-COVERALL-MASKPPENh3nfndGkgptXUf.exe	schtasks.exe
PID 1676 wrote to memory of 1164	1676	SAFETYMATERIAL-COVERALL-MASKPPENh3nfndGkgptXUf.exe	schtasks.exe
PID 1676 wrote to memory of 1164	1676	SAFETYMATERIAL-COVERALL-MASKPPENh3nfndGkgptXUf.exe	schtasks.exe
PID 1676 wrote to memory of 1164	1676	SAFETYMATERIAL-COVERALL-MASKPPENh3nfndGkgptXUf.exe	schtasks.exe
PID 1676 wrote to memory of 1552	1676	SAFETYMATERIAL-COVERALL-MASKPPENh3nfndGkgptXUf.exe	SAFETYMATERIAL-COVERALL-MASKPPENh3nfndGkgptXUf.exe
PID 1676 wrote to memory of 1552	1676	SAFETYMATERIAL-COVERALL-MASKPPENh3nfndGkgptXUf.exe	SAFETYMATERIAL-COVERALL-MASKPPENh3nfndGkgptXUf.exe
PID 1676 wrote to memory of 1552	1676	SAFETYMATERIAL-COVERALL-MASKPPENh3nfndGkgptXUf.exe	SAFETYMATERIAL-COVERALL-MASKPPENh3nfndGkgptXUf.exe
PID 1676 wrote to memory of 1552	1676	SAFETYMATERIAL-COVERALL-MASKPPENh3nfndGkgptXUf.exe	SAFETYMATERIAL-COVERALL-MASKPPENh3nfndGkgptXUf.exe
PID 1676 wrote to memory of 1552	1676	SAFETYMATERIAL-COVERALL-MASKPPENh3nfndGkgptXUf.exe	SAFETYMATERIAL-COVERALL-MASKPPENh3nfndGkgptXUf.exe
PID 1676 wrote to memory of 1552	1676	SAFETYMATERIAL-COVERALL-MASKPPENh3nfndGkgptXUf.exe	SAFETYMATERIAL-COVERALL-MASKPPENh3nfndGkgptXUf.exe
PID 1676 wrote to memory of 1552	1676	SAFETYMATERIAL-COVERALL-MASKPPENh3nfndGkgptXUf.exe	SAFETYMATERIAL-COVERALL-MASKPPENh3nfndGkgptXUf.exe
PID 1676 wrote to memory of 1552	1676	SAFETYMATERIAL-COVERALL-MASKPPENh3nfndGkgptXUf.exe	SAFETYMATERIAL-COVERALL-MASKPPENh3nfndGkgptXUf.exe
PID 1676 wrote to memory of 1552	1676	SAFETYMATERIAL-COVERALL-MASKPPENh3nfndGkgptXUf.exe	SAFETYMATERIAL-COVERALL-MASKPPENh3nfndGkgptXUf.exe

C:\Users\Admin\AppData\Local\Temp\SAFETYMATERIAL-COVERALL-MASKPPENh3nfndGkgptXUf.exe
"C:\Users\Admin\AppData\Local\Temp\SAFETYMATERIAL-COVERALL-MASKPPENh3nfndGkgptXUf.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1676

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\AkXikCVNwI" /XML "C:\Users\Admin\AppData\Local\Temp\tmp2839.tmp"
2⤵
- Creates scheduled task(s)
PID:1164

C:\Users\Admin\AppData\Local\Temp\SAFETYMATERIAL-COVERALL-MASKPPENh3nfndGkgptXUf.exe
"{path}"
2⤵
PID:1552

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp2839.tmp
MD5
e49c1b492e3e08e4a36f20164dac439d

SHA1
d2be482ab1f92343d67b34c2b305315db5d96b3a

SHA256
dadeb11c8a52a7f36c0f6750fe3ec91e89d7080b985f5ff952f4863afa5de574

SHA512
b86118758ba4ce9a7bf83c793e4852cbbba3754236a90cef62e784d8052b8297a61d01e5c2d749d54162dc871c653e3355eb8c2645701798838ce6f669994390

Download Submit
memory/1164-6-0x0000000000000000-mapping.dmp

Download
memory/1552-8-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1552-9-0x000000000040C60E-mapping.dmp

Download
memory/1552-10-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1552-11-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1552-12-0x00000000741A0000-0x000000007488E000-memory.dmp

Filesize
6.9MB

Download
memory/1676-0-0x00000000741A0000-0x000000007488E000-memory.dmp

Filesize
6.9MB

Download
memory/1676-1-0x0000000001290000-0x0000000001291000-memory.dmp

Filesize
4KB

Download
memory/1676-3-0x0000000000260000-0x0000000000276000-memory.dmp

Filesize
88KB

Download
memory/1676-4-0x00000000003B0000-0x00000000003B3000-memory.dmp

Filesize
12KB

Download
memory/1676-5-0x0000000000530000-0x0000000000543000-memory.dmp

Filesize
76KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads