asyncrat | a4df5e9015f70b47dc4f2e6bae0fbeb9d108979e0cda7ef54aa123a0d33bdf8b

Analysis

max time kernel
55s
max time network
115s
platform
windows10_x64
resource
win10v20201028
submitted
09/11/2020, 20:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a4df5e9015f70b47dc4f2e6bae0fbeb9d108979e0cda7ef54aa123a0d33bdf8b.exe
Size 93KB
Sample201109-mlbmdgl22s
SHA256 a4df5e9015f70b47dc4f2e6bae0fbeb9d108979e0cda7ef54aa123a0d33bdf8b
MD5 d563f075ba91e64064d709aa000654b5
SHA1 000274f0f03545785392e83d950c259505e33802
SHA512 4c2cbe9de626aaf001ace652b7b72ae8a225c48d1bbf65c6680641e930edf642bb55003f7b2395dd9ffc3271493d2a5b73a0f614c3650f4f48146ac5cfdfc915
MD5 SHA1 SHA512

Score

10^/10

asyncrat rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

type1520.duckdns.org:2087

Mutex

dgfdsgsggfsd

Attributes

aes_key
TJy3oMrfmzR3gyyYibgTrDIuakYrpmZQ
anti_detection
false
autorun
true
bdos
false
delay
Default
host
type1520.duckdns.org
hwid
3
install_file
install_folder
%AppData%
mutex
dgfdsgsggfsd
pastebin_config
null
port
2087
version
0.5.7B

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
rat asyncrat

Async RAT payload 3 IoCs

rat

resource	yara_rule
behavioral2/memory/64-8-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat
behavioral2/memory/64-9-0x000000000040C6CE-mapping.dmp	asyncrat
behavioral2/memory/184-35-0x000000000040C6CE-mapping.dmp	asyncrat

Executes dropped EXE 3 IoCs

pid	Process
2372	Intel.exe
1452	Intel.exe
584	Intel.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 3760 set thread context of 64	3760	a4df5e9015f70b47dc4f2e6bae0fbeb9d108979e0cda7ef54aa123a0d33bdf8b.exe	79
PID 2372 set thread context of 184	2372	Intel.exe	88

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
2592	schtasks.exe
2780	schtasks.exe

Delays execution with timeout.exe 2 IoCs

evasion

pid	Process
1592	timeout.exe
3140	timeout.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
3760	a4df5e9015f70b47dc4f2e6bae0fbeb9d108979e0cda7ef54aa123a0d33bdf8b.exe
3760	a4df5e9015f70b47dc4f2e6bae0fbeb9d108979e0cda7ef54aa123a0d33bdf8b.exe
64	a4df5e9015f70b47dc4f2e6bae0fbeb9d108979e0cda7ef54aa123a0d33bdf8b.exe
64	a4df5e9015f70b47dc4f2e6bae0fbeb9d108979e0cda7ef54aa123a0d33bdf8b.exe
64	a4df5e9015f70b47dc4f2e6bae0fbeb9d108979e0cda7ef54aa123a0d33bdf8b.exe
64	a4df5e9015f70b47dc4f2e6bae0fbeb9d108979e0cda7ef54aa123a0d33bdf8b.exe
64	a4df5e9015f70b47dc4f2e6bae0fbeb9d108979e0cda7ef54aa123a0d33bdf8b.exe
64	a4df5e9015f70b47dc4f2e6bae0fbeb9d108979e0cda7ef54aa123a0d33bdf8b.exe
64	a4df5e9015f70b47dc4f2e6bae0fbeb9d108979e0cda7ef54aa123a0d33bdf8b.exe
64	a4df5e9015f70b47dc4f2e6bae0fbeb9d108979e0cda7ef54aa123a0d33bdf8b.exe
64	a4df5e9015f70b47dc4f2e6bae0fbeb9d108979e0cda7ef54aa123a0d33bdf8b.exe
64	a4df5e9015f70b47dc4f2e6bae0fbeb9d108979e0cda7ef54aa123a0d33bdf8b.exe
64	a4df5e9015f70b47dc4f2e6bae0fbeb9d108979e0cda7ef54aa123a0d33bdf8b.exe
64	a4df5e9015f70b47dc4f2e6bae0fbeb9d108979e0cda7ef54aa123a0d33bdf8b.exe
64	a4df5e9015f70b47dc4f2e6bae0fbeb9d108979e0cda7ef54aa123a0d33bdf8b.exe
64	a4df5e9015f70b47dc4f2e6bae0fbeb9d108979e0cda7ef54aa123a0d33bdf8b.exe
64	a4df5e9015f70b47dc4f2e6bae0fbeb9d108979e0cda7ef54aa123a0d33bdf8b.exe
2372	Intel.exe
2372	Intel.exe
2372	Intel.exe
2372	Intel.exe
184	regasm.exe
184	regasm.exe
184	regasm.exe
184	regasm.exe
184	regasm.exe
184	regasm.exe
184	regasm.exe
184	regasm.exe
184	regasm.exe
184	regasm.exe
184	regasm.exe
184	regasm.exe
184	regasm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	3760	a4df5e9015f70b47dc4f2e6bae0fbeb9d108979e0cda7ef54aa123a0d33bdf8b.exe
Token: SeDebugPrivilege	64	a4df5e9015f70b47dc4f2e6bae0fbeb9d108979e0cda7ef54aa123a0d33bdf8b.exe
Token: SeDebugPrivilege	2372	Intel.exe
Token: SeDebugPrivilege	184	regasm.exe

Suspicious use of WriteProcessMemory 49 IoCs

description	pid	Process	procid_target
PID 3760 wrote to memory of 64	3760	a4df5e9015f70b47dc4f2e6bae0fbeb9d108979e0cda7ef54aa123a0d33bdf8b.exe	79
PID 3760 wrote to memory of 64	3760	a4df5e9015f70b47dc4f2e6bae0fbeb9d108979e0cda7ef54aa123a0d33bdf8b.exe	79
PID 3760 wrote to memory of 64	3760	a4df5e9015f70b47dc4f2e6bae0fbeb9d108979e0cda7ef54aa123a0d33bdf8b.exe	79
PID 3760 wrote to memory of 64	3760	a4df5e9015f70b47dc4f2e6bae0fbeb9d108979e0cda7ef54aa123a0d33bdf8b.exe	79
PID 3760 wrote to memory of 64	3760	a4df5e9015f70b47dc4f2e6bae0fbeb9d108979e0cda7ef54aa123a0d33bdf8b.exe	79
PID 3760 wrote to memory of 64	3760	a4df5e9015f70b47dc4f2e6bae0fbeb9d108979e0cda7ef54aa123a0d33bdf8b.exe	79
PID 3760 wrote to memory of 64	3760	a4df5e9015f70b47dc4f2e6bae0fbeb9d108979e0cda7ef54aa123a0d33bdf8b.exe	79
PID 3760 wrote to memory of 64	3760	a4df5e9015f70b47dc4f2e6bae0fbeb9d108979e0cda7ef54aa123a0d33bdf8b.exe	79
PID 64 wrote to memory of 3352	64	a4df5e9015f70b47dc4f2e6bae0fbeb9d108979e0cda7ef54aa123a0d33bdf8b.exe	80
PID 64 wrote to memory of 3352	64	a4df5e9015f70b47dc4f2e6bae0fbeb9d108979e0cda7ef54aa123a0d33bdf8b.exe	80
PID 64 wrote to memory of 3352	64	a4df5e9015f70b47dc4f2e6bae0fbeb9d108979e0cda7ef54aa123a0d33bdf8b.exe	80
PID 64 wrote to memory of 1164	64	a4df5e9015f70b47dc4f2e6bae0fbeb9d108979e0cda7ef54aa123a0d33bdf8b.exe	81
PID 64 wrote to memory of 1164	64	a4df5e9015f70b47dc4f2e6bae0fbeb9d108979e0cda7ef54aa123a0d33bdf8b.exe	81
PID 64 wrote to memory of 1164	64	a4df5e9015f70b47dc4f2e6bae0fbeb9d108979e0cda7ef54aa123a0d33bdf8b.exe	81
PID 3352 wrote to memory of 2592	3352	cmd.exe	84
PID 3352 wrote to memory of 2592	3352	cmd.exe	84
PID 3352 wrote to memory of 2592	3352	cmd.exe	84
PID 1164 wrote to memory of 1592	1164	cmd.exe	85
PID 1164 wrote to memory of 1592	1164	cmd.exe	85
PID 1164 wrote to memory of 1592	1164	cmd.exe	85
PID 1164 wrote to memory of 2372	1164	cmd.exe	86
PID 1164 wrote to memory of 2372	1164	cmd.exe	86
PID 1164 wrote to memory of 2372	1164	cmd.exe	86
PID 2372 wrote to memory of 1452	2372	Intel.exe	87
PID 2372 wrote to memory of 1452	2372	Intel.exe	87
PID 2372 wrote to memory of 1452	2372	Intel.exe	87
PID 2372 wrote to memory of 184	2372	Intel.exe	88
PID 2372 wrote to memory of 184	2372	Intel.exe	88
PID 2372 wrote to memory of 184	2372	Intel.exe	88
PID 2372 wrote to memory of 184	2372	Intel.exe	88
PID 2372 wrote to memory of 184	2372	Intel.exe	88
PID 2372 wrote to memory of 184	2372	Intel.exe	88
PID 2372 wrote to memory of 184	2372	Intel.exe	88
PID 2372 wrote to memory of 184	2372	Intel.exe	88
PID 184 wrote to memory of 2308	184	regasm.exe	89
PID 184 wrote to memory of 2308	184	regasm.exe	89
PID 184 wrote to memory of 2308	184	regasm.exe	89
PID 2308 wrote to memory of 2780	2308	cmd.exe	91
PID 2308 wrote to memory of 2780	2308	cmd.exe	91
PID 2308 wrote to memory of 2780	2308	cmd.exe	91
PID 184 wrote to memory of 2776	184	regasm.exe	92
PID 184 wrote to memory of 2776	184	regasm.exe	92
PID 184 wrote to memory of 2776	184	regasm.exe	92
PID 2776 wrote to memory of 3140	2776	cmd.exe	94
PID 2776 wrote to memory of 3140	2776	cmd.exe	94
PID 2776 wrote to memory of 3140	2776	cmd.exe	94
PID 2776 wrote to memory of 584	2776	cmd.exe	95
PID 2776 wrote to memory of 584	2776	cmd.exe	95
PID 2776 wrote to memory of 584	2776	cmd.exe	95

C:\Users\Admin\AppData\Local\Temp\a4df5e9015f70b47dc4f2e6bae0fbeb9d108979e0cda7ef54aa123a0d33bdf8b.exe
"C:\Users\Admin\AppData\Local\Temp\a4df5e9015f70b47dc4f2e6bae0fbeb9d108979e0cda7ef54aa123a0d33bdf8b.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3760
- C:\Users\Admin\AppData\Local\Temp\a4df5e9015f70b47dc4f2e6bae0fbeb9d108979e0cda7ef54aa123a0d33bdf8b.exe
  "C:\Users\Admin\AppData\Local\Temp\a4df5e9015f70b47dc4f2e6bae0fbeb9d108979e0cda7ef54aa123a0d33bdf8b.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:64
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Intel" /tr '"C:\Users\Admin\AppData\Roaming\Intel.exe"' & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3352
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /f /sc onlogon /rl highest /tn "Intel" /tr '"C:\Users\Admin\AppData\Roaming\Intel.exe"'
      4⤵
      Creates scheduled task(s)
      PID:2592
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp7A94.tmp.bat""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1164
  - - C:\Windows\SysWOW64\timeout.exe
      timeout 3
      4⤵
      Delays execution with timeout.exe
      PID:1592
  - - C:\Users\Admin\AppData\Roaming\Intel.exe
      "C:\Users\Admin\AppData\Roaming\Intel.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2372
    - - C:\Users\Admin\AppData\Roaming\Intel.exe
        
        "C:\Users\Admin\AppData\Roaming\Intel.exe"
        5⤵
        Executes dropped EXE
        
        PID:1452
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:184
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Intel" /tr '"C:\Users\Admin\AppData\Roaming\Intel.exe"' & exit
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:2308
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "Intel" /tr '"C:\Users\Admin\AppData\Roaming\Intel.exe"'
        7⤵
        Creates scheduled task(s)
        
        PID:2780
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpFEC8.tmp.bat""
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:2776
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout 3
        7⤵
        Delays execution with timeout.exe
        
        PID:3140
        
        C:\Users\Admin\AppData\Roaming\Intel.exe
        
        "C:\Users\Admin\AppData\Roaming\Intel.exe"
        7⤵
        Executes dropped EXE
        
        PID:584

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/64-8-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/64-13-0x00000000051A0000-0x00000000051A1000-memory.dmp

Download

memory/64-10-0x0000000073920000-0x000000007400E000-memory.dmp

Download

memory/184-36-0x0000000073920000-0x000000007400E000-memory.dmp

Download

memory/584-49-0x00000000739C0000-0x00000000740AE000-memory.dmp

Download

memory/584-50-0x0000000000BE0000-0x0000000000BE1000-memory.dmp

Download

memory/2372-24-0x0000000073920000-0x000000007400E000-memory.dmp

Download

memory/2372-33-0x0000000006120000-0x0000000006121000-memory.dmp

Download

memory/3760-0-0x0000000073920000-0x000000007400E000-memory.dmp

Download

memory/3760-6-0x00000000057A0000-0x00000000057A5000-memory.dmp

Download

memory/3760-5-0x00000000053C0000-0x00000000053C4000-memory.dmp

Download

memory/3760-4-0x0000000005430000-0x0000000005431000-memory.dmp

Download

memory/3760-3-0x0000000005830000-0x0000000005831000-memory.dmp

Download

memory/3760-1-0x0000000000BE0000-0x0000000000BE1000-memory.dmp

Download