asyncrat | 5b0ffdd98aa6a53e13e00b7723f9c8085e7b03356c5ec4e77cc88c9779011b74

General

Target
3c59ce6c1cef9dbc4808d9c10e90f83d.exe
Size 234KB
Sample201109-vvlr8ca31j
SHA256 5b0ffdd98aa6a53e13e00b7723f9c8085e7b03356c5ec4e77cc88c9779011b74
MD5 3c59ce6c1cef9dbc4808d9c10e90f83d
SHA1 220c04cf40c8547468ef38bdb2469891abf80cf8
SHA512 03f2343588ca757f4747e505fbe138ec18eb77af42dba3900c2bf2dda1a2a2effbd43e2a9e69b698d04d483a56d015e3513cd7d88283514b3c097cbfb0561848
MD5 SHA1 SHA512

Score

10^/10

asyncrat coreentity rat rezer0

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

C2

moveforme.ug:6970
xafsavxcfdgbdsfg.ru:6970

Mutex

AsyncMutex_ggkanor

Attributes

aes_key
li2MB48BWA2H16sJwngH2ceTNgp1xxPb
anti_detection
false
autorun
false
bdos
false
delay
Spread
host
moveforme.ug,xafsavxcfdgbdsfg.ru
hwid
3
install_file
install_folder
%AppData%
mutex
AsyncMutex_ggkanor
pastebin_config
null
port
6970
version
0.5.7B

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
rat asyncrat

CoreEntity .NET Packer 1 IoCs

A .NET packer called CoreEntity where it has embedded the payload as a BitMap object which is later decrypted.

coreentity

resource	yara_rule
behavioral1/memory/1588-3-0x00000000009E0000-0x00000000009E2000-memory.dmp	coreentity

Async RAT payload 4 IoCs

rat

resource	yara_rule
behavioral1/memory/2044-7-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat
behavioral1/memory/2044-8-0x000000000040C76E-mapping.dmp	asyncrat
behavioral1/memory/2044-9-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat
behavioral1/memory/2044-10-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat

rezer0 1 IoCs

Detects ReZer0, a packer with multiple versions used in various campaigns.

rezer0

resource	yara_rule
behavioral1/memory/1588-4-0x0000000000B90000-0x0000000000BA3000-memory.dmp	rezer0

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1588 set thread context of 2044	1588	3c59ce6c1cef9dbc4808d9c10e90f83d.exe	30

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1920	schtasks.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 1588 wrote to memory of 1920	1588	3c59ce6c1cef9dbc4808d9c10e90f83d.exe	26
PID 1588 wrote to memory of 1920	1588	3c59ce6c1cef9dbc4808d9c10e90f83d.exe	26
PID 1588 wrote to memory of 1920	1588	3c59ce6c1cef9dbc4808d9c10e90f83d.exe	26
PID 1588 wrote to memory of 1920	1588	3c59ce6c1cef9dbc4808d9c10e90f83d.exe	26
PID 1588 wrote to memory of 2044	1588	3c59ce6c1cef9dbc4808d9c10e90f83d.exe	30
PID 1588 wrote to memory of 2044	1588	3c59ce6c1cef9dbc4808d9c10e90f83d.exe	30
PID 1588 wrote to memory of 2044	1588	3c59ce6c1cef9dbc4808d9c10e90f83d.exe	30
PID 1588 wrote to memory of 2044	1588	3c59ce6c1cef9dbc4808d9c10e90f83d.exe	30
PID 1588 wrote to memory of 2044	1588	3c59ce6c1cef9dbc4808d9c10e90f83d.exe	30
PID 1588 wrote to memory of 2044	1588	3c59ce6c1cef9dbc4808d9c10e90f83d.exe	30
PID 1588 wrote to memory of 2044	1588	3c59ce6c1cef9dbc4808d9c10e90f83d.exe	30
PID 1588 wrote to memory of 2044	1588	3c59ce6c1cef9dbc4808d9c10e90f83d.exe	30
PID 1588 wrote to memory of 2044	1588	3c59ce6c1cef9dbc4808d9c10e90f83d.exe	30

C:\Users\Admin\AppData\Local\Temp\3c59ce6c1cef9dbc4808d9c10e90f83d.exe
"C:\Users\Admin\AppData\Local\Temp\3c59ce6c1cef9dbc4808d9c10e90f83d.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1588
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\RSIHBty" /XML "C:\Users\Admin\AppData\Local\Temp\tmpE53.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:1920
- C:\Users\Admin\AppData\Local\Temp\3c59ce6c1cef9dbc4808d9c10e90f83d.exe
  "{path}"
  2⤵
  PID:2044

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1588-0-0x0000000074670000-0x0000000074D5E000-memory.dmp

Download

memory/1588-1-0x0000000000CA0000-0x0000000000CA1000-memory.dmp

Download

memory/1588-3-0x00000000009E0000-0x00000000009E2000-memory.dmp

Download

memory/1588-4-0x0000000000B90000-0x0000000000BA3000-memory.dmp

Download

memory/2044-7-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/2044-9-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/2044-10-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/2044-11-0x0000000074670000-0x0000000074D5E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads