asyncrat | eca20c693b49898e7457ceda947bdfd264ffa4f936cf43b1dbbd8d635bd27cf2

General

Target
d39eb54090a3984bd54d6a1f0b7555cb.exe
Size 500KB
Sample201122-csy12a6d2e
SHA256 eca20c693b49898e7457ceda947bdfd264ffa4f936cf43b1dbbd8d635bd27cf2
MD5 d39eb54090a3984bd54d6a1f0b7555cb
SHA1 0155f314ae0b661b6c301c1f06c33b4aeb7d31bc
SHA512 83664b609d6700bcccd10d38bdcefebc083e4d28f0954441c2f8d3d35acd5e5af20a143b013a4645639b618428deef7aa4f8914820155ef2491f0e9d7318813d
MD5 SHA1 SHA512

Score

10^/10

asyncrat persistence rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

C2

agentttt.ac.ug:6970
agentpurple.ac.ug:6970

Mutex

AsyncMutex_6SI8OkPnk

Attributes

aes_key
16dw6EDbQkYZp5BTs7cmLUicVtOA4UQr
anti_detection
false
autorun
false
bdos
false
delay
Default
host
agentttt.ac.ug,agentpurple.ac.ug
hwid
3
install_file
install_folder
%AppData%
mutex
AsyncMutex_6SI8OkPnk
pastebin_config
null
port
6970
version
0.5.7B

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
rat asyncrat

Async RAT payload 4 IoCs

rat

resource	yara_rule
behavioral1/memory/1936-5-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat
behavioral1/memory/1936-6-0x000000000040C76E-mapping.dmp	asyncrat
behavioral1/memory/1936-7-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat
behavioral1/memory/1936-8-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run\cavvlc = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\VideoLAN\\cavvlc.exe\""	d39eb54090a3984bd54d6a1f0b7555cb.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2036 set thread context of 1936	2036	d39eb54090a3984bd54d6a1f0b7555cb.exe	29

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2036	d39eb54090a3984bd54d6a1f0b7555cb.exe
2036	d39eb54090a3984bd54d6a1f0b7555cb.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2036	d39eb54090a3984bd54d6a1f0b7555cb.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2036 wrote to memory of 1936	2036	d39eb54090a3984bd54d6a1f0b7555cb.exe	29
PID 2036 wrote to memory of 1936	2036	d39eb54090a3984bd54d6a1f0b7555cb.exe	29
PID 2036 wrote to memory of 1936	2036	d39eb54090a3984bd54d6a1f0b7555cb.exe	29
PID 2036 wrote to memory of 1936	2036	d39eb54090a3984bd54d6a1f0b7555cb.exe	29
PID 2036 wrote to memory of 1936	2036	d39eb54090a3984bd54d6a1f0b7555cb.exe	29
PID 2036 wrote to memory of 1936	2036	d39eb54090a3984bd54d6a1f0b7555cb.exe	29
PID 2036 wrote to memory of 1936	2036	d39eb54090a3984bd54d6a1f0b7555cb.exe	29
PID 2036 wrote to memory of 1936	2036	d39eb54090a3984bd54d6a1f0b7555cb.exe	29
PID 2036 wrote to memory of 1936	2036	d39eb54090a3984bd54d6a1f0b7555cb.exe	29

C:\Users\Admin\AppData\Local\Temp\d39eb54090a3984bd54d6a1f0b7555cb.exe
"C:\Users\Admin\AppData\Local\Temp\d39eb54090a3984bd54d6a1f0b7555cb.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2036
- C:\Users\Admin\AppData\Local\Temp\d39eb54090a3984bd54d6a1f0b7555cb.exe
  "C:\Users\Admin\AppData\Local\Temp\d39eb54090a3984bd54d6a1f0b7555cb.exe"
  2⤵
  PID:1936

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1936-5-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/1936-7-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/1936-8-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/1936-9-0x0000000074EE0000-0x00000000755CE000-memory.dmp

Download

memory/2036-0-0x0000000074EE0000-0x00000000755CE000-memory.dmp

Download

memory/2036-1-0x0000000000FB0000-0x0000000000FB1000-memory.dmp

Download

memory/2036-3-0x0000000000570000-0x00000000005A9000-memory.dmp

Download

memory/2036-4-0x0000000000600000-0x0000000000616000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads