asyncrat | e3c342be37ab6f49260bc36cec49561b08479b1a577ec2df7b634caffd585d96

General

Target
Invoice #002278.exe
Size 232KB
Sample201217-fvvstfc9fa
SHA256 e3c342be37ab6f49260bc36cec49561b08479b1a577ec2df7b634caffd585d96
MD5 da5dd4e41b4311ed1e0fd1ae64cd3163
SHA1 e142108da9dc123a4d93754f914955d59de8a7f6
SHA512 2a434396d9c9cd6c452bc1c50ed904e30a7904f4e4736fb7d5a0bd42fc9280ef2ecd28157625bc51b98d35fea4c4ecaf9fb95e1767f099baec1c25c1058a780d
MD5 SHA1 SHA512

Score

10^/10

asyncrat persistence rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

C2

chongmei33.publicvm.com:49746
chongmei33.publicvm.com:2703
chongmei33.publicvm.com:49714
chongmei33.publicvm.com:49703
185.165.153.116:49746
185.165.153.116:2703
185.165.153.116:49714
185.165.153.116:49703
54.37.36.116:49746
54.37.36.116:2703
54.37.36.116:49714
54.37.36.116:49703
185.244.30.92:49746
185.244.30.92:2703
185.244.30.92:49714
185.244.30.92:49703
dongreg202020.duckdns.org:49746
dongreg202020.duckdns.org:2703
dongreg202020.duckdns.org:49714
dongreg202020.duckdns.org:49703
178.33.222.241:49746
178.33.222.241:2703
178.33.222.241:49714
178.33.222.241:49703
rahim321.duckdns.org:49746
rahim321.duckdns.org:2703
rahim321.duckdns.org:49714
rahim321.duckdns.org:49703
79.134.225.92:49746
79.134.225.92:2703
79.134.225.92:49714
79.134.225.92:49703
37.120.208.36:49746
37.120.208.36:2703
37.120.208.36:49714
37.120.208.36:49703

Mutex

word_6SI86kPnk

Attributes

aes_key
Hz9AIk2iuw31bDO3o1GepDyHZ5vVJkGp
anti_detection
false
autorun
false
bdos
false
delay
SEPT G8
host
chongmei33.publicvm.com,185.165.153.116,54.37.36.116,185.244.30.92,dongreg202020.duckdns.org,178.33.222.241,rahim321.duckdns.org,79.134.225.92,37.120.208.36
hwid
3
install_file
install_folder
%AppData%
mutex
word_6SI86kPnk
pastebin_config
null
port
49746,2703,49714,49703
version
0.5.7B

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
rat asyncrat

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe,\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Invoice #002278.exe\""	Invoice #002278.exe

Async RAT payload 4 IoCs

rat

resource	yara_rule
behavioral1/memory/1004-8-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat
behavioral1/memory/1004-9-0x000000000040C89E-mapping.dmp	asyncrat
behavioral1/memory/1004-10-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat
behavioral1/memory/1004-11-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Invoice #002278.exe	Invoice #002278.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Invoice #002278.exe	Invoice #002278.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\<Unknown> = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Invoice #002278.exe"	Invoice #002278.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\Invoice #002278.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Invoice #002278.exe"	Invoice #002278.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1924 set thread context of 1004	1924	Invoice #002278.exe	33

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
568	timeout.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1924	Invoice #002278.exe
1924	Invoice #002278.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1924	Invoice #002278.exe
Token: SeDebugPrivilege	1004	Invoice #002278.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 1924 wrote to memory of 368	1924	Invoice #002278.exe	26
PID 1924 wrote to memory of 368	1924	Invoice #002278.exe	26
PID 1924 wrote to memory of 368	1924	Invoice #002278.exe	26
PID 1924 wrote to memory of 368	1924	Invoice #002278.exe	26
PID 368 wrote to memory of 568	368	cmd.exe	28
PID 368 wrote to memory of 568	368	cmd.exe	28
PID 368 wrote to memory of 568	368	cmd.exe	28
PID 368 wrote to memory of 568	368	cmd.exe	28
PID 1924 wrote to memory of 852	1924	Invoice #002278.exe	32
PID 1924 wrote to memory of 852	1924	Invoice #002278.exe	32
PID 1924 wrote to memory of 852	1924	Invoice #002278.exe	32
PID 1924 wrote to memory of 852	1924	Invoice #002278.exe	32
PID 1924 wrote to memory of 1004	1924	Invoice #002278.exe	33
PID 1924 wrote to memory of 1004	1924	Invoice #002278.exe	33
PID 1924 wrote to memory of 1004	1924	Invoice #002278.exe	33
PID 1924 wrote to memory of 1004	1924	Invoice #002278.exe	33
PID 1924 wrote to memory of 1004	1924	Invoice #002278.exe	33
PID 1924 wrote to memory of 1004	1924	Invoice #002278.exe	33
PID 1924 wrote to memory of 1004	1924	Invoice #002278.exe	33
PID 1924 wrote to memory of 1004	1924	Invoice #002278.exe	33
PID 1924 wrote to memory of 1004	1924	Invoice #002278.exe	33

C:\Users\Admin\AppData\Local\Temp\Invoice #002278.exe
"C:\Users\Admin\AppData\Local\Temp\Invoice #002278.exe"
1⤵
- Modifies WinLogon for persistence
- Drops startup file
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1924
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c timeout 4.065
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:368
- - C:\Windows\SysWOW64\timeout.exe
    timeout 4.065
    3⤵
    - Delays execution with timeout.exe
    PID:568
- C:\Users\Admin\AppData\Local\Temp\Invoice #002278.exe
  "C:\Users\Admin\AppData\Local\Temp\Invoice #002278.exe"
  2⤵
  PID:852
- C:\Users\Admin\AppData\Local\Temp\Invoice #002278.exe
  "C:\Users\Admin\AppData\Local\Temp\Invoice #002278.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1004

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1004-8-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/1004-10-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/1004-11-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/1004-12-0x0000000074480000-0x0000000074B6E000-memory.dmp

Download

memory/1924-2-0x0000000074480000-0x0000000074B6E000-memory.dmp

Download

memory/1924-3-0x0000000000130000-0x0000000000131000-memory.dmp

Download

memory/1924-7-0x0000000001F20000-0x0000000001F3E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads