asyncrat | 3bc701b864cc3fffdb154ed410de8f893cc31b577e7df78347742a8ab15ce9ef | Triage™

Analysis

max time kernel
150s
max time network
135s
platform
windows10_x64
resource
win10v20201028
submitted
01/01/2021, 08:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
338046b4bd5337aa3d6ccea6b45c7950.exe
Size 98KB
Sample210101-69tff3667n
SHA256 3bc701b864cc3fffdb154ed410de8f893cc31b577e7df78347742a8ab15ce9ef
MD5 338046b4bd5337aa3d6ccea6b45c7950
SHA1 2a85497a77928068a064674237610b6a9bb7aed9
SHA512 7d3781710087ea81b4256a6ad3fa04bc9e072282be1229b5f62165cc3c30b96746c8f89934f8057840323885dd19d01804df1756ad4466272ed21a5a76879e94
MD5 SHA1 SHA512

Score

10^/10

asyncrat rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

C2

null:null

Mutex

AsyncMutex_6SI8OkPnk

Attributes

aes_key
MbJHwqGReQMnsZXxOd2433A3UKiKEwZV
anti_detection
false
autorun
true
bdos
false
delay
GrieferGames
host
null
hwid
3
install_file
install_folder
%AppData%
mutex
AsyncMutex_6SI8OkPnk
pastebin_config
https://pastebin.com/raw/bC60Y12E
port
null
version
0.5.7B

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
rat asyncrat

Async RAT payload 2 IoCs

resource	yara_rule
behavioral2/files/0x000500000001ab64-12.dat	asyncrat
behavioral2/files/0x000500000001ab64-14.dat	asyncrat

Executes dropped EXE 1 IoCs

pid	Process
1368	Explorer.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task

pid	Process
1528	schtasks.exe

Delays execution with timeout.exe 1 IoCs

pid	Process
3340	timeout.exe

Suspicious behavior: EnumeratesProcesses 15 IoCs

pid	Process
1048	338046b4bd5337aa3d6ccea6b45c7950.exe
1048	338046b4bd5337aa3d6ccea6b45c7950.exe
1048	338046b4bd5337aa3d6ccea6b45c7950.exe
1048	338046b4bd5337aa3d6ccea6b45c7950.exe
1048	338046b4bd5337aa3d6ccea6b45c7950.exe
1048	338046b4bd5337aa3d6ccea6b45c7950.exe
1048	338046b4bd5337aa3d6ccea6b45c7950.exe
1048	338046b4bd5337aa3d6ccea6b45c7950.exe
1048	338046b4bd5337aa3d6ccea6b45c7950.exe
1048	338046b4bd5337aa3d6ccea6b45c7950.exe
1048	338046b4bd5337aa3d6ccea6b45c7950.exe
1048	338046b4bd5337aa3d6ccea6b45c7950.exe
1048	338046b4bd5337aa3d6ccea6b45c7950.exe
1048	338046b4bd5337aa3d6ccea6b45c7950.exe
1048	338046b4bd5337aa3d6ccea6b45c7950.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1048	338046b4bd5337aa3d6ccea6b45c7950.exe
Token: SeDebugPrivilege	1368	Explorer.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 1048 wrote to memory of 1372	1048	338046b4bd5337aa3d6ccea6b45c7950.exe	79
PID 1048 wrote to memory of 1372	1048	338046b4bd5337aa3d6ccea6b45c7950.exe	79
PID 1048 wrote to memory of 1372	1048	338046b4bd5337aa3d6ccea6b45c7950.exe	79
PID 1048 wrote to memory of 2252	1048	338046b4bd5337aa3d6ccea6b45c7950.exe	80
PID 1048 wrote to memory of 2252	1048	338046b4bd5337aa3d6ccea6b45c7950.exe	80
PID 1048 wrote to memory of 2252	1048	338046b4bd5337aa3d6ccea6b45c7950.exe	80
PID 1372 wrote to memory of 1528	1372	cmd.exe	83
PID 1372 wrote to memory of 1528	1372	cmd.exe	83
PID 1372 wrote to memory of 1528	1372	cmd.exe	83
PID 2252 wrote to memory of 3340	2252	cmd.exe	84
PID 2252 wrote to memory of 3340	2252	cmd.exe	84
PID 2252 wrote to memory of 3340	2252	cmd.exe	84
PID 2252 wrote to memory of 1368	2252	cmd.exe	85
PID 2252 wrote to memory of 1368	2252	cmd.exe	85
PID 2252 wrote to memory of 1368	2252	cmd.exe	85

C:\Users\Admin\AppData\Local\Temp\338046b4bd5337aa3d6ccea6b45c7950.exe
"C:\Users\Admin\AppData\Local\Temp\338046b4bd5337aa3d6ccea6b45c7950.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1048
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Explorer" /tr '"C:\Users\Admin\AppData\Roaming\Explorer.exe"' & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1372
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /f /sc onlogon /rl highest /tn "Explorer" /tr '"C:\Users\Admin\AppData\Roaming\Explorer.exe"'
    3⤵
    - Creates scheduled task(s)
    PID:1528
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp676A.tmp.bat""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2252
- - C:\Windows\SysWOW64\timeout.exe
    timeout 3
    3⤵
    - Delays execution with timeout.exe
    PID:3340
- - C:\Users\Admin\AppData\Roaming\Explorer.exe
    "C:\Users\Admin\AppData\Roaming\Explorer.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:1368

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Persistence

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

Web Service

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1048-3-0x0000000000A90000-0x0000000000A91000-memory.dmp

Download

memory/1048-5-0x00000000055F0000-0x00000000055F1000-memory.dmp

Download

memory/1048-2-0x0000000073C80000-0x000000007436E000-memory.dmp

Download

memory/1368-15-0x0000000073BD0000-0x00000000742BE000-memory.dmp

Download