asyncrat | 7f8fae93824dfb08c5a5a4ad6e28612109530da49a33370eacb8deaa5fe9fd6b

General

Target

ORDER #0421 pdf.exe
Size

402KB
MD5

fcc5dca7aa404d3f6e81a4ba10359cde
SHA1

7f0426a62831d90c111dd110abd47d635a38522d
SHA256

7f8fae93824dfb08c5a5a4ad6e28612109530da49a33370eacb8deaa5fe9fd6b
SHA512

0c04243ce607693713c0f796e09c510829d6f24f1c477aaa53185930a54b64e7fb99744e6ffd123ef4bf6d27b8346280d5addb1f6b02d3fb5f5e2db697ef68ec

Score

10^/10

asyncrat persistence rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

C2

chongmei33.publicvm.com:49746

chongmei33.publicvm.com:2703

chongmei33.publicvm.com:49714

chongmei33.publicvm.com:49703

185.165.153.116:49746

185.165.153.116:2703

185.165.153.116:49714

185.165.153.116:49703

54.37.36.116:49746

54.37.36.116:2703

54.37.36.116:49714

54.37.36.116:49703

185.244.30.92:49746

185.244.30.92:2703

185.244.30.92:49714

185.244.30.92:49703

dongreg202020.duckdns.org:49746

dongreg202020.duckdns.org:2703

dongreg202020.duckdns.org:49714

dongreg202020.duckdns.org:49703

Mutex

word_6SI86kPnk

Attributes

aes_key
Hz9AIk2iuw31bDO3o1GepDyHZ5vVJkGp
anti_detection
false
autorun
false
bdos
false
delay
SEPT G8
host
chongmei33.publicvm.com,185.165.153.116,54.37.36.116,185.244.30.92,dongreg202020.duckdns.org,178.33.222.241,rahim321.duckdns.org,79.134.225.92,37.120.208.36
hwid
3
install_file
install_folder
%AppData%
mutex
word_6SI86kPnk
pastebin_config
null
port
49746,2703,49714,49703
version
0.5.7B

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
rat asyncrat

Async RAT payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/1228-23-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat
behavioral2/memory/1228-24-0x000000000040C89E-mapping.dmp	asyncrat

Executes dropped EXE 2 IoCs

Processes:

word.exeword.exe

pid process

2676 word.exe
1228 word.exe

pid	process
2676	word.exe
1228	word.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

reg.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\word = "C:\\Users\\Admin\\word.exe"	reg.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

word.exe

description pid process target process

PID 2676 set thread context of 1228 2676 word.exe word.exe

description	pid	process	target process
PID 2676 set thread context of 1228	2676	word.exe	word.exe

Suspicious behavior: EnumeratesProcesses 17 IoCs

Processes:

ORDER #0421 pdf.exeword.exe

pid	process
1404	ORDER #0421 pdf.exe
1404	ORDER #0421 pdf.exe
1404	ORDER #0421 pdf.exe
1404	ORDER #0421 pdf.exe
1404	ORDER #0421 pdf.exe
1404	ORDER #0421 pdf.exe
1404	ORDER #0421 pdf.exe
1404	ORDER #0421 pdf.exe
1404	ORDER #0421 pdf.exe
1404	ORDER #0421 pdf.exe
1404	ORDER #0421 pdf.exe
1404	ORDER #0421 pdf.exe
1404	ORDER #0421 pdf.exe
1404	ORDER #0421 pdf.exe
1404	ORDER #0421 pdf.exe
2676	word.exe
2676	word.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

ORDER #0421 pdf.exeword.exe

description pid process

Token: SeDebugPrivilege 1404 ORDER #0421 pdf.exe
Token: SeDebugPrivilege 2676 word.exe

description	pid	process
Token: SeDebugPrivilege	1404	ORDER #0421 pdf.exe
Token: SeDebugPrivilege	2676	word.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

ORDER #0421 pdf.execmd.exeword.exe

description	pid	process	target process
PID 1404 wrote to memory of 1956	1404	ORDER #0421 pdf.exe	cmd.exe
PID 1404 wrote to memory of 1956	1404	ORDER #0421 pdf.exe	cmd.exe
PID 1404 wrote to memory of 1956	1404	ORDER #0421 pdf.exe	cmd.exe
PID 1956 wrote to memory of 2680	1956	cmd.exe	reg.exe
PID 1956 wrote to memory of 2680	1956	cmd.exe	reg.exe
PID 1956 wrote to memory of 2680	1956	cmd.exe	reg.exe
PID 1404 wrote to memory of 2676	1404	ORDER #0421 pdf.exe	word.exe
PID 1404 wrote to memory of 2676	1404	ORDER #0421 pdf.exe	word.exe
PID 1404 wrote to memory of 2676	1404	ORDER #0421 pdf.exe	word.exe
PID 2676 wrote to memory of 1228	2676	word.exe	word.exe
PID 2676 wrote to memory of 1228	2676	word.exe	word.exe
PID 2676 wrote to memory of 1228	2676	word.exe	word.exe
PID 2676 wrote to memory of 1228	2676	word.exe	word.exe
PID 2676 wrote to memory of 1228	2676	word.exe	word.exe
PID 2676 wrote to memory of 1228	2676	word.exe	word.exe
PID 2676 wrote to memory of 1228	2676	word.exe	word.exe
PID 2676 wrote to memory of 1228	2676	word.exe	word.exe

C:\Users\Admin\AppData\Local\Temp\ORDER #0421 pdf.exe
"C:\Users\Admin\AppData\Local\Temp\ORDER #0421 pdf.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1404

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "word" /t REG_SZ /d "C:\Users\Admin\word.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:1956

C:\Windows\SysWOW64\reg.exe
REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "word" /t REG_SZ /d "C:\Users\Admin\word.exe"
3⤵
- Adds Run key to start application
PID:2680

C:\Users\Admin\word.exe
"C:\Users\Admin\word.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2676

C:\Users\Admin\word.exe
"C:\Users\Admin\word.exe"
3⤵
- Executes dropped EXE
PID:1228

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\word.exe
MD5
fcc5dca7aa404d3f6e81a4ba10359cde

SHA1
7f0426a62831d90c111dd110abd47d635a38522d

SHA256
7f8fae93824dfb08c5a5a4ad6e28612109530da49a33370eacb8deaa5fe9fd6b

SHA512
0c04243ce607693713c0f796e09c510829d6f24f1c477aaa53185930a54b64e7fb99744e6ffd123ef4bf6d27b8346280d5addb1f6b02d3fb5f5e2db697ef68ec

Download Submit
C:\Users\Admin\word.exe
MD5
fcc5dca7aa404d3f6e81a4ba10359cde

SHA1
7f0426a62831d90c111dd110abd47d635a38522d

SHA256
7f8fae93824dfb08c5a5a4ad6e28612109530da49a33370eacb8deaa5fe9fd6b

SHA512
0c04243ce607693713c0f796e09c510829d6f24f1c477aaa53185930a54b64e7fb99744e6ffd123ef4bf6d27b8346280d5addb1f6b02d3fb5f5e2db697ef68ec

Download Submit
C:\Users\Admin\word.exe
MD5
fcc5dca7aa404d3f6e81a4ba10359cde

SHA1
7f0426a62831d90c111dd110abd47d635a38522d

SHA256
7f8fae93824dfb08c5a5a4ad6e28612109530da49a33370eacb8deaa5fe9fd6b

SHA512
0c04243ce607693713c0f796e09c510829d6f24f1c477aaa53185930a54b64e7fb99744e6ffd123ef4bf6d27b8346280d5addb1f6b02d3fb5f5e2db697ef68ec

Download Submit
memory/1228-26-0x0000000073550000-0x0000000073C3E000-memory.dmp

Filesize
6.9MB

Download
memory/1228-24-0x000000000040C89E-mapping.dmp

Download
memory/1228-23-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1404-6-0x0000000005460000-0x000000000547E000-memory.dmp

Filesize
120KB

Download
memory/1404-2-0x0000000073550000-0x0000000073C3E000-memory.dmp

Filesize
6.9MB

Download
memory/1404-8-0x0000000007EB0000-0x0000000007EB1000-memory.dmp

Filesize
4KB

Download
memory/1404-7-0x0000000005440000-0x0000000005441000-memory.dmp

Filesize
4KB

Download
memory/1404-5-0x0000000005500000-0x0000000005501000-memory.dmp

Filesize
4KB

Download
memory/1404-3-0x0000000000B30000-0x0000000000B31000-memory.dmp

Filesize
4KB

Download
memory/1956-9-0x0000000000000000-mapping.dmp

Download
memory/2676-11-0x0000000000000000-mapping.dmp

Download
memory/2676-22-0x00000000059B0000-0x00000000059B1000-memory.dmp

Filesize
4KB

Download
memory/2676-21-0x0000000005990000-0x000000000599B000-memory.dmp

Filesize
44KB

Download
memory/2676-14-0x0000000073550000-0x0000000073C3E000-memory.dmp

Filesize
6.9MB

Download
memory/2680-10-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads