asyncrat | 153c15e3573b191c91b9355f3c02bace3830f19108e313f64d909509420ea1a7

General

Target

INVOICE SWIFT.scr
Size

825KB
MD5

56b720aefb701c0b399f08304b2d8259
SHA1

07f620a3f16fe547cd61207f7ea73a98486da995
SHA256

153c15e3573b191c91b9355f3c02bace3830f19108e313f64d909509420ea1a7
SHA512

c3536f94d52269a14ae57347669f66a620aef75fadfe7e4c1f1674342d47d790e8611da80a4c37f8722a4a7ff3ab494e735060389a3882a949618b1c459b4387

Score

10^/10

asyncrat rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.6D

C2

127.0.0.1:6606

127.0.0.1:7707

127.0.0.1:8808

79.134.225.22:6606

79.134.225.22:7707

79.134.225.22:8808

Mutex

zcqpcbhuoliwhfa

Attributes

aes_key
UdKKLbjrvVElx2zAu9O2JlfsxRCVHO9C
anti_detection
false
autorun
false
bdos
false
delay
NEWFILE
host
127.0.0.1,79.134.225.22
hwid
1
install_file
install_folder
%AppData%
mutex
zcqpcbhuoliwhfa
pastebin_config
null
port
6606,7707,8808
version
0.5.6D

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
rat asyncrat

Async RAT payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/3344-15-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat
behavioral2/memory/3344-16-0x000000000040C63E-mapping.dmp	asyncrat

Suspicious use of SetThreadContext 1 IoCs

Processes:

INVOICE SWIFT.scr

description pid process target process

PID 4048 set thread context of 3344 4048 INVOICE SWIFT.scr INVOICE SWIFT.scr
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

3844 schtasks.exe

description	pid	process	target process
PID 4048 set thread context of 3344	4048	INVOICE SWIFT.scr	INVOICE SWIFT.scr

pid	process
3844	schtasks.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

INVOICE SWIFT.scr

description	pid	process	target process
PID 4048 wrote to memory of 3844	4048	INVOICE SWIFT.scr	schtasks.exe
PID 4048 wrote to memory of 3844	4048	INVOICE SWIFT.scr	schtasks.exe
PID 4048 wrote to memory of 3844	4048	INVOICE SWIFT.scr	schtasks.exe
PID 4048 wrote to memory of 3344	4048	INVOICE SWIFT.scr	INVOICE SWIFT.scr
PID 4048 wrote to memory of 3344	4048	INVOICE SWIFT.scr	INVOICE SWIFT.scr
PID 4048 wrote to memory of 3344	4048	INVOICE SWIFT.scr	INVOICE SWIFT.scr
PID 4048 wrote to memory of 3344	4048	INVOICE SWIFT.scr	INVOICE SWIFT.scr
PID 4048 wrote to memory of 3344	4048	INVOICE SWIFT.scr	INVOICE SWIFT.scr
PID 4048 wrote to memory of 3344	4048	INVOICE SWIFT.scr	INVOICE SWIFT.scr
PID 4048 wrote to memory of 3344	4048	INVOICE SWIFT.scr	INVOICE SWIFT.scr
PID 4048 wrote to memory of 3344	4048	INVOICE SWIFT.scr	INVOICE SWIFT.scr

C:\Users\Admin\AppData\Local\Temp\INVOICE SWIFT.scr
"C:\Users\Admin\AppData\Local\Temp\INVOICE SWIFT.scr" /S
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4048

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\uBpDtoWrOLqIoY" /XML "C:\Users\Admin\AppData\Local\Temp\tmpE417.tmp"
2⤵
- Creates scheduled task(s)
PID:3844

C:\Users\Admin\AppData\Local\Temp\INVOICE SWIFT.scr
"C:\Users\Admin\AppData\Local\Temp\INVOICE SWIFT.scr"
2⤵
PID:3344

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\INVOICE SWIFT.scr.log
MD5
90acfd72f14a512712b1a7380c0faf60

SHA1
40ba4accb8faa75887e84fb8e38d598dc8cf0f12

SHA256
20806822f0c130b340504132c1461b589261fbbc518e468f4f90733ab514cb86

SHA512
29dbf85e14e60868574cb4dc9bda83d3c229fb956733d8d2557f2475ee0e690ac9c2e72f31e02284996da6906ba2dbfa382a29b04c15a2406571d8ee19ad16b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpE417.tmp
MD5
db0bad81bdc39a509b42df5f36fa53c4

SHA1
b2dbb8ebff8cd57c3e4f9f04b87ee072fac8a576

SHA256
fa56e9295925aed40dcee0224058b9eacd94ad752cb7f5efb0a04d3d79b1d6ca

SHA512
2e4f0b77133b9a5b680aab87b9bad7058ddbd25267c962a8659dce137718a6c6529c54fcb24be33d9c7e208875ecbbe33293a91923ad4b4b027483f60f3c1b6d

Download Submit
memory/3344-18-0x0000000073820000-0x0000000073F0E000-memory.dmp

Filesize
6.9MB

Download
memory/3344-16-0x000000000040C63E-mapping.dmp

Download
memory/3344-15-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/3844-13-0x0000000000000000-mapping.dmp

Download
memory/4048-7-0x0000000007510000-0x0000000007511000-memory.dmp

Filesize
4KB

Download
memory/4048-10-0x0000000004960000-0x0000000004972000-memory.dmp

Filesize
72KB

Download
memory/4048-11-0x0000000005380000-0x00000000053AF000-memory.dmp

Filesize
188KB

Download
memory/4048-12-0x00000000053B0000-0x00000000053BF000-memory.dmp

Filesize
60KB

Download
memory/4048-9-0x0000000007720000-0x0000000007721000-memory.dmp

Filesize
4KB

Download
memory/4048-8-0x0000000007410000-0x0000000007411000-memory.dmp

Filesize
4KB

Download
memory/4048-2-0x0000000073820000-0x0000000073F0E000-memory.dmp

Filesize
6.9MB

Download
memory/4048-6-0x0000000007A10000-0x0000000007A11000-memory.dmp

Filesize
4KB

Download
memory/4048-5-0x0000000007470000-0x0000000007471000-memory.dmp

Filesize
4KB

Download
memory/4048-3-0x0000000000640000-0x0000000000641000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads