asyncrat | 77cc0ec039c99a695a94081d8462ee42b5b526a1da92bf05c65f3ff8fd40ec0c

General

Target

Geno_Quotation,pdf.exe
Size

929KB
MD5

fbf75396fc5ed9d7555effe393035109
SHA1

be62388c45754b3497e8eda1d501031fa2ca7cbf
SHA256

77cc0ec039c99a695a94081d8462ee42b5b526a1da92bf05c65f3ff8fd40ec0c
SHA512

7069b9080b288bb292fdd6fc513a3c9ac40593bc63b2631ff7214256999455369379e0e05deeabe6139bd65964db37cace8ecb1c23853496340f77e663fe5671

Score

10^/10

asyncrat rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

C2

null:null

Mutex

AsyncMutex_6SI8OkPnk

Attributes

aes_key
yFdiISTMNVqtdBU1VShPLhZnkF6gdamp
anti_detection
false
autorun
false
bdos
false
delay
billion
host
null
hwid
3
install_file
install_folder
%AppData%
mutex
AsyncMutex_6SI8OkPnk
pastebin_config
https://pastebin.com/raw/Q5Dxj1fY
port
null
version
0.5.7B

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
rat asyncrat

Async RAT payload 4 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1828-9-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat
behavioral1/memory/1828-10-0x000000000040C77E-mapping.dmp	asyncrat
behavioral1/memory/1828-11-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat
behavioral1/memory/1828-12-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Suspicious use of SetThreadContext 1 IoCs

Processes:

Geno_Quotation,pdf.exe

description pid process target process

PID 648 set thread context of 1828 648 Geno_Quotation,pdf.exe MSBuild.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1612 schtasks.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

MSBuild.exe

description pid process

Token: SeDebugPrivilege 1828 MSBuild.exe

description	pid	process	target process
PID 648 set thread context of 1828	648	Geno_Quotation,pdf.exe	MSBuild.exe

pid	process
1612	schtasks.exe

description	pid	process
Token: SeDebugPrivilege	1828	MSBuild.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

Geno_Quotation,pdf.exe

description	pid	process	target process
PID 648 wrote to memory of 1612	648	Geno_Quotation,pdf.exe	schtasks.exe
PID 648 wrote to memory of 1612	648	Geno_Quotation,pdf.exe	schtasks.exe
PID 648 wrote to memory of 1612	648	Geno_Quotation,pdf.exe	schtasks.exe
PID 648 wrote to memory of 1612	648	Geno_Quotation,pdf.exe	schtasks.exe
PID 648 wrote to memory of 1828	648	Geno_Quotation,pdf.exe	MSBuild.exe
PID 648 wrote to memory of 1828	648	Geno_Quotation,pdf.exe	MSBuild.exe
PID 648 wrote to memory of 1828	648	Geno_Quotation,pdf.exe	MSBuild.exe
PID 648 wrote to memory of 1828	648	Geno_Quotation,pdf.exe	MSBuild.exe
PID 648 wrote to memory of 1828	648	Geno_Quotation,pdf.exe	MSBuild.exe
PID 648 wrote to memory of 1828	648	Geno_Quotation,pdf.exe	MSBuild.exe
PID 648 wrote to memory of 1828	648	Geno_Quotation,pdf.exe	MSBuild.exe
PID 648 wrote to memory of 1828	648	Geno_Quotation,pdf.exe	MSBuild.exe
PID 648 wrote to memory of 1828	648	Geno_Quotation,pdf.exe	MSBuild.exe

C:\Users\Admin\AppData\Local\Temp\Geno_Quotation,pdf.exe
"C:\Users\Admin\AppData\Local\Temp\Geno_Quotation,pdf.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:648

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\qROELcojWsQAjm" /XML "C:\Users\Admin\AppData\Local\Temp\tmpD539.tmp"
2⤵
- Creates scheduled task(s)
PID:1612

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1828

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1

T1102

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpD539.tmp
MD5
f818cd39f60f7bc4e9ab7d46d5b9a9c9

SHA1
8ea89b00ae5bdc26008bbc4956845f2dd74f5c29

SHA256
8127b3d066d3ae4fe2c7f43995ab3638e019e8b7fe797c7d4c1e6808e28c3411

SHA512
ec8207b31a23bb6c417de0dd4cb12e7a4b8fa0581e4cf95beaf1ee12a4139c34fb1601f92cbfbcb1e8f176428507327b647bdc948d16cba48522eed4d313556b

Download Submit
memory/648-2-0x00000000746F0000-0x0000000074DDE000-memory.dmp

Filesize
6.9MB

Download
memory/648-3-0x0000000000AE0000-0x0000000000AE1000-memory.dmp

Filesize
4KB

Download
memory/648-5-0x0000000000310000-0x0000000000322000-memory.dmp

Filesize
72KB

Download
memory/648-6-0x00000000044B0000-0x00000000044F9000-memory.dmp

Filesize
292KB

Download
memory/1612-7-0x0000000000000000-mapping.dmp

Download
memory/1828-9-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1828-10-0x000000000040C77E-mapping.dmp

Download
memory/1828-11-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1828-12-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1828-13-0x00000000746F0000-0x0000000074DDE000-memory.dmp

Filesize
6.9MB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads