asyncrat | 77cc0ec039c99a695a94081d8462ee42b5b526a1da92bf05c65f3ff8fd40ec0c

General

Target

Geno_Quotation,pdf.exe
Size

929KB
MD5

fbf75396fc5ed9d7555effe393035109
SHA1

be62388c45754b3497e8eda1d501031fa2ca7cbf
SHA256

77cc0ec039c99a695a94081d8462ee42b5b526a1da92bf05c65f3ff8fd40ec0c
SHA512

7069b9080b288bb292fdd6fc513a3c9ac40593bc63b2631ff7214256999455369379e0e05deeabe6139bd65964db37cace8ecb1c23853496340f77e663fe5671

Score

10^/10

asyncrat rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

C2

null:null

Mutex

AsyncMutex_6SI8OkPnk

Attributes

aes_key
yFdiISTMNVqtdBU1VShPLhZnkF6gdamp
anti_detection
false
autorun
false
bdos
false
delay
billion
host
null
hwid
3
install_file
install_folder
%AppData%
mutex
AsyncMutex_6SI8OkPnk
pastebin_config
https://pastebin.com/raw/Q5Dxj1fY
port
null
version
0.5.7B

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
rat asyncrat

Async RAT payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/2684-14-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat
behavioral2/memory/2684-15-0x000000000040C77E-mapping.dmp	asyncrat

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Suspicious use of SetThreadContext 1 IoCs

Processes:

Geno_Quotation,pdf.exe

description pid process target process

PID 508 set thread context of 2684 508 Geno_Quotation,pdf.exe MSBuild.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

2232 schtasks.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

Geno_Quotation,pdf.exe

pid process

508 Geno_Quotation,pdf.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Geno_Quotation,pdf.exeMSBuild.exe

description pid process

Token: SeDebugPrivilege 508 Geno_Quotation,pdf.exe
Token: SeDebugPrivilege 2684 MSBuild.exe

description	pid	process	target process
PID 508 set thread context of 2684	508	Geno_Quotation,pdf.exe	MSBuild.exe

pid	process
2232	schtasks.exe

pid	process
508	Geno_Quotation,pdf.exe

description	pid	process
Token: SeDebugPrivilege	508	Geno_Quotation,pdf.exe
Token: SeDebugPrivilege	2684	MSBuild.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

Geno_Quotation,pdf.exe

description	pid	process	target process
PID 508 wrote to memory of 2232	508	Geno_Quotation,pdf.exe	schtasks.exe
PID 508 wrote to memory of 2232	508	Geno_Quotation,pdf.exe	schtasks.exe
PID 508 wrote to memory of 2232	508	Geno_Quotation,pdf.exe	schtasks.exe
PID 508 wrote to memory of 2684	508	Geno_Quotation,pdf.exe	MSBuild.exe
PID 508 wrote to memory of 2684	508	Geno_Quotation,pdf.exe	MSBuild.exe
PID 508 wrote to memory of 2684	508	Geno_Quotation,pdf.exe	MSBuild.exe
PID 508 wrote to memory of 2684	508	Geno_Quotation,pdf.exe	MSBuild.exe
PID 508 wrote to memory of 2684	508	Geno_Quotation,pdf.exe	MSBuild.exe
PID 508 wrote to memory of 2684	508	Geno_Quotation,pdf.exe	MSBuild.exe
PID 508 wrote to memory of 2684	508	Geno_Quotation,pdf.exe	MSBuild.exe
PID 508 wrote to memory of 2684	508	Geno_Quotation,pdf.exe	MSBuild.exe

C:\Users\Admin\AppData\Local\Temp\Geno_Quotation,pdf.exe
"C:\Users\Admin\AppData\Local\Temp\Geno_Quotation,pdf.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:508

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\qROELcojWsQAjm" /XML "C:\Users\Admin\AppData\Local\Temp\tmp3C7D.tmp"
2⤵
- Creates scheduled task(s)
PID:2232

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2684

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1

T1102

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp3C7D.tmp
MD5
5b8336e8f31676dd5620f0270d5829d9

SHA1
32871552193e3a8a349853c1930dfaf3981e630d

SHA256
001fd7466a435c22204927bdb027b8b443497296a430b034d714da95e336fa7e

SHA512
05129479afd78c0088021454fb7f181fbbda0238daa430b96383c4a9ac89db87cbf3f3649871efee45d8202b1a028f02457d4ff20b5e868a592751f7d56a286b

Download Submit
memory/508-9-0x0000000005450000-0x0000000005451000-memory.dmp

Filesize
4KB

Download
memory/508-5-0x00000000050B0000-0x00000000050B1000-memory.dmp

Filesize
4KB

Download
memory/508-6-0x00000000056A0000-0x00000000056A1000-memory.dmp

Filesize
4KB

Download
memory/508-7-0x0000000005240000-0x0000000005241000-memory.dmp

Filesize
4KB

Download
memory/508-8-0x00000000051C0000-0x00000000051C1000-memory.dmp

Filesize
4KB

Download
memory/508-2-0x0000000073520000-0x0000000073C0E000-memory.dmp

Filesize
6.9MB

Download
memory/508-10-0x0000000005200000-0x0000000005212000-memory.dmp

Filesize
72KB

Download
memory/508-11-0x0000000005EB0000-0x0000000005EF9000-memory.dmp

Filesize
292KB

Download
memory/508-3-0x00000000006D0000-0x00000000006D1000-memory.dmp

Filesize
4KB

Download
memory/2232-12-0x0000000000000000-mapping.dmp

Download
memory/2684-14-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2684-15-0x000000000040C77E-mapping.dmp

Download
memory/2684-16-0x0000000073520000-0x0000000073C0E000-memory.dmp

Filesize
6.9MB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads