asyncrat | 5cefff6712f29c6f7fe30bfd3f7d1e790e5474ef242304a91348369b3c1afcab

General

Target

PAYMENT_COPIER-PDF.exe
Size

614KB
MD5

420b8126273bae41ebcf03c1d90ff581
SHA1

d30d32a0993778df3823e8a7a896ddcab8fd8c94
SHA256

5cefff6712f29c6f7fe30bfd3f7d1e790e5474ef242304a91348369b3c1afcab
SHA512

5809f09897dc4fa94c15f29f5942ca873ad74a4509e5e28db54dd739fd171cf68046321bb61afc54a9795d315962822afdc9dfe99d9a9b8612e1b98a7cffb7da

Score

10^/10

asyncrat rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.6D

C2

127.0.0.1:6606

127.0.0.1:7707

127.0.0.1:8808

79.134.225.22:6606

79.134.225.22:7707

79.134.225.22:8808

91.193.75.122:6606

91.193.75.122:7707

91.193.75.122:8808

Mutex

zvnqorsaslyyrhro

Attributes

aes_key
RqLMDJRwW683DhbzEvUdl4n3FCMZGQW8
anti_detection
false
autorun
false
bdos
false
delay
NEWFILE
host
127.0.0.1,79.134.225.22,91.193.75.122
hwid
10
install_file
install_folder
%AppData%
mutex
zvnqorsaslyyrhro
pastebin_config
null
port
6606,7707,8808
version
0.5.6D

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
rat asyncrat

Async RAT payload 4 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/332-9-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat
behavioral1/memory/332-10-0x000000000040C67E-mapping.dmp	asyncrat
behavioral1/memory/332-11-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat
behavioral1/memory/332-12-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat

Suspicious use of SetThreadContext 1 IoCs

Processes:

PAYMENT_COPIER-PDF.exe

description pid process target process

PID 1080 set thread context of 332 1080 PAYMENT_COPIER-PDF.exe PAYMENT_COPIER-PDF.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1748 schtasks.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

PAYMENT_COPIER-PDF.exe

pid process

1080 PAYMENT_COPIER-PDF.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

PAYMENT_COPIER-PDF.exe

description pid process

Token: SeDebugPrivilege 1080 PAYMENT_COPIER-PDF.exe

description	pid	process	target process
PID 1080 set thread context of 332	1080	PAYMENT_COPIER-PDF.exe	PAYMENT_COPIER-PDF.exe

pid	process
1748	schtasks.exe

pid	process
1080	PAYMENT_COPIER-PDF.exe

description	pid	process
Token: SeDebugPrivilege	1080	PAYMENT_COPIER-PDF.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

PAYMENT_COPIER-PDF.exe

description	pid	process	target process
PID 1080 wrote to memory of 1748	1080	PAYMENT_COPIER-PDF.exe	schtasks.exe
PID 1080 wrote to memory of 1748	1080	PAYMENT_COPIER-PDF.exe	schtasks.exe
PID 1080 wrote to memory of 1748	1080	PAYMENT_COPIER-PDF.exe	schtasks.exe
PID 1080 wrote to memory of 1748	1080	PAYMENT_COPIER-PDF.exe	schtasks.exe
PID 1080 wrote to memory of 332	1080	PAYMENT_COPIER-PDF.exe	PAYMENT_COPIER-PDF.exe
PID 1080 wrote to memory of 332	1080	PAYMENT_COPIER-PDF.exe	PAYMENT_COPIER-PDF.exe
PID 1080 wrote to memory of 332	1080	PAYMENT_COPIER-PDF.exe	PAYMENT_COPIER-PDF.exe
PID 1080 wrote to memory of 332	1080	PAYMENT_COPIER-PDF.exe	PAYMENT_COPIER-PDF.exe
PID 1080 wrote to memory of 332	1080	PAYMENT_COPIER-PDF.exe	PAYMENT_COPIER-PDF.exe
PID 1080 wrote to memory of 332	1080	PAYMENT_COPIER-PDF.exe	PAYMENT_COPIER-PDF.exe
PID 1080 wrote to memory of 332	1080	PAYMENT_COPIER-PDF.exe	PAYMENT_COPIER-PDF.exe
PID 1080 wrote to memory of 332	1080	PAYMENT_COPIER-PDF.exe	PAYMENT_COPIER-PDF.exe
PID 1080 wrote to memory of 332	1080	PAYMENT_COPIER-PDF.exe	PAYMENT_COPIER-PDF.exe

C:\Users\Admin\AppData\Local\Temp\PAYMENT_COPIER-PDF.exe
"C:\Users\Admin\AppData\Local\Temp\PAYMENT_COPIER-PDF.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1080

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\oiNZSLSVfD" /XML "C:\Users\Admin\AppData\Local\Temp\tmp6B9E.tmp"
2⤵
- Creates scheduled task(s)
PID:1748

C:\Users\Admin\AppData\Local\Temp\PAYMENT_COPIER-PDF.exe
"C:\Users\Admin\AppData\Local\Temp\PAYMENT_COPIER-PDF.exe"
2⤵
PID:332

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp6B9E.tmp
MD5
2ae038a47c165f5de9c9d28062c65743

SHA1
9b24e79881a9611f3c4a1306b6f375989d801557

SHA256
87e3a97e58bd5fd3e30e4af2f2ccb30b1a6befaa8f2899897d297005aabb1c4e

SHA512
6f4cf17bc9058f66168e81f2eacbd975dbe00c35e53f071a07294ec130c0590a389a9d6ebba7bed22144288640e055f64a5a71a870fa0b0488c30a1a37493cd1

Download Submit
memory/332-9-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/332-10-0x000000000040C67E-mapping.dmp

Download
memory/332-11-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/332-12-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/332-13-0x0000000074CF0000-0x00000000753DE000-memory.dmp

Filesize
6.9MB

Download
memory/1080-2-0x0000000074CF0000-0x00000000753DE000-memory.dmp

Filesize
6.9MB

Download
memory/1080-3-0x0000000000960000-0x0000000000961000-memory.dmp

Filesize
4KB

Download
memory/1080-5-0x00000000004E0000-0x00000000004F2000-memory.dmp

Filesize
72KB

Download
memory/1080-6-0x00000000041F0000-0x0000000004234000-memory.dmp

Filesize
272KB

Download
memory/1748-7-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads