asyncrat | b465151f3d0ce34aad5f35ff2647138b763f133e75d01336e9191185f58b0931

General

Target

Order 00-06022784.pdf.exe
Size

1.3MB
MD5

7821c8246c7e5af805c90fa2b4bc7bf3
SHA1

f1409b245e7da8bfe3370c3011e8d0b422a1f7f5
SHA256

b465151f3d0ce34aad5f35ff2647138b763f133e75d01336e9191185f58b0931
SHA512

4a20c4e63e5e0479a32126bc97b048e8f5cdc0bd3751017790e833f8b8374c342b9bd3e883496baefd0b79b3961970f7085ae21126c0d40cba8322fb9207dd95

Score

10^/10

asyncrat rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

C2

79.134.225.23:30493

Mutex

AsyncMutex_6SI8OkPnk

Attributes

aes_key
fAuR6N9PDMVk4kTOwMECuVUvSQaoRRKq
anti_detection
false
autorun
false
bdos
false
delay
Default
host
79.134.225.23
hwid
3
install_file
install_folder
%AppData%
mutex
AsyncMutex_6SI8OkPnk
pastebin_config
null
port
30493
version
0.5.7B

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
rat asyncrat

Async RAT payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/3352-13-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat
behavioral2/memory/3352-14-0x000000000040C70E-mapping.dmp	asyncrat

Suspicious use of SetThreadContext 1 IoCs

Processes:

Order 00-06022784.pdf.exe

description pid process target process

PID 692 set thread context of 3352 692 Order 00-06022784.pdf.exe RegSvcs.exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

Order 00-06022784.pdf.exe

pid process

692 Order 00-06022784.pdf.exe
692 Order 00-06022784.pdf.exe
692 Order 00-06022784.pdf.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Order 00-06022784.pdf.exeRegSvcs.exe

description pid process

Token: SeDebugPrivilege 692 Order 00-06022784.pdf.exe
Token: SeDebugPrivilege 3352 RegSvcs.exe

description	pid	process	target process
PID 692 set thread context of 3352	692	Order 00-06022784.pdf.exe	RegSvcs.exe

pid	process
692	Order 00-06022784.pdf.exe
692	Order 00-06022784.pdf.exe
692	Order 00-06022784.pdf.exe

description	pid	process
Token: SeDebugPrivilege	692	Order 00-06022784.pdf.exe
Token: SeDebugPrivilege	3352	RegSvcs.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

Order 00-06022784.pdf.exe

description	pid	process	target process
PID 692 wrote to memory of 3352	692	Order 00-06022784.pdf.exe	RegSvcs.exe
PID 692 wrote to memory of 3352	692	Order 00-06022784.pdf.exe	RegSvcs.exe
PID 692 wrote to memory of 3352	692	Order 00-06022784.pdf.exe	RegSvcs.exe
PID 692 wrote to memory of 3352	692	Order 00-06022784.pdf.exe	RegSvcs.exe
PID 692 wrote to memory of 3352	692	Order 00-06022784.pdf.exe	RegSvcs.exe
PID 692 wrote to memory of 3352	692	Order 00-06022784.pdf.exe	RegSvcs.exe
PID 692 wrote to memory of 3352	692	Order 00-06022784.pdf.exe	RegSvcs.exe
PID 692 wrote to memory of 3352	692	Order 00-06022784.pdf.exe	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\Order 00-06022784.pdf.exe
"C:\Users\Admin\AppData\Local\Temp\Order 00-06022784.pdf.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:692

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"{path}"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3352

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/692-2-0x0000000073160000-0x000000007384E000-memory.dmp

Filesize
6.9MB

Download
memory/692-3-0x0000000000C40000-0x0000000000C41000-memory.dmp

Filesize
4KB

Download
memory/692-5-0x0000000005570000-0x00000000055D3000-memory.dmp

Filesize
396KB

Download
memory/692-6-0x0000000006010000-0x0000000006011000-memory.dmp

Filesize
4KB

Download
memory/692-7-0x00000000055E0000-0x00000000055E1000-memory.dmp

Filesize
4KB

Download
memory/692-8-0x0000000005BB0000-0x0000000005BB1000-memory.dmp

Filesize
4KB

Download
memory/692-9-0x0000000005B80000-0x0000000005B81000-memory.dmp

Filesize
4KB

Download
memory/692-10-0x0000000005DA0000-0x0000000005DAE000-memory.dmp

Filesize
56KB

Download
memory/692-11-0x0000000008CE0000-0x0000000008D0A000-memory.dmp

Filesize
168KB

Download
memory/692-12-0x0000000008DC0000-0x0000000008DC1000-memory.dmp

Filesize
4KB

Download
memory/3352-13-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/3352-14-0x000000000040C70E-mapping.dmp

Download
memory/3352-15-0x0000000073160000-0x000000007384E000-memory.dmp

Filesize
6.9MB

Download
memory/3352-18-0x0000000004DB0000-0x0000000004DB1000-memory.dmp

Filesize
4KB

Download
memory/3352-21-0x0000000005620000-0x0000000005621000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing