asyncrat | 87ca86e54af983557503b99b5c47702b129d2c361762ee246354f836cf2ff430

General

Target

OTT MT103_211412199807_OP03202101150042_20210119_6190008_1.exe
Size

1.4MB
MD5

2de834ec25ec7651ac8fc5ad2632d84a
SHA1

f2329a7d7326e5b8309c499241b62532f3a90bff
SHA256

87ca86e54af983557503b99b5c47702b129d2c361762ee246354f836cf2ff430
SHA512

5b385636d7113ba00c977befaa5a7402434e8a787748d8adde4a5c02b73a7408f8100175f62d169ad584afdbda5bd04226623933591b9b73868090eabc7d1a29

Score

10^/10

asyncrat ransomware rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.6D

C2

meltdili.duckdns.org:8808

:8808

Mutex

uqaueqtjitmvhewi

Attributes

aes_key
HcAc1HXMTeGYmihRB0xyI7Qrdm6e5GJk
anti_detection
false
autorun
false
bdos
false
delay
Default
host
meltdili.duckdns.org,
hwid
1
install_file
install_folder
%AppData%
mutex
uqaueqtjitmvhewi
pastebin_config
null
port
8808
version
0.5.6D

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
rat asyncrat

Async RAT payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/3456-15-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat
behavioral2/memory/3456-16-0x000000000040C65E-mapping.dmp	asyncrat

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
ransomware

System Information Discovery
T1082
Suspicious use of SetThreadContext 1 IoCs

Processes:

OTT MT103_211412199807_OP03202101150042_20210119_6190008_1.exe

description pid process target process

PID 496 set thread context of 3456 496 OTT MT103_211412199807_OP03202101150042_20210119_6190008_1.exe MSBuild.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

3716 schtasks.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

MSBuild.exe

description pid process

Token: SeDebugPrivilege 3456 MSBuild.exe

description	pid	process	target process
PID 496 set thread context of 3456	496	OTT MT103_211412199807_OP03202101150042_20210119_6190008_1.exe	MSBuild.exe

pid	process
3716	schtasks.exe

description	pid	process
Token: SeDebugPrivilege	3456	MSBuild.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

OTT MT103_211412199807_OP03202101150042_20210119_6190008_1.exe

description	pid	process	target process
PID 496 wrote to memory of 3716	496	OTT MT103_211412199807_OP03202101150042_20210119_6190008_1.exe	schtasks.exe
PID 496 wrote to memory of 3716	496	OTT MT103_211412199807_OP03202101150042_20210119_6190008_1.exe	schtasks.exe
PID 496 wrote to memory of 3716	496	OTT MT103_211412199807_OP03202101150042_20210119_6190008_1.exe	schtasks.exe
PID 496 wrote to memory of 3456	496	OTT MT103_211412199807_OP03202101150042_20210119_6190008_1.exe	MSBuild.exe
PID 496 wrote to memory of 3456	496	OTT MT103_211412199807_OP03202101150042_20210119_6190008_1.exe	MSBuild.exe
PID 496 wrote to memory of 3456	496	OTT MT103_211412199807_OP03202101150042_20210119_6190008_1.exe	MSBuild.exe
PID 496 wrote to memory of 3456	496	OTT MT103_211412199807_OP03202101150042_20210119_6190008_1.exe	MSBuild.exe
PID 496 wrote to memory of 3456	496	OTT MT103_211412199807_OP03202101150042_20210119_6190008_1.exe	MSBuild.exe
PID 496 wrote to memory of 3456	496	OTT MT103_211412199807_OP03202101150042_20210119_6190008_1.exe	MSBuild.exe
PID 496 wrote to memory of 3456	496	OTT MT103_211412199807_OP03202101150042_20210119_6190008_1.exe	MSBuild.exe
PID 496 wrote to memory of 3456	496	OTT MT103_211412199807_OP03202101150042_20210119_6190008_1.exe	MSBuild.exe

C:\Users\Admin\AppData\Local\Temp\OTT MT103_211412199807_OP03202101150042_20210119_6190008_1.exe
"C:\Users\Admin\AppData\Local\Temp\OTT MT103_211412199807_OP03202101150042_20210119_6190008_1.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:496

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vwdOhJqckldWd" /XML "C:\Users\Admin\AppData\Local\Temp\tmp91B2.tmp"
2⤵
- Creates scheduled task(s)
PID:3716

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3456

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp91B2.tmp
MD5
684c9e629ae5755e8da5dcdfdb66888d

SHA1
58390daaaf51bf7bb8c7b1a15dd61c34791e9cac

SHA256
591863e4b1411423489e58fdc4b17f9a0ddb9d057b5c11bfd96909a42936c35d

SHA512
e513526a83e14b101876bff809d2b1f0b06b919cab6f600161e0362f04eb2b84518c651b9af6f8e5dd2b719571c6f6c91799467cda8f6995c4a68ead4965e63b

Download Submit
memory/496-11-0x00000000076C0000-0x00000000076E3000-memory.dmp

Filesize
140KB

Download
memory/496-10-0x0000000007790000-0x0000000007791000-memory.dmp

Filesize
4KB

Download
memory/496-6-0x00000000079C0000-0x00000000079C1000-memory.dmp

Filesize
4KB

Download
memory/496-7-0x0000000007560000-0x0000000007561000-memory.dmp

Filesize
4KB

Download
memory/496-12-0x00000000080C0000-0x000000000810B000-memory.dmp

Filesize
300KB

Download
memory/496-9-0x0000000007720000-0x0000000007721000-memory.dmp

Filesize
4KB

Download
memory/496-5-0x0000000007420000-0x0000000007421000-memory.dmp

Filesize
4KB

Download
memory/496-2-0x0000000073AD0000-0x00000000741BE000-memory.dmp

Filesize
6.9MB

Download
memory/496-8-0x00000000074F0000-0x00000000074F1000-memory.dmp

Filesize
4KB

Download
memory/496-3-0x00000000004D0000-0x00000000004D1000-memory.dmp

Filesize
4KB

Download
memory/3456-15-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/3456-16-0x000000000040C65E-mapping.dmp

Download
memory/3456-17-0x0000000073AD0000-0x00000000741BE000-memory.dmp

Filesize
6.9MB

Download
memory/3456-20-0x0000000002F40000-0x0000000002F41000-memory.dmp

Filesize
4KB

Download
memory/3456-23-0x0000000005EF0000-0x0000000005EF1000-memory.dmp

Filesize
4KB

Download
memory/3716-13-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads