asyncrat | 574a2711ba6fc60ea40eb0610a567a86a6d80a033059b5c47a2347de917da649

General

Target

2798501849fb1844af16adf13898125e2589d94929c4231be0cea89ddcb4c95a.exe
Size

632KB
MD5

a23fbc23425218221b2d5d40bfe948d0
SHA1

a81fff01ca92d5b540f3960183dd923750388ae2
SHA256

2798501849fb1844af16adf13898125e2589d94929c4231be0cea89ddcb4c95a
SHA512

6609a2c202e506aec733577ec7e15de428a7df0f17de7d50c5fe37860e6bd64871806ad1c511d1539e9dde5dc149944cedd6d4a1ec2d59a1d07b7dd261882eb2

Score

10^/10

asyncrat rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

C2

fedeloperome09.duckdns.org:1884

Mutex

AsyncMutex_6SI8OkPnk

Attributes

aes_key
rCcPIZRuOpZ1tE1foTgZDDuqhAqiDiBZ
anti_detection
false
autorun
false
bdos
false
delay
Default
host
fedeloperome09.duckdns.org
hwid
3
install_file
install_folder
%AppData%
mutex
AsyncMutex_6SI8OkPnk
pastebin_config
null
port
1884
version
0.5.7B

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
rat asyncrat

Async RAT payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/3200-141-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat
behavioral2/memory/3200-142-0x000000000040C75E-mapping.dmp	asyncrat

Suspicious use of SetThreadContext 1 IoCs

Processes:

2798501849fb1844af16adf13898125e2589d94929c4231be0cea89ddcb4c95a.exe

description	pid	process	target process
PID 708 set thread context of 3200	708	2798501849fb1844af16adf13898125e2589d94929c4231be0cea89ddcb4c95a.exe	RegSvcs.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

2204 schtasks.exe

pid	process
2204	schtasks.exe

Suspicious behavior: EnumeratesProcesses 15 IoCs

Processes:

2798501849fb1844af16adf13898125e2589d94929c4231be0cea89ddcb4c95a.exepowershell.exepowershell.exepowershell.exe

pid	process
708	2798501849fb1844af16adf13898125e2589d94929c4231be0cea89ddcb4c95a.exe
708	2798501849fb1844af16adf13898125e2589d94929c4231be0cea89ddcb4c95a.exe
708	2798501849fb1844af16adf13898125e2589d94929c4231be0cea89ddcb4c95a.exe
708	2798501849fb1844af16adf13898125e2589d94929c4231be0cea89ddcb4c95a.exe
708	2798501849fb1844af16adf13898125e2589d94929c4231be0cea89ddcb4c95a.exe
2732	powershell.exe
708	2798501849fb1844af16adf13898125e2589d94929c4231be0cea89ddcb4c95a.exe
984	powershell.exe
4080	powershell.exe
4080	powershell.exe
2732	powershell.exe
984	powershell.exe
984	powershell.exe
2732	powershell.exe
4080	powershell.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

2798501849fb1844af16adf13898125e2589d94929c4231be0cea89ddcb4c95a.exepowershell.exepowershell.exepowershell.exeRegSvcs.exe

description	pid	process
Token: SeDebugPrivilege	708	2798501849fb1844af16adf13898125e2589d94929c4231be0cea89ddcb4c95a.exe
Token: SeDebugPrivilege	984	powershell.exe
Token: SeDebugPrivilege	2732	powershell.exe
Token: SeDebugPrivilege	4080	powershell.exe
Token: SeDebugPrivilege	3200	RegSvcs.exe

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

2798501849fb1844af16adf13898125e2589d94929c4231be0cea89ddcb4c95a.exe

description	pid	process	target process
PID 708 wrote to memory of 2732	708	2798501849fb1844af16adf13898125e2589d94929c4231be0cea89ddcb4c95a.exe	powershell.exe
PID 708 wrote to memory of 2732	708	2798501849fb1844af16adf13898125e2589d94929c4231be0cea89ddcb4c95a.exe	powershell.exe
PID 708 wrote to memory of 2732	708	2798501849fb1844af16adf13898125e2589d94929c4231be0cea89ddcb4c95a.exe	powershell.exe
PID 708 wrote to memory of 984	708	2798501849fb1844af16adf13898125e2589d94929c4231be0cea89ddcb4c95a.exe	powershell.exe
PID 708 wrote to memory of 984	708	2798501849fb1844af16adf13898125e2589d94929c4231be0cea89ddcb4c95a.exe	powershell.exe
PID 708 wrote to memory of 984	708	2798501849fb1844af16adf13898125e2589d94929c4231be0cea89ddcb4c95a.exe	powershell.exe
PID 708 wrote to memory of 2204	708	2798501849fb1844af16adf13898125e2589d94929c4231be0cea89ddcb4c95a.exe	schtasks.exe
PID 708 wrote to memory of 2204	708	2798501849fb1844af16adf13898125e2589d94929c4231be0cea89ddcb4c95a.exe	schtasks.exe
PID 708 wrote to memory of 2204	708	2798501849fb1844af16adf13898125e2589d94929c4231be0cea89ddcb4c95a.exe	schtasks.exe
PID 708 wrote to memory of 4080	708	2798501849fb1844af16adf13898125e2589d94929c4231be0cea89ddcb4c95a.exe	powershell.exe
PID 708 wrote to memory of 4080	708	2798501849fb1844af16adf13898125e2589d94929c4231be0cea89ddcb4c95a.exe	powershell.exe
PID 708 wrote to memory of 4080	708	2798501849fb1844af16adf13898125e2589d94929c4231be0cea89ddcb4c95a.exe	powershell.exe
PID 708 wrote to memory of 1792	708	2798501849fb1844af16adf13898125e2589d94929c4231be0cea89ddcb4c95a.exe	RegSvcs.exe
PID 708 wrote to memory of 1792	708	2798501849fb1844af16adf13898125e2589d94929c4231be0cea89ddcb4c95a.exe	RegSvcs.exe
PID 708 wrote to memory of 1792	708	2798501849fb1844af16adf13898125e2589d94929c4231be0cea89ddcb4c95a.exe	RegSvcs.exe
PID 708 wrote to memory of 3200	708	2798501849fb1844af16adf13898125e2589d94929c4231be0cea89ddcb4c95a.exe	RegSvcs.exe
PID 708 wrote to memory of 3200	708	2798501849fb1844af16adf13898125e2589d94929c4231be0cea89ddcb4c95a.exe	RegSvcs.exe
PID 708 wrote to memory of 3200	708	2798501849fb1844af16adf13898125e2589d94929c4231be0cea89ddcb4c95a.exe	RegSvcs.exe
PID 708 wrote to memory of 3200	708	2798501849fb1844af16adf13898125e2589d94929c4231be0cea89ddcb4c95a.exe	RegSvcs.exe
PID 708 wrote to memory of 3200	708	2798501849fb1844af16adf13898125e2589d94929c4231be0cea89ddcb4c95a.exe	RegSvcs.exe
PID 708 wrote to memory of 3200	708	2798501849fb1844af16adf13898125e2589d94929c4231be0cea89ddcb4c95a.exe	RegSvcs.exe
PID 708 wrote to memory of 3200	708	2798501849fb1844af16adf13898125e2589d94929c4231be0cea89ddcb4c95a.exe	RegSvcs.exe
PID 708 wrote to memory of 3200	708	2798501849fb1844af16adf13898125e2589d94929c4231be0cea89ddcb4c95a.exe	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\2798501849fb1844af16adf13898125e2589d94929c4231be0cea89ddcb4c95a.exe
"C:\Users\Admin\AppData\Local\Temp\2798501849fb1844af16adf13898125e2589d94929c4231be0cea89ddcb4c95a.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:708

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\2798501849fb1844af16adf13898125e2589d94929c4231be0cea89ddcb4c95a.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2732

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\ASGsaVXzY.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:984

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ASGsaVXzY" /XML "C:\Users\Admin\AppData\Local\Temp\tmp4D32.tmp"
2⤵
- Creates scheduled task(s)
PID:2204

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\ASGsaVXzY.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4080

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
2⤵
PID:1792

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3200

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
MD5
1c19c16e21c97ed42d5beabc93391fc5

SHA1
8ad83f8e0b3acf8dfbbf87931e41f0d664c4df68

SHA256
1bcd97396c83babfe6c5068ba590d7a3f8b70e72955a9d1e4070648e404cbf05

SHA512
7d18776d8f649b3d29c182ff03efc6cea8b527542ee55304980f24577aae8b64e37044407776e220984346c3998ace5f8853afa58c8b38407482a728e9495e0c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
MD5
36f67e6476ed9e4a7753939ce8f44a0c

SHA1
1d21194625ab2039f125d725b1a21054399ea709

SHA256
45dd9a473709f1b92fde0dbe8756d12285dc8b35ba3706ed10807f9ff8d087fd

SHA512
c8e6c443317d6b7f31cec045d4672707e4e73c7df32754ef7f5ece5b2cd633e997312b6fa0d8f999cb87cd0865cb843e26f8398d4d7d6b8974fa3ddc7641ca0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
MD5
4b85e4ca0d24c909c5c845b551150fe4

SHA1
be5e48d591f1a702fa6872673aa8f7fc9456584f

SHA256
0e86a5ddbe01cd8530af1962f4e0254eb7ff772e2115dae567de53048f0058e7

SHA512
3e956b484725caee5f48bdde24e018d2804ea6e31217d2521e8e87396679af7613266941474b82d0464b4237953519dea3365e5a8167209241424496683666e1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp4D32.tmp
MD5
b6c1231e25024c5c049e54a661278b68

SHA1
4717c2c54ff1d5b2ce614da338c9f3ad2985d112

SHA256
9b7ea7648a7d9fb9efdbc74096d98507acee1425ef8b52d512df094755e75f13

SHA512
a1c45921aa81caa5b61622f49174abdc77ffe2e131a37e52d28f9c14c48a781677a1c1ce362aa1f8f1830d398036a750bb39a2efa371a487318d6cbd156d9661

Download Submit
memory/708-121-0x0000000005470000-0x0000000005471000-memory.dmp

Filesize
4KB

Download
memory/708-119-0x0000000005330000-0x000000000582E000-memory.dmp

Filesize
5.0MB

Download
memory/708-120-0x0000000005250000-0x0000000005251000-memory.dmp

Filesize
4KB

Download
memory/708-122-0x0000000005D30000-0x0000000005D31000-memory.dmp

Filesize
4KB

Download
memory/708-123-0x0000000006120000-0x0000000006129000-memory.dmp

Filesize
36KB

Download
memory/708-124-0x0000000001200000-0x0000000001264000-memory.dmp

Filesize
400KB

Download
memory/708-125-0x0000000000F00000-0x0000000000F1D000-memory.dmp

Filesize
116KB

Download
memory/708-118-0x00000000053D0000-0x00000000053D1000-memory.dmp

Filesize
4KB

Download
memory/708-117-0x0000000005830000-0x0000000005831000-memory.dmp

Filesize
4KB

Download
memory/708-116-0x0000000005270000-0x0000000005271000-memory.dmp

Filesize
4KB

Download
memory/708-114-0x00000000009A0000-0x00000000009A1000-memory.dmp

Filesize
4KB

Download
memory/984-165-0x0000000008040000-0x0000000008041000-memory.dmp

Filesize
4KB

Download
memory/984-152-0x0000000006F10000-0x0000000006F11000-memory.dmp

Filesize
4KB

Download
memory/984-130-0x0000000000000000-mapping.dmp

Download
memory/984-197-0x0000000006F13000-0x0000000006F14000-memory.dmp

Filesize
4KB

Download
memory/984-194-0x000000007EF40000-0x000000007EF41000-memory.dmp

Filesize
4KB

Download
memory/984-171-0x0000000008410000-0x0000000008411000-memory.dmp

Filesize
4KB

Download
memory/984-156-0x0000000007460000-0x0000000007461000-memory.dmp

Filesize
4KB

Download
memory/984-150-0x00000000072C0000-0x00000000072C1000-memory.dmp

Filesize
4KB

Download
memory/984-153-0x0000000006F12000-0x0000000006F13000-memory.dmp

Filesize
4KB

Download
memory/2204-132-0x0000000000000000-mapping.dmp

Download
memory/2732-192-0x000000007ED90000-0x000000007ED91000-memory.dmp

Filesize
4KB

Download
memory/2732-144-0x00000000068F0000-0x00000000068F1000-memory.dmp

Filesize
4KB

Download
memory/2732-126-0x0000000000000000-mapping.dmp

Download
memory/2732-158-0x0000000006D20000-0x0000000006D21000-memory.dmp

Filesize
4KB

Download
memory/2732-162-0x0000000007560000-0x0000000007561000-memory.dmp

Filesize
4KB

Download
memory/2732-131-0x0000000006F30000-0x0000000006F31000-memory.dmp

Filesize
4KB

Download
memory/2732-129-0x0000000000920000-0x0000000000921000-memory.dmp

Filesize
4KB

Download
memory/2732-145-0x00000000068F2000-0x00000000068F3000-memory.dmp

Filesize
4KB

Download
memory/2732-195-0x00000000068F3000-0x00000000068F4000-memory.dmp

Filesize
4KB

Download
memory/3200-142-0x000000000040C75E-mapping.dmp

Download
memory/3200-180-0x0000000004F60000-0x0000000004F61000-memory.dmp

Filesize
4KB

Download
memory/3200-141-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/4080-154-0x0000000006A20000-0x0000000006A21000-memory.dmp

Filesize
4KB

Download
memory/4080-193-0x000000007F2C0000-0x000000007F2C1000-memory.dmp

Filesize
4KB

Download
memory/4080-196-0x0000000006A23000-0x0000000006A24000-memory.dmp

Filesize
4KB

Download
memory/4080-168-0x00000000082C0000-0x00000000082C1000-memory.dmp

Filesize
4KB

Download
memory/4080-138-0x0000000000000000-mapping.dmp

Download
memory/4080-148-0x0000000006A22000-0x0000000006A23000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads