asyncrat | 57dc7782af4f8595d5663d6308cf8f132ba09efe1fb53d7573ccfa298a33ed7a

General

Target

e-dekont.pdf.exe
Size

675KB
MD5

231032805835e5992d7be55cd281e28a
SHA1

a32819de35a59c23dad01c62fbb1be5a2a96fa19
SHA256

57dc7782af4f8595d5663d6308cf8f132ba09efe1fb53d7573ccfa298a33ed7a
SHA512

be6d5dca1f03d292a1f907cc7d11a85500cc315e4b8bd3fb25e63cdb6105399679e5ab3f626dd0eeb91e30df1be6264de43ee27d2187043fa5cd8fb54e544971

Score

10^/10

asyncrat rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

C2

194.156.90.31:5004

Mutex

AsyncMutex_6SI8OkPnk

Attributes

aes_key
HDFxJ480h98cocmnXczBVateXyWu1kTP
anti_detection
false
autorun
false
bdos
false
delay
Default
host
194.156.90.31
hwid
3
install_file
install_folder
%AppData%
mutex
AsyncMutex_6SI8OkPnk
pastebin_config
null
port
5004
version
0.5.7B

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
rat asyncrat

Async RAT payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/572-127-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat
behavioral2/memory/572-128-0x000000000040C71E-mapping.dmp	asyncrat

Suspicious use of SetThreadContext 1 IoCs

Processes:

e-dekont.pdf.exe

description pid process target process

PID 1456 set thread context of 572 1456 e-dekont.pdf.exe e-dekont.pdf.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

2256 schtasks.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

e-dekont.pdf.exe

description pid process

Token: SeDebugPrivilege 572 e-dekont.pdf.exe

description	pid	process	target process
PID 1456 set thread context of 572	1456	e-dekont.pdf.exe	e-dekont.pdf.exe

pid	process
2256	schtasks.exe

description	pid	process
Token: SeDebugPrivilege	572	e-dekont.pdf.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

e-dekont.pdf.exe

description	pid	process	target process
PID 1456 wrote to memory of 2256	1456	e-dekont.pdf.exe	schtasks.exe
PID 1456 wrote to memory of 2256	1456	e-dekont.pdf.exe	schtasks.exe
PID 1456 wrote to memory of 2256	1456	e-dekont.pdf.exe	schtasks.exe
PID 1456 wrote to memory of 572	1456	e-dekont.pdf.exe	e-dekont.pdf.exe
PID 1456 wrote to memory of 572	1456	e-dekont.pdf.exe	e-dekont.pdf.exe
PID 1456 wrote to memory of 572	1456	e-dekont.pdf.exe	e-dekont.pdf.exe
PID 1456 wrote to memory of 572	1456	e-dekont.pdf.exe	e-dekont.pdf.exe
PID 1456 wrote to memory of 572	1456	e-dekont.pdf.exe	e-dekont.pdf.exe
PID 1456 wrote to memory of 572	1456	e-dekont.pdf.exe	e-dekont.pdf.exe
PID 1456 wrote to memory of 572	1456	e-dekont.pdf.exe	e-dekont.pdf.exe
PID 1456 wrote to memory of 572	1456	e-dekont.pdf.exe	e-dekont.pdf.exe

C:\Users\Admin\AppData\Local\Temp\e-dekont.pdf.exe
"C:\Users\Admin\AppData\Local\Temp\e-dekont.pdf.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1456

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\nzwowTPIzFjlO" /XML "C:\Users\Admin\AppData\Local\Temp\tmp16E4.tmp"
2⤵
- Creates scheduled task(s)
PID:2256

C:\Users\Admin\AppData\Local\Temp\e-dekont.pdf.exe
"{path}"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:572

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\e-dekont.pdf.exe.log
MD5
0c2899d7c6746f42d5bbe088c777f94c

SHA1
622f66c5f7a3c91b28a9f43ce7c6cabadbf514f1

SHA256
5b0b99740cadaeff7b9891136644b396941547e20cc7eea646560d0dad5a5458

SHA512
ab7a3409ed4b6ca00358330a3aa4ef6de7d81eb21a5e24bb629ef6a7c7c4e2a70ca3accfbc989ed6e495fdb8eb6203a26d6f2a37b2a5809af4276af375b49078

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp16E4.tmp
MD5
7718bb23472ac06ed3d7e59bcac43630

SHA1
7e90caed0f0d38e05a9468515787bfff51f918e7

SHA256
bd4d39009f7820419794d0363e6e8d387eff3b55fb04451de674b203ae8bea20

SHA512
9c52964b9f62befd51a1d81fd9d1659b6e6f1171168a35c718ae78fba130ffa6c18c01834ce3c9ea8df0995696472b9aa87e5e4ed8e82e084ad97587c7dcdcdd

Download Submit
memory/572-135-0x0000000005AF0000-0x0000000005AF1000-memory.dmp

Filesize
4KB

Download
memory/572-132-0x0000000002980000-0x0000000002981000-memory.dmp

Filesize
4KB

Download
memory/572-128-0x000000000040C71E-mapping.dmp

Download
memory/572-127-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1456-119-0x00000000058A0000-0x00000000058A1000-memory.dmp

Filesize
4KB

Download
memory/1456-122-0x000000007F4F0000-0x000000007F4F1000-memory.dmp

Filesize
4KB

Download
memory/1456-123-0x000000000A2E0000-0x000000000A387000-memory.dmp

Filesize
668KB

Download
memory/1456-124-0x000000000C880000-0x000000000C8D7000-memory.dmp

Filesize
348KB

Download
memory/1456-121-0x0000000008D50000-0x0000000008D55000-memory.dmp

Filesize
20KB

Download
memory/1456-120-0x0000000008D80000-0x0000000008D81000-memory.dmp

Filesize
4KB

Download
memory/1456-114-0x0000000000FA0000-0x0000000000FA1000-memory.dmp

Filesize
4KB

Download
memory/1456-118-0x0000000005810000-0x0000000005811000-memory.dmp

Filesize
4KB

Download
memory/1456-117-0x00000000058E0000-0x00000000058E1000-memory.dmp

Filesize
4KB

Download
memory/1456-116-0x0000000005D40000-0x0000000005D41000-memory.dmp

Filesize
4KB

Download
memory/2256-125-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads