asyncrat | a3af875c94ed804c15cb508884edad66cc1d7784fbf2f42cfd450deac4e52577

General

Target

CopyexportdocumentsMay03052021ScaannedCopies7.exe
Size

182KB
MD5

561e66ab89bb2e930bb743130d676115
SHA1

dd19eebda3867a174b104ee2d26e0c6a40337253
SHA256

a3af875c94ed804c15cb508884edad66cc1d7784fbf2f42cfd450deac4e52577
SHA512

7962f76415e50389821cb3196e000a5b562d0541ac2eba078e10a3429fdb8452363daebda42e6549ba780b0017ca5ee5a9e0fc256ef8407689ef08afdff7eebb

Score

10^/10

asyncrat rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.7A

C2

asyynet.duckdns.org:5687

Mutex

ffcvfwedwsswederf4fredwseewwjjdjdhshhshd

Attributes

aes_key
KHHi77aXZ19TMUsXIRXk76wbzryWK58m
anti_detection
false
autorun
false
bdos
false
delay
TURK
host
asyynet.duckdns.org
hwid
1
install_file
install_folder
%AppData%
mutex
ffcvfwedwsswederf4fredwseewwjjdjdhshhshd
pastebin_config
null
port
5687
version
0.5.7A

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
rat asyncrat

Async RAT payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/3552-126-0x000000000040CFBE-mapping.dmp	asyncrat
behavioral2/memory/3552-125-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat

Drops startup file 2 IoCs

Processes:

CopyexportdocumentsMay03052021ScaannedCopies7.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CopyexportdocumentsMay03052021ScaannedCopies7.exe	CopyexportdocumentsMay03052021ScaannedCopies7.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CopyexportdocumentsMay03052021ScaannedCopies7.exe	CopyexportdocumentsMay03052021ScaannedCopies7.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

CopyexportdocumentsMay03052021ScaannedCopies7.exe

description	pid	process	target process
PID 808 set thread context of 3552	808	CopyexportdocumentsMay03052021ScaannedCopies7.exe	CopyexportdocumentsMay03052021ScaannedCopies7.exe

Suspicious behavior: EnumeratesProcesses 50 IoCs

Processes:

CopyexportdocumentsMay03052021ScaannedCopies7.exe

pid	process
808	CopyexportdocumentsMay03052021ScaannedCopies7.exe
808	CopyexportdocumentsMay03052021ScaannedCopies7.exe
808	CopyexportdocumentsMay03052021ScaannedCopies7.exe
808	CopyexportdocumentsMay03052021ScaannedCopies7.exe
808	CopyexportdocumentsMay03052021ScaannedCopies7.exe
808	CopyexportdocumentsMay03052021ScaannedCopies7.exe
808	CopyexportdocumentsMay03052021ScaannedCopies7.exe
808	CopyexportdocumentsMay03052021ScaannedCopies7.exe
808	CopyexportdocumentsMay03052021ScaannedCopies7.exe
808	CopyexportdocumentsMay03052021ScaannedCopies7.exe
808	CopyexportdocumentsMay03052021ScaannedCopies7.exe
808	CopyexportdocumentsMay03052021ScaannedCopies7.exe
808	CopyexportdocumentsMay03052021ScaannedCopies7.exe
808	CopyexportdocumentsMay03052021ScaannedCopies7.exe
808	CopyexportdocumentsMay03052021ScaannedCopies7.exe
808	CopyexportdocumentsMay03052021ScaannedCopies7.exe
808	CopyexportdocumentsMay03052021ScaannedCopies7.exe
808	CopyexportdocumentsMay03052021ScaannedCopies7.exe
808	CopyexportdocumentsMay03052021ScaannedCopies7.exe
808	CopyexportdocumentsMay03052021ScaannedCopies7.exe
808	CopyexportdocumentsMay03052021ScaannedCopies7.exe
808	CopyexportdocumentsMay03052021ScaannedCopies7.exe
808	CopyexportdocumentsMay03052021ScaannedCopies7.exe
808	CopyexportdocumentsMay03052021ScaannedCopies7.exe
808	CopyexportdocumentsMay03052021ScaannedCopies7.exe
808	CopyexportdocumentsMay03052021ScaannedCopies7.exe
808	CopyexportdocumentsMay03052021ScaannedCopies7.exe
808	CopyexportdocumentsMay03052021ScaannedCopies7.exe
808	CopyexportdocumentsMay03052021ScaannedCopies7.exe
808	CopyexportdocumentsMay03052021ScaannedCopies7.exe
808	CopyexportdocumentsMay03052021ScaannedCopies7.exe
808	CopyexportdocumentsMay03052021ScaannedCopies7.exe
808	CopyexportdocumentsMay03052021ScaannedCopies7.exe
808	CopyexportdocumentsMay03052021ScaannedCopies7.exe
808	CopyexportdocumentsMay03052021ScaannedCopies7.exe
808	CopyexportdocumentsMay03052021ScaannedCopies7.exe
808	CopyexportdocumentsMay03052021ScaannedCopies7.exe
808	CopyexportdocumentsMay03052021ScaannedCopies7.exe
808	CopyexportdocumentsMay03052021ScaannedCopies7.exe
808	CopyexportdocumentsMay03052021ScaannedCopies7.exe
808	CopyexportdocumentsMay03052021ScaannedCopies7.exe
808	CopyexportdocumentsMay03052021ScaannedCopies7.exe
808	CopyexportdocumentsMay03052021ScaannedCopies7.exe
808	CopyexportdocumentsMay03052021ScaannedCopies7.exe
808	CopyexportdocumentsMay03052021ScaannedCopies7.exe
808	CopyexportdocumentsMay03052021ScaannedCopies7.exe
808	CopyexportdocumentsMay03052021ScaannedCopies7.exe
808	CopyexportdocumentsMay03052021ScaannedCopies7.exe
808	CopyexportdocumentsMay03052021ScaannedCopies7.exe
808	CopyexportdocumentsMay03052021ScaannedCopies7.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

CopyexportdocumentsMay03052021ScaannedCopies7.exeCopyexportdocumentsMay03052021ScaannedCopies7.exe

description	pid	process
Token: SeDebugPrivilege	808	CopyexportdocumentsMay03052021ScaannedCopies7.exe
Token: SeDebugPrivilege	3552	CopyexportdocumentsMay03052021ScaannedCopies7.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

CopyexportdocumentsMay03052021ScaannedCopies7.exe

description	pid	process	target process
PID 808 wrote to memory of 3552	808	CopyexportdocumentsMay03052021ScaannedCopies7.exe	CopyexportdocumentsMay03052021ScaannedCopies7.exe
PID 808 wrote to memory of 3552	808	CopyexportdocumentsMay03052021ScaannedCopies7.exe	CopyexportdocumentsMay03052021ScaannedCopies7.exe
PID 808 wrote to memory of 3552	808	CopyexportdocumentsMay03052021ScaannedCopies7.exe	CopyexportdocumentsMay03052021ScaannedCopies7.exe
PID 808 wrote to memory of 3552	808	CopyexportdocumentsMay03052021ScaannedCopies7.exe	CopyexportdocumentsMay03052021ScaannedCopies7.exe
PID 808 wrote to memory of 3552	808	CopyexportdocumentsMay03052021ScaannedCopies7.exe	CopyexportdocumentsMay03052021ScaannedCopies7.exe
PID 808 wrote to memory of 3552	808	CopyexportdocumentsMay03052021ScaannedCopies7.exe	CopyexportdocumentsMay03052021ScaannedCopies7.exe
PID 808 wrote to memory of 3552	808	CopyexportdocumentsMay03052021ScaannedCopies7.exe	CopyexportdocumentsMay03052021ScaannedCopies7.exe
PID 808 wrote to memory of 3552	808	CopyexportdocumentsMay03052021ScaannedCopies7.exe	CopyexportdocumentsMay03052021ScaannedCopies7.exe

C:\Users\Admin\AppData\Local\Temp\CopyexportdocumentsMay03052021ScaannedCopies7.exe
"C:\Users\Admin\AppData\Local\Temp\CopyexportdocumentsMay03052021ScaannedCopies7.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:808

C:\Users\Admin\AppData\Local\Temp\CopyexportdocumentsMay03052021ScaannedCopies7.exe
"C:\Users\Admin\AppData\Local\Temp\CopyexportdocumentsMay03052021ScaannedCopies7.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3552

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/808-114-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download
memory/808-116-0x0000000004DB0000-0x0000000004DB1000-memory.dmp

Filesize
4KB

Download
memory/808-117-0x00000000048B0000-0x00000000048B1000-memory.dmp

Filesize
4KB

Download
memory/808-118-0x0000000004A00000-0x0000000004A01000-memory.dmp

Filesize
4KB

Download
memory/808-119-0x0000000004D80000-0x0000000004D81000-memory.dmp

Filesize
4KB

Download
memory/808-120-0x00000000048B0000-0x0000000004DAE000-memory.dmp

Filesize
5.0MB

Download
memory/808-121-0x0000000008730000-0x0000000008756000-memory.dmp

Filesize
152KB

Download
memory/808-122-0x0000000008960000-0x0000000008961000-memory.dmp

Filesize
4KB

Download
memory/808-123-0x0000000006AE0000-0x0000000006AE1000-memory.dmp

Filesize
4KB

Download
memory/808-124-0x0000000006DD0000-0x0000000006DD1000-memory.dmp

Filesize
4KB

Download
memory/3552-126-0x000000000040CFBE-mapping.dmp

Download
memory/3552-125-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/3552-129-0x0000000005080000-0x0000000005081000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads