asyncrat | 6bd0f63d69ebaa8e28b21e9b0f5c02e05c1213535b2881d080db1d09082e9f1d

General

Target

6BD0F63D69EBAA8E28B21E9B0F5C02E05C1213535B288.exe
Size

203KB
MD5

fb5f1a2f214dc8774c41d7a67965a733
SHA1

07bb74780172f5dd719e7c392817a0aaad27f173
SHA256

6bd0f63d69ebaa8e28b21e9b0f5c02e05c1213535b2881d080db1d09082e9f1d
SHA512

3ff2cffda73daf67b3da8c1a8a841183b97e4a6c0d3a9e62c86d7e50476ae748439b5cd61051fabd8a869e60b404b3df549700a8ace941dfbd4da241b27cd56d

Score

10^/10

asyncrat persistence rat

Malware Config

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
rat asyncrat

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

6BD0F63D69EBAA8E28B21E9B0F5C02E05C1213535B288.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,\"C:\\Users\\Admin\\AppData\\Roaming\\chromes.exe\","	6BD0F63D69EBAA8E28B21E9B0F5C02E05C1213535B288.exe

Executes dropped EXE 1 IoCs

Processes:

InstallUtil.exe

pid process

1600 InstallUtil.exe
Loads dropped DLL 1 IoCs

Processes:

6BD0F63D69EBAA8E28B21E9B0F5C02E05C1213535B288.exe

pid process

1096 6BD0F63D69EBAA8E28B21E9B0F5C02E05C1213535B288.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

6BD0F63D69EBAA8E28B21E9B0F5C02E05C1213535B288.exe

description pid process target process

PID 1096 set thread context of 1600 1096 6BD0F63D69EBAA8E28B21E9B0F5C02E05C1213535B288.exe InstallUtil.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

6BD0F63D69EBAA8E28B21E9B0F5C02E05C1213535B288.exeInstallUtil.exe

description pid process

Token: SeDebugPrivilege 1096 6BD0F63D69EBAA8E28B21E9B0F5C02E05C1213535B288.exe
Token: SeDebugPrivilege 1600 InstallUtil.exe

pid	process
1600	InstallUtil.exe

pid	process
1096	6BD0F63D69EBAA8E28B21E9B0F5C02E05C1213535B288.exe

description	pid	process	target process
PID 1096 set thread context of 1600	1096	6BD0F63D69EBAA8E28B21E9B0F5C02E05C1213535B288.exe	InstallUtil.exe

description	pid	process
Token: SeDebugPrivilege	1096	6BD0F63D69EBAA8E28B21E9B0F5C02E05C1213535B288.exe
Token: SeDebugPrivilege	1600	InstallUtil.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

6BD0F63D69EBAA8E28B21E9B0F5C02E05C1213535B288.exe

description	pid	process	target process
PID 1096 wrote to memory of 1600	1096	6BD0F63D69EBAA8E28B21E9B0F5C02E05C1213535B288.exe	InstallUtil.exe
PID 1096 wrote to memory of 1600	1096	6BD0F63D69EBAA8E28B21E9B0F5C02E05C1213535B288.exe	InstallUtil.exe
PID 1096 wrote to memory of 1600	1096	6BD0F63D69EBAA8E28B21E9B0F5C02E05C1213535B288.exe	InstallUtil.exe
PID 1096 wrote to memory of 1600	1096	6BD0F63D69EBAA8E28B21E9B0F5C02E05C1213535B288.exe	InstallUtil.exe
PID 1096 wrote to memory of 1600	1096	6BD0F63D69EBAA8E28B21E9B0F5C02E05C1213535B288.exe	InstallUtil.exe
PID 1096 wrote to memory of 1600	1096	6BD0F63D69EBAA8E28B21E9B0F5C02E05C1213535B288.exe	InstallUtil.exe
PID 1096 wrote to memory of 1600	1096	6BD0F63D69EBAA8E28B21E9B0F5C02E05C1213535B288.exe	InstallUtil.exe
PID 1096 wrote to memory of 1600	1096	6BD0F63D69EBAA8E28B21E9B0F5C02E05C1213535B288.exe	InstallUtil.exe
PID 1096 wrote to memory of 1600	1096	6BD0F63D69EBAA8E28B21E9B0F5C02E05C1213535B288.exe	InstallUtil.exe
PID 1096 wrote to memory of 1600	1096	6BD0F63D69EBAA8E28B21E9B0F5C02E05C1213535B288.exe	InstallUtil.exe
PID 1096 wrote to memory of 1600	1096	6BD0F63D69EBAA8E28B21E9B0F5C02E05C1213535B288.exe	InstallUtil.exe
PID 1096 wrote to memory of 1600	1096	6BD0F63D69EBAA8E28B21E9B0F5C02E05C1213535B288.exe	InstallUtil.exe

C:\Users\Admin\AppData\Local\Temp\6BD0F63D69EBAA8E28B21E9B0F5C02E05C1213535B288.exe
"C:\Users\Admin\AppData\Local\Temp\6BD0F63D69EBAA8E28B21E9B0F5C02E05C1213535B288.exe"
1⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1096

C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe
"C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1600

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

1

T1004

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe
MD5
91c9ae9c9a17a9db5e08b120e668c74c

SHA1
50770954c1ceb0bb6f1d5d3f2de2a0a065773723

SHA256
e56a7e5d3ab9675555e2897fc3faa2dd9265008a4967a7d54030ab8184d2d38f

SHA512
ca504af192e3318359d4742a2ef26ae1b5d040a4f9942782e02549a310158d5d5dbf919b4c748c31ee609d2046bd23ee0c22712891c86ae4a1e3a58c6e67647e

Download Submit
C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe
MD5
91c9ae9c9a17a9db5e08b120e668c74c

SHA1
50770954c1ceb0bb6f1d5d3f2de2a0a065773723

SHA256
e56a7e5d3ab9675555e2897fc3faa2dd9265008a4967a7d54030ab8184d2d38f

SHA512
ca504af192e3318359d4742a2ef26ae1b5d040a4f9942782e02549a310158d5d5dbf919b4c748c31ee609d2046bd23ee0c22712891c86ae4a1e3a58c6e67647e

Download Submit
\Users\Admin\AppData\Local\Temp\InstallUtil.exe
MD5
91c9ae9c9a17a9db5e08b120e668c74c

SHA1
50770954c1ceb0bb6f1d5d3f2de2a0a065773723

SHA256
e56a7e5d3ab9675555e2897fc3faa2dd9265008a4967a7d54030ab8184d2d38f

SHA512
ca504af192e3318359d4742a2ef26ae1b5d040a4f9942782e02549a310158d5d5dbf919b4c748c31ee609d2046bd23ee0c22712891c86ae4a1e3a58c6e67647e

Download Submit
memory/1096-60-0x00000000002B0000-0x00000000002B1000-memory.dmp

Filesize
4KB

Download
memory/1096-62-0x0000000001ED0000-0x0000000001ED1000-memory.dmp

Filesize
4KB

Download
memory/1096-63-0x00000000006D0000-0x0000000000710000-memory.dmp

Filesize
256KB

Download
memory/1600-66-0x000000000042561E-mapping.dmp

Download
memory/1600-65-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1600-69-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1600-71-0x0000000000F10000-0x0000000000F11000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing