asyncrat | 6bd0f63d69ebaa8e28b21e9b0f5c02e05c1213535b2881d080db1d09082e9f1d

General

Target

6BD0F63D69EBAA8E28B21E9B0F5C02E05C1213535B288.exe
Size

203KB
MD5

fb5f1a2f214dc8774c41d7a67965a733
SHA1

07bb74780172f5dd719e7c392817a0aaad27f173
SHA256

6bd0f63d69ebaa8e28b21e9b0f5c02e05c1213535b2881d080db1d09082e9f1d
SHA512

3ff2cffda73daf67b3da8c1a8a841183b97e4a6c0d3a9e62c86d7e50476ae748439b5cd61051fabd8a869e60b404b3df549700a8ace941dfbd4da241b27cd56d

Score

10^/10

asyncrat persistence rat

Malware Config

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
rat asyncrat

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

6BD0F63D69EBAA8E28B21E9B0F5C02E05C1213535B288.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,\"C:\\Users\\Admin\\AppData\\Roaming\\chromes.exe\","	6BD0F63D69EBAA8E28B21E9B0F5C02E05C1213535B288.exe

Async RAT payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/3012-134-0x00000000066B0000-0x00000000066CD000-memory.dmp	asyncrat

Executes dropped EXE 1 IoCs

Processes:

InstallUtil.exe

pid process

3012 InstallUtil.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

6BD0F63D69EBAA8E28B21E9B0F5C02E05C1213535B288.exe

description pid process target process

PID 3952 set thread context of 3012 3952 6BD0F63D69EBAA8E28B21E9B0F5C02E05C1213535B288.exe InstallUtil.exe
Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

2476 timeout.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

6BD0F63D69EBAA8E28B21E9B0F5C02E05C1213535B288.exeInstallUtil.exe

description pid process

Token: SeDebugPrivilege 3952 6BD0F63D69EBAA8E28B21E9B0F5C02E05C1213535B288.exe
Token: SeDebugPrivilege 3012 InstallUtil.exe

pid	process
3012	InstallUtil.exe

description	pid	process	target process
PID 3952 set thread context of 3012	3952	6BD0F63D69EBAA8E28B21E9B0F5C02E05C1213535B288.exe	InstallUtil.exe

pid	process
2476	timeout.exe

description	pid	process
Token: SeDebugPrivilege	3952	6BD0F63D69EBAA8E28B21E9B0F5C02E05C1213535B288.exe
Token: SeDebugPrivilege	3012	InstallUtil.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

6BD0F63D69EBAA8E28B21E9B0F5C02E05C1213535B288.exeInstallUtil.execmd.exe

description	pid	process	target process
PID 3952 wrote to memory of 3012	3952	6BD0F63D69EBAA8E28B21E9B0F5C02E05C1213535B288.exe	InstallUtil.exe
PID 3952 wrote to memory of 3012	3952	6BD0F63D69EBAA8E28B21E9B0F5C02E05C1213535B288.exe	InstallUtil.exe
PID 3952 wrote to memory of 3012	3952	6BD0F63D69EBAA8E28B21E9B0F5C02E05C1213535B288.exe	InstallUtil.exe
PID 3952 wrote to memory of 3012	3952	6BD0F63D69EBAA8E28B21E9B0F5C02E05C1213535B288.exe	InstallUtil.exe
PID 3952 wrote to memory of 3012	3952	6BD0F63D69EBAA8E28B21E9B0F5C02E05C1213535B288.exe	InstallUtil.exe
PID 3952 wrote to memory of 3012	3952	6BD0F63D69EBAA8E28B21E9B0F5C02E05C1213535B288.exe	InstallUtil.exe
PID 3952 wrote to memory of 3012	3952	6BD0F63D69EBAA8E28B21E9B0F5C02E05C1213535B288.exe	InstallUtil.exe
PID 3952 wrote to memory of 3012	3952	6BD0F63D69EBAA8E28B21E9B0F5C02E05C1213535B288.exe	InstallUtil.exe
PID 3012 wrote to memory of 1528	3012	InstallUtil.exe	cmd.exe
PID 3012 wrote to memory of 1528	3012	InstallUtil.exe	cmd.exe
PID 3012 wrote to memory of 1528	3012	InstallUtil.exe	cmd.exe
PID 1528 wrote to memory of 2476	1528	cmd.exe	timeout.exe
PID 1528 wrote to memory of 2476	1528	cmd.exe	timeout.exe
PID 1528 wrote to memory of 2476	1528	cmd.exe	timeout.exe

C:\Users\Admin\AppData\Local\Temp\6BD0F63D69EBAA8E28B21E9B0F5C02E05C1213535B288.exe
"C:\Users\Admin\AppData\Local\Temp\6BD0F63D69EBAA8E28B21E9B0F5C02E05C1213535B288.exe"
1⤵
- Modifies WinLogon for persistence
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3952

C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe
"C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3012

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp4F1B.tmp.bat""
3⤵
- Suspicious use of WriteProcessMemory
PID:1528

C:\Windows\SysWOW64\timeout.exe
timeout 3
4⤵
- Delays execution with timeout.exe
PID:2476

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

1

T1004

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe
MD5
91c9ae9c9a17a9db5e08b120e668c74c

SHA1
50770954c1ceb0bb6f1d5d3f2de2a0a065773723

SHA256
e56a7e5d3ab9675555e2897fc3faa2dd9265008a4967a7d54030ab8184d2d38f

SHA512
ca504af192e3318359d4742a2ef26ae1b5d040a4f9942782e02549a310158d5d5dbf919b4c748c31ee609d2046bd23ee0c22712891c86ae4a1e3a58c6e67647e

Download Submit
C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe
MD5
91c9ae9c9a17a9db5e08b120e668c74c

SHA1
50770954c1ceb0bb6f1d5d3f2de2a0a065773723

SHA256
e56a7e5d3ab9675555e2897fc3faa2dd9265008a4967a7d54030ab8184d2d38f

SHA512
ca504af192e3318359d4742a2ef26ae1b5d040a4f9942782e02549a310158d5d5dbf919b4c748c31ee609d2046bd23ee0c22712891c86ae4a1e3a58c6e67647e

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp4F1B.tmp.bat
MD5
bc173c9032160a671d8ef38ea4c39944

SHA1
a0bfd9a5dd8904fc652196b0547bb48f11479e1f

SHA256
a268566a47ae69e8b1d686ad9c1ce878bceaa47d7e9f3b0716361b07266b5072

SHA512
1c4704bdccc2555ea139493fbfdd70a50f90ac24905d2cd195a8fa47ed66ccaa582857585d9defb74c645c30a5df550a2f776f11eb94654ea3adb2eec8f0fbc7

Download Submit
memory/1528-137-0x0000000000000000-mapping.dmp

Download
memory/2476-139-0x0000000000000000-mapping.dmp

Download
memory/3012-129-0x0000000004F70000-0x0000000004F71000-memory.dmp

Filesize
4KB

Download
memory/3012-134-0x00000000066B0000-0x00000000066CD000-memory.dmp

Filesize
116KB

Download
memory/3012-132-0x0000000005250000-0x0000000005251000-memory.dmp

Filesize
4KB

Download
memory/3012-123-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/3012-124-0x000000000042561E-mapping.dmp

Download
memory/3012-131-0x0000000005140000-0x0000000005141000-memory.dmp

Filesize
4KB

Download
memory/3952-119-0x0000000004DB0000-0x0000000004DB1000-memory.dmp

Filesize
4KB

Download
memory/3952-114-0x0000000000080000-0x0000000000081000-memory.dmp

Filesize
4KB

Download
memory/3952-120-0x00000000049D0000-0x0000000004A10000-memory.dmp

Filesize
256KB

Download
memory/3952-122-0x0000000004970000-0x0000000004E6E000-memory.dmp

Filesize
5.0MB

Download
memory/3952-121-0x0000000004D50000-0x0000000004D51000-memory.dmp

Filesize
4KB

Download
memory/3952-118-0x00000000024B0000-0x00000000024B1000-memory.dmp

Filesize
4KB

Download
memory/3952-117-0x0000000004A10000-0x0000000004A11000-memory.dmp

Filesize
4KB

Download
memory/3952-116-0x0000000004E70000-0x0000000004E71000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads