asyncrat | c7a647398282460a21fe3334a15d327c975c23cfdf4e08028c440b04b0404b73

General

Target

ORDER-210067.xls.exe
Size

1.2MB
MD5

0afcb9f210ad0fbae66276f583a0d04b
SHA1

d26d65ae6cad14cbdeb1edfdca9d3eba3dee1c5c
SHA256

c7a647398282460a21fe3334a15d327c975c23cfdf4e08028c440b04b0404b73
SHA512

9aa577f488eca1846e8e10fae445164a03406189e65a8abd7a78f563af06999a0f1a97015da3cd008327ba125eacb421cf1352de6034e9ee6fbba64473b91b04

Score

10^/10

asyncrat persistence rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

C2

chongmei33.publicvm.com:2703

chongmei33.publicvm.com:49746

chongmei33.publicvm.com:49703

chongmei33.publicvm.com:46943

185.165.153.116:2703

185.165.153.116:49746

185.165.153.116:49703

185.165.153.116:46943

54.37.36.116:2703

54.37.36.116:49746

54.37.36.116:49703

54.37.36.116:46943

185.244.30.92:2703

185.244.30.92:49746

185.244.30.92:49703

185.244.30.92:46943

dongreg202020.duckdns.org:2703

dongreg202020.duckdns.org:49746

dongreg202020.duckdns.org:49703

dongreg202020.duckdns.org:46943

Mutex

AsyncMutex_6SI8OkPnk

Attributes

aes_key
URB8HbE2qoPxdQcCDSu3DcXrIBKuvbaM
anti_detection
false
autorun
false
bdos
false
delay
APP
host
chongmei33.publicvm.com,185.165.153.116,54.37.36.116,185.244.30.92,dongreg202020.duckdns.org,178.33.222.241,rahim321.duckdns.org,79.134.225.92,37.120.208.36,178.33.222.243,87.98.245.48
hwid
3
install_file
install_folder
%AppData%
mutex
AsyncMutex_6SI8OkPnk
pastebin_config
null
port
2703,49746,49703,46943
version
0.5.7B

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
rat asyncrat

Async RAT payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/1128-117-0x000000000040C92E-mapping.dmp	asyncrat
behavioral2/memory/1128-116-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat
behavioral2/memory/1128-120-0x0000000000E30000-0x0000000000F7A000-memory.dmp	asyncrat

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

ORDER-210067.xls.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\word = "C:\\Users\\Admin\\AppData\\Roaming\\word\\svchost.exe.exe"	ORDER-210067.xls.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run	ORDER-210067.xls.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

ORDER-210067.xls.exe

description pid process target process

PID 2256 set thread context of 1128 2256 ORDER-210067.xls.exe RegSvcs.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

RegSvcs.exe

description pid process

Token: SeDebugPrivilege 1128 RegSvcs.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

ORDER-210067.xls.exe

pid process

2256 ORDER-210067.xls.exe

description	pid	process	target process
PID 2256 set thread context of 1128	2256	ORDER-210067.xls.exe	RegSvcs.exe

description	pid	process
Token: SeDebugPrivilege	1128	RegSvcs.exe

pid	process
2256	ORDER-210067.xls.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

ORDER-210067.xls.exe

description	pid	process	target process
PID 2256 wrote to memory of 1128	2256	ORDER-210067.xls.exe	RegSvcs.exe
PID 2256 wrote to memory of 1128	2256	ORDER-210067.xls.exe	RegSvcs.exe
PID 2256 wrote to memory of 1128	2256	ORDER-210067.xls.exe	RegSvcs.exe
PID 2256 wrote to memory of 1128	2256	ORDER-210067.xls.exe	RegSvcs.exe
PID 2256 wrote to memory of 1128	2256	ORDER-210067.xls.exe	RegSvcs.exe
PID 2256 wrote to memory of 1128	2256	ORDER-210067.xls.exe	RegSvcs.exe
PID 2256 wrote to memory of 1128	2256	ORDER-210067.xls.exe	RegSvcs.exe
PID 2256 wrote to memory of 1128	2256	ORDER-210067.xls.exe	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\ORDER-210067.xls.exe
"C:\Users\Admin\AppData\Local\Temp\ORDER-210067.xls.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2256

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1128

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1128-117-0x000000000040C92E-mapping.dmp

Download
memory/1128-116-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1128-120-0x0000000000E30000-0x0000000000F7A000-memory.dmp

Filesize
1.3MB

Download
memory/1128-121-0x00000000059E0000-0x00000000059E1000-memory.dmp

Filesize
4KB

Download
memory/1128-122-0x0000000005F80000-0x0000000005F81000-memory.dmp

Filesize
4KB

Download
memory/1128-123-0x0000000005AF0000-0x0000000005AF1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads