asyncrat | c8f3d97c54386b86778a1d20917353583bcf706ffe0615d962683d55e449bcab

General

Target

Price list.xlsm
Size

64KB
MD5

dc48640ca8488d4c4e61b807ef19d11c
SHA1

e2cfbc565e62b269a7bfbdf2b3c060e52aaa6614
SHA256

c8f3d97c54386b86778a1d20917353583bcf706ffe0615d962683d55e449bcab
SHA512

06d0b3420f784cad69e11202271b99f47c7c5eeca68de9a5e01da6ebf2c5b25414ec242dd4517eeff43fcd239ec8ded073a9317c1140ae9e3c6b620b6af741b9

Score

10^/10

asyncrat evasion rat spyware stealer

Malware Config

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
rat asyncrat
Modifies visibility of file extensions in Explorer 2 TTPs
evasion

Hidden Files and Directories
T1158

Modify Registry
T1112
Downloads MZ/PE file
Executes dropped EXE 1 IoCs

Processes:

HsJzA.exe

pid process

2208 HsJzA.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

pid	process
2208	HsJzA.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

Processes:

EXCEL.EXEHsJzA.exe

pid process

784 EXCEL.EXE
2208 HsJzA.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

HsJzA.exe

pid process

2208 HsJzA.exe
2208 HsJzA.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

HsJzA.exe

description pid process

Token: SeDebugPrivilege 2208 HsJzA.exe
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

EXCEL.EXE

pid process

784 EXCEL.EXE
784 EXCEL.EXE

pid	process
2208	HsJzA.exe
2208	HsJzA.exe

description	pid	process
Token: SeDebugPrivilege	2208	HsJzA.exe

Suspicious use of SetWindowsHookEx 13 IoCs

Processes:

EXCEL.EXEHsJzA.exe

pid	process
784	EXCEL.EXE
784	EXCEL.EXE
784	EXCEL.EXE
784	EXCEL.EXE
784	EXCEL.EXE
784	EXCEL.EXE
784	EXCEL.EXE
784	EXCEL.EXE
784	EXCEL.EXE
784	EXCEL.EXE
784	EXCEL.EXE
784	EXCEL.EXE
2208	HsJzA.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

EXCEL.EXE

description pid process target process

PID 784 wrote to memory of 2208 784 EXCEL.EXE HsJzA.exe
PID 784 wrote to memory of 2208 784 EXCEL.EXE HsJzA.exe

description	pid	process	target process
PID 784 wrote to memory of 2208	784	EXCEL.EXE	HsJzA.exe
PID 784 wrote to memory of 2208	784	EXCEL.EXE	HsJzA.exe

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\Price list.xlsm"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:784

C:\Users\Admin\AppData\Local\Temp\HsJzA.exe
C:\Users\Admin\AppData\Local\Temp\HsJzA.exe
2⤵
- Executes dropped EXE
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2208

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Hidden Files and Directories

1

T1158

Privilege Escalation

Defense Evasion

Hidden Files and Directories

1

T1158

Modify Registry

1

T1112

Credential Access

Credentials in Files

1

T1081

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\HsJzA.exe
MD5
c8f1a39398783633b0fdcf9c744001ee

SHA1
db1ac98baa818def3931ccce9bd63434cf81587d

SHA256
d506b695f45cb729a6af2e18708597fe2f7df623d4f36e1ab1a4f118dbbdccf9

SHA512
d4d3c235e7224de8378b21b43f713df904903c7c01fda8ba4110469c8f9e766ea44b0ffda8ea47ec97fbc383db51f969e0fcfed7d0e0de194b891b928855c60b

Download Submit
C:\Users\Admin\AppData\Local\Temp\HsJzA.exe
MD5
c8f1a39398783633b0fdcf9c744001ee

SHA1
db1ac98baa818def3931ccce9bd63434cf81587d

SHA256
d506b695f45cb729a6af2e18708597fe2f7df623d4f36e1ab1a4f118dbbdccf9

SHA512
d4d3c235e7224de8378b21b43f713df904903c7c01fda8ba4110469c8f9e766ea44b0ffda8ea47ec97fbc383db51f969e0fcfed7d0e0de194b891b928855c60b

Download Submit
memory/784-117-0x00007FFDD78A0000-0x00007FFDD78B0000-memory.dmp

Filesize
64KB

Download
memory/784-114-0x00007FF708B70000-0x00007FF70C126000-memory.dmp

Filesize
53.7MB

Download
memory/784-118-0x00007FFDD78A0000-0x00007FFDD78B0000-memory.dmp

Filesize
64KB

Download
memory/784-121-0x00007FFDD78A0000-0x00007FFDD78B0000-memory.dmp

Filesize
64KB

Download
memory/784-122-0x00007FFDF79B0000-0x00007FFDF8A9E000-memory.dmp

Filesize
16.9MB

Download
memory/784-123-0x0000018478BE0000-0x000001847AAD5000-memory.dmp

Filesize
31.0MB

Download
memory/784-116-0x00007FFDD78A0000-0x00007FFDD78B0000-memory.dmp

Filesize
64KB

Download
memory/784-115-0x00007FFDD78A0000-0x00007FFDD78B0000-memory.dmp

Filesize
64KB

Download
memory/2208-179-0x0000000000000000-mapping.dmp

Download
memory/2208-182-0x0000000002D70000-0x0000000002D72000-memory.dmp

Filesize
8KB

Download
memory/2208-183-0x0000000002D73000-0x0000000002D75000-memory.dmp

Filesize
8KB

Download
memory/2208-184-0x0000000002D75000-0x0000000002D76000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads