asyncrat | 86a970ceae4a26b7b3cca4894885278b76aede70d85c92a2c55d9fe4d950a879

General

Target

Request For Quote.exe
Size

723KB
MD5

60b38fcb88892b72f97c72a04b03ce29
SHA1

90a9b8272b1c39aba84ceb9c53aa1b041fb61f6b
SHA256

86a970ceae4a26b7b3cca4894885278b76aede70d85c92a2c55d9fe4d950a879
SHA512

a5fe465d7fd3dc278c85be115ae060b85a069f445d3a768064e34fa51de08221368890bce5f958bc2133fbc4bfbc8393b7a0fff7a9093f80ef82dd6d8fad4477

Score

10^/10

asyncrat rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

C2

kingmethod.duckdns.org:6606

kingmethod.duckdns.org:7707

kingmethod.duckdns.org:8808

Mutex

AsyncMutex_6SI8OkPnk

Attributes

aes_key
OZXGLSBOBV86soeiTb9Hf1tQxfBtCgFw
anti_detection
false
autorun
false
bdos
false
delay
Default
host
,kingmethod.duckdns.org
hwid
3
install_file
install_folder
%AppData%
mutex
AsyncMutex_6SI8OkPnk
pastebin_config
null
port
6606,7707,8808
version
0.5.7B

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
rat asyncrat

Async RAT payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/1524-127-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat
behavioral2/memory/1524-128-0x000000000040C73E-mapping.dmp	asyncrat

Suspicious use of SetThreadContext 1 IoCs

Processes:

Request For Quote.exe

description pid process target process

PID 4804 set thread context of 1524 4804 Request For Quote.exe Request For Quote.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1160 schtasks.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Request For Quote.exeRequest For Quote.exe

description pid process

Token: SeDebugPrivilege 4804 Request For Quote.exe
Token: SeDebugPrivilege 1524 Request For Quote.exe

description	pid	process	target process
PID 4804 set thread context of 1524	4804	Request For Quote.exe	Request For Quote.exe

pid	process
1160	schtasks.exe

description	pid	process
Token: SeDebugPrivilege	4804	Request For Quote.exe
Token: SeDebugPrivilege	1524	Request For Quote.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

Request For Quote.exe

description	pid	process	target process
PID 4804 wrote to memory of 1160	4804	Request For Quote.exe	schtasks.exe
PID 4804 wrote to memory of 1160	4804	Request For Quote.exe	schtasks.exe
PID 4804 wrote to memory of 1160	4804	Request For Quote.exe	schtasks.exe
PID 4804 wrote to memory of 1524	4804	Request For Quote.exe	Request For Quote.exe
PID 4804 wrote to memory of 1524	4804	Request For Quote.exe	Request For Quote.exe
PID 4804 wrote to memory of 1524	4804	Request For Quote.exe	Request For Quote.exe
PID 4804 wrote to memory of 1524	4804	Request For Quote.exe	Request For Quote.exe
PID 4804 wrote to memory of 1524	4804	Request For Quote.exe	Request For Quote.exe
PID 4804 wrote to memory of 1524	4804	Request For Quote.exe	Request For Quote.exe
PID 4804 wrote to memory of 1524	4804	Request For Quote.exe	Request For Quote.exe
PID 4804 wrote to memory of 1524	4804	Request For Quote.exe	Request For Quote.exe

C:\Users\Admin\AppData\Local\Temp\Request For Quote.exe
"C:\Users\Admin\AppData\Local\Temp\Request For Quote.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4804

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\wTWgfPg" /XML "C:\Users\Admin\AppData\Local\Temp\tmp4E1C.tmp"
2⤵
- Creates scheduled task(s)
PID:1160

C:\Users\Admin\AppData\Local\Temp\Request For Quote.exe
"C:\Users\Admin\AppData\Local\Temp\Request For Quote.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1524

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp4E1C.tmp
MD5
f40f5a36976bf95e22f37dfcbe8dfffb

SHA1
821622d0ac3b2cbe01d05d37ce62e7b9780f2db5

SHA256
87ed212a6a473a2efb6571a1ee63c3272eb1eef58054ea4c827d6dddd06116a5

SHA512
8bf1d930c85bc3d13ee72783ab1c329032b1542f39ab197cca0600f8950be1884902dab3d292f358b7e5f4d7d7be25457452fc41e37d2220fd56a51beb317e0e

Download Submit
memory/1160-125-0x0000000000000000-mapping.dmp

Download
memory/1524-134-0x0000000005E00000-0x0000000005E01000-memory.dmp

Filesize
4KB

Download
memory/1524-131-0x0000000005240000-0x0000000005241000-memory.dmp

Filesize
4KB

Download
memory/1524-128-0x000000000040C73E-mapping.dmp

Download
memory/1524-127-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/4804-119-0x0000000005540000-0x0000000005541000-memory.dmp

Filesize
4KB

Download
memory/4804-122-0x0000000005540000-0x0000000005A3E000-memory.dmp

Filesize
5.0MB

Download
memory/4804-123-0x00000000013A0000-0x000000000140F000-memory.dmp

Filesize
444KB

Download
memory/4804-124-0x0000000001410000-0x0000000001438000-memory.dmp

Filesize
160KB

Download
memory/4804-121-0x00000000055A0000-0x00000000055BE000-memory.dmp

Filesize
120KB

Download
memory/4804-120-0x0000000005680000-0x0000000005681000-memory.dmp

Filesize
4KB

Download
memory/4804-114-0x0000000000A80000-0x0000000000A81000-memory.dmp

Filesize
4KB

Download
memory/4804-118-0x00000000055E0000-0x00000000055E1000-memory.dmp

Filesize
4KB

Download
memory/4804-117-0x0000000005A40000-0x0000000005A41000-memory.dmp

Filesize
4KB

Download
memory/4804-116-0x00000000054A0000-0x00000000054A1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads