asyncrat | 9f930b3e48efa94f3db3084e3f5941a59eff5b0eb7fb29425e4f4a39b822fb6f

Analysis

max time kernel
148s
max time network
186s
platform
windows7_x64
resource
win7v20210410
submitted
05/07/2021, 22:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Chris Mike Resume.exe
Size 978KB
Sample210705-eel8hlp48e
SHA256 9f930b3e48efa94f3db3084e3f5941a59eff5b0eb7fb29425e4f4a39b822fb6f
MD5 452de3e5bb28ef5ab02e7621d0067cdc
SHA1 1075dd593ca755bc91c95724d11e3f4b6ff0d6f2
SHA512 e4a3bbe5c910e0b60594dc8d4e9113afc656963909e2d5027a6e3999631070412ba71bf78a0d05285279961a01a6ea519075783aefabbc68134af506255a672f
MD5 SHA1 SHA512

Score

10^/10

asyncrat rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

adikremix.ydns.eu:3030

Mutex

AsyncMutex_6SI8OkPnk

Attributes

aes_key
EVf3iXPqVeGNfM0v7OFtNSBkmxCEVuQk
anti_detection
false
autorun
true
bdos
false
delay
Default
host
adikremix.ydns.eu
hwid
5
install_file
install_folder
%AppData%
mutex
AsyncMutex_6SI8OkPnk
pastebin_config
null
port
3030
version
0.5.7B

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
rat asyncrat

Async RAT payload 5 IoCs

rat

resource	yara_rule
behavioral1/memory/688-65-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat
behavioral1/memory/688-66-0x000000000040D08E-mapping.dmp	asyncrat
behavioral1/memory/688-67-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat
behavioral1/memory/1560-87-0x000000000040D08E-mapping.dmp	asyncrat
behavioral1/memory/1560-89-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat

Executes dropped EXE 2 IoCs

pid	Process
360	configure.exe
1560	configure.exe

Loads dropped DLL 1 IoCs

pid	Process
364	cmd.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1072 set thread context of 688	1072	Chris Mike Resume.exe	29
PID 360 set thread context of 1560	360	configure.exe	37

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
868	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
548	timeout.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
688	Chris Mike Resume.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	688	Chris Mike Resume.exe
Token: SeDebugPrivilege	1560	configure.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 1072 wrote to memory of 688	1072	Chris Mike Resume.exe	29
PID 1072 wrote to memory of 688	1072	Chris Mike Resume.exe	29
PID 1072 wrote to memory of 688	1072	Chris Mike Resume.exe	29
PID 1072 wrote to memory of 688	1072	Chris Mike Resume.exe	29
PID 1072 wrote to memory of 688	1072	Chris Mike Resume.exe	29
PID 1072 wrote to memory of 688	1072	Chris Mike Resume.exe	29
PID 1072 wrote to memory of 688	1072	Chris Mike Resume.exe	29
PID 1072 wrote to memory of 688	1072	Chris Mike Resume.exe	29
PID 1072 wrote to memory of 688	1072	Chris Mike Resume.exe	29
PID 688 wrote to memory of 828	688	Chris Mike Resume.exe	30
PID 688 wrote to memory of 828	688	Chris Mike Resume.exe	30
PID 688 wrote to memory of 828	688	Chris Mike Resume.exe	30
PID 688 wrote to memory of 828	688	Chris Mike Resume.exe	30
PID 688 wrote to memory of 364	688	Chris Mike Resume.exe	32
PID 688 wrote to memory of 364	688	Chris Mike Resume.exe	32
PID 688 wrote to memory of 364	688	Chris Mike Resume.exe	32
PID 688 wrote to memory of 364	688	Chris Mike Resume.exe	32
PID 828 wrote to memory of 868	828	cmd.exe	34
PID 828 wrote to memory of 868	828	cmd.exe	34
PID 828 wrote to memory of 868	828	cmd.exe	34
PID 828 wrote to memory of 868	828	cmd.exe	34
PID 364 wrote to memory of 548	364	cmd.exe	35
PID 364 wrote to memory of 548	364	cmd.exe	35
PID 364 wrote to memory of 548	364	cmd.exe	35
PID 364 wrote to memory of 548	364	cmd.exe	35
PID 364 wrote to memory of 360	364	cmd.exe	36
PID 364 wrote to memory of 360	364	cmd.exe	36
PID 364 wrote to memory of 360	364	cmd.exe	36
PID 364 wrote to memory of 360	364	cmd.exe	36
PID 360 wrote to memory of 1560	360	configure.exe	37
PID 360 wrote to memory of 1560	360	configure.exe	37
PID 360 wrote to memory of 1560	360	configure.exe	37
PID 360 wrote to memory of 1560	360	configure.exe	37
PID 360 wrote to memory of 1560	360	configure.exe	37
PID 360 wrote to memory of 1560	360	configure.exe	37
PID 360 wrote to memory of 1560	360	configure.exe	37
PID 360 wrote to memory of 1560	360	configure.exe	37
PID 360 wrote to memory of 1560	360	configure.exe	37

C:\Users\Admin\AppData\Local\Temp\Chris Mike Resume.exe
"C:\Users\Admin\AppData\Local\Temp\Chris Mike Resume.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1072
- C:\Users\Admin\AppData\Local\Temp\Chris Mike Resume.exe
  "C:\Users\Admin\AppData\Local\Temp\Chris Mike Resume.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:688
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "configure" /tr '"C:\Users\Admin\AppData\Roaming\configure.exe"' & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:828
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /f /sc onlogon /rl highest /tn "configure" /tr '"C:\Users\Admin\AppData\Roaming\configure.exe"'
      4⤵
      Creates scheduled task(s)
      PID:868
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp91A5.tmp.bat""
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:364
  - - C:\Windows\SysWOW64\timeout.exe
      timeout 3
      4⤵
      Delays execution with timeout.exe
      PID:548
  - - C:\Users\Admin\AppData\Roaming\configure.exe
      "C:\Users\Admin\AppData\Roaming\configure.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of WriteProcessMemory
      PID:360
    - - C:\Users\Admin\AppData\Roaming\configure.exe
        
        "C:\Users\Admin\AppData\Roaming\configure.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1560

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/360-82-0x00000000048A0000-0x00000000048A1000-memory.dmp

Download

memory/360-80-0x0000000010950000-0x0000000010951000-memory.dmp

Download

memory/688-65-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/688-67-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/688-69-0x00000000768B1000-0x00000000768B3000-memory.dmp

Download

memory/688-70-0x0000000004BD0000-0x0000000004BD1000-memory.dmp

Download

memory/1072-61-0x0000000004D00000-0x0000000004D01000-memory.dmp

Download

memory/1072-62-0x0000000000310000-0x000000000031F000-memory.dmp

Download

memory/1072-59-0x0000000010210000-0x0000000010211000-memory.dmp

Download

memory/1072-63-0x0000000004D40000-0x0000000004DA3000-memory.dmp

Download

memory/1072-64-0x00000000005C0000-0x00000000005E7000-memory.dmp

Download

memory/1560-89-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/1560-92-0x0000000004000000-0x0000000004001000-memory.dmp

Download