asyncrat | 9f930b3e48efa94f3db3084e3f5941a59eff5b0eb7fb29425e4f4a39b822fb6f

Analysis

max time kernel
146s
max time network
149s
platform
windows10_x64
resource
win10v20210410
submitted
05/07/2021, 22:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Chris Mike Resume.exe
Size 978KB
Sample210705-eel8hlp48e
SHA256 9f930b3e48efa94f3db3084e3f5941a59eff5b0eb7fb29425e4f4a39b822fb6f
MD5 452de3e5bb28ef5ab02e7621d0067cdc
SHA1 1075dd593ca755bc91c95724d11e3f4b6ff0d6f2
SHA512 e4a3bbe5c910e0b60594dc8d4e9113afc656963909e2d5027a6e3999631070412ba71bf78a0d05285279961a01a6ea519075783aefabbc68134af506255a672f
MD5 SHA1 SHA512

Score

10^/10

asyncrat rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

adikremix.ydns.eu:3030

Mutex

AsyncMutex_6SI8OkPnk

Attributes

aes_key
EVf3iXPqVeGNfM0v7OFtNSBkmxCEVuQk
anti_detection
false
autorun
true
bdos
false
delay
Default
host
adikremix.ydns.eu
hwid
5
install_file
install_folder
%AppData%
mutex
AsyncMutex_6SI8OkPnk
pastebin_config
null
port
3030
version
0.5.7B

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
rat asyncrat

Async RAT payload 3 IoCs

rat

resource	yara_rule
behavioral2/memory/3856-124-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat
behavioral2/memory/3856-125-0x000000000040D08E-mapping.dmp	asyncrat
behavioral2/memory/1928-150-0x000000000040D08E-mapping.dmp	asyncrat

Executes dropped EXE 2 IoCs

pid	Process
2720	configure.exe
1928	configure.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 3916 set thread context of 3856	3916	Chris Mike Resume.exe	79
PID 2720 set thread context of 1928	2720	configure.exe	87

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1212	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
1380	timeout.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
3856	Chris Mike Resume.exe
3856	Chris Mike Resume.exe
3856	Chris Mike Resume.exe
3856	Chris Mike Resume.exe
3856	Chris Mike Resume.exe
3856	Chris Mike Resume.exe
3856	Chris Mike Resume.exe
3856	Chris Mike Resume.exe
3856	Chris Mike Resume.exe
3856	Chris Mike Resume.exe
3856	Chris Mike Resume.exe
3856	Chris Mike Resume.exe
3856	Chris Mike Resume.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3856	Chris Mike Resume.exe
Token: SeDebugPrivilege	1928	configure.exe

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 3916 wrote to memory of 3856	3916	Chris Mike Resume.exe	79
PID 3916 wrote to memory of 3856	3916	Chris Mike Resume.exe	79
PID 3916 wrote to memory of 3856	3916	Chris Mike Resume.exe	79
PID 3916 wrote to memory of 3856	3916	Chris Mike Resume.exe	79
PID 3916 wrote to memory of 3856	3916	Chris Mike Resume.exe	79
PID 3916 wrote to memory of 3856	3916	Chris Mike Resume.exe	79
PID 3916 wrote to memory of 3856	3916	Chris Mike Resume.exe	79
PID 3916 wrote to memory of 3856	3916	Chris Mike Resume.exe	79
PID 3856 wrote to memory of 2104	3856	Chris Mike Resume.exe	80
PID 3856 wrote to memory of 2104	3856	Chris Mike Resume.exe	80
PID 3856 wrote to memory of 2104	3856	Chris Mike Resume.exe	80
PID 3856 wrote to memory of 2088	3856	Chris Mike Resume.exe	81
PID 3856 wrote to memory of 2088	3856	Chris Mike Resume.exe	81
PID 3856 wrote to memory of 2088	3856	Chris Mike Resume.exe	81
PID 2104 wrote to memory of 1212	2104	cmd.exe	84
PID 2104 wrote to memory of 1212	2104	cmd.exe	84
PID 2104 wrote to memory of 1212	2104	cmd.exe	84
PID 2088 wrote to memory of 1380	2088	cmd.exe	85
PID 2088 wrote to memory of 1380	2088	cmd.exe	85
PID 2088 wrote to memory of 1380	2088	cmd.exe	85
PID 2088 wrote to memory of 2720	2088	cmd.exe	86
PID 2088 wrote to memory of 2720	2088	cmd.exe	86
PID 2088 wrote to memory of 2720	2088	cmd.exe	86
PID 2720 wrote to memory of 1928	2720	configure.exe	87
PID 2720 wrote to memory of 1928	2720	configure.exe	87
PID 2720 wrote to memory of 1928	2720	configure.exe	87
PID 2720 wrote to memory of 1928	2720	configure.exe	87
PID 2720 wrote to memory of 1928	2720	configure.exe	87
PID 2720 wrote to memory of 1928	2720	configure.exe	87
PID 2720 wrote to memory of 1928	2720	configure.exe	87
PID 2720 wrote to memory of 1928	2720	configure.exe	87

C:\Users\Admin\AppData\Local\Temp\Chris Mike Resume.exe
"C:\Users\Admin\AppData\Local\Temp\Chris Mike Resume.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3916
- C:\Users\Admin\AppData\Local\Temp\Chris Mike Resume.exe
  "C:\Users\Admin\AppData\Local\Temp\Chris Mike Resume.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3856
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "configure" /tr '"C:\Users\Admin\AppData\Roaming\configure.exe"' & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2104
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /f /sc onlogon /rl highest /tn "configure" /tr '"C:\Users\Admin\AppData\Roaming\configure.exe"'
      4⤵
      Creates scheduled task(s)
      PID:1212
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp1E37.tmp.bat""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2088
  - - C:\Windows\SysWOW64\timeout.exe
      timeout 3
      4⤵
      Delays execution with timeout.exe
      PID:1380
  - - C:\Users\Admin\AppData\Roaming\configure.exe
      "C:\Users\Admin\AppData\Roaming\configure.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of WriteProcessMemory
      PID:2720
    - - C:\Users\Admin\AppData\Roaming\configure.exe
        
        "C:\Users\Admin\AppData\Roaming\configure.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1928

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1928-155-0x00000000030B0000-0x00000000030B1000-memory.dmp

Download

memory/2720-144-0x00000000058E0000-0x0000000005DDE000-memory.dmp

Download

memory/3856-129-0x00000000053F0000-0x00000000053F1000-memory.dmp

Download

memory/3856-124-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/3916-114-0x0000000000C70000-0x0000000000C71000-memory.dmp

Download

memory/3916-123-0x0000000005B70000-0x0000000005B97000-memory.dmp

Download

memory/3916-122-0x0000000006500000-0x0000000006563000-memory.dmp

Download

memory/3916-121-0x00000000050A0000-0x00000000050AF000-memory.dmp

Download

memory/3916-120-0x0000000005710000-0x0000000005C0E000-memory.dmp

Download

memory/3916-119-0x0000000005580000-0x0000000005581000-memory.dmp

Download

memory/3916-118-0x0000000005710000-0x0000000005711000-memory.dmp

Download

memory/3916-117-0x0000000005600000-0x0000000005601000-memory.dmp

Download

memory/3916-116-0x0000000005C10000-0x0000000005C11000-memory.dmp

Download