asyncrat | a33be1069f51683e3ef5290bedad88f032df7b67fde8955bf2ad72b2f8d5e647

Analysis

max time kernel
77s
max time network
153s
platform
windows10_x64
resource
win10v20210408
submitted
12/07/2021, 22:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
A33BE1069F51683E3EF5290BEDAD88F032DF7B67FDE89.exe
Size 984KB
Sample210712-5d7tthrfpa
SHA256 a33be1069f51683e3ef5290bedad88f032df7b67fde8955bf2ad72b2f8d5e647
MD5 6aa7a99215146db805906413536e044b
SHA1 6836d123533da85745f86c492a23fdec04fdde8c
SHA512 b3c5d48f37acc1f52f464cb9e17d22687a7b3f48ec75e835547e0ce6ad0f474d1c289a857814d13fc634712c73950d52eea317b8f15562ae743eeee7fe60955c
MD5 SHA1 SHA512

Score

10^/10

asyncrat quasar bitt21 discovery rat spyware trojan

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

pettbull.ddns.net:6606
pettbull.ddns.net:7707
pettbull.ddns.net:8808

Mutex

AsyncMutex_6SI8OkPnk

Attributes

aes_key
Rf0cBtTiTPesPoSUe1juZE7Kx9eHMndW
anti_detection
false
autorun
false
bdos
false
delay
CHAP21
host
pettbull.ddns.net
hwid
3
install_file
install_folder
%AppData%
mutex
AsyncMutex_6SI8OkPnk
pastebin_config
null
port
6606,7707,8808
version
0.5.7B

aes.plain

Extracted

Family

quasar

Version

1.4.0

Botnet

BITT21

pettbull.ddns.net:4782

Mutex

42a7796c-8301-4ac9-9f03-c5e40867d833

Attributes

encryption_key
DAE9E02E5E04D59D9AF2AA1D5E82248D5919AC6A
install_name
Windows Service.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Microsoft Windows
subdirectory
Windows Update

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
rat asyncrat

Quasar Payload 3 IoCs

resource	yara_rule
behavioral2/memory/3804-161-0x0000000000400000-0x0000000000484000-memory.dmp	family_quasar
behavioral2/memory/3804-162-0x000000000047E79E-mapping.dmp	family_quasar
behavioral2/memory/3804-188-0x0000000004D80000-0x000000000527E000-memory.dmp	family_quasar

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Async RAT payload 2 IoCs

rat

resource	yara_rule
behavioral2/memory/3356-121-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat
behavioral2/memory/3356-122-0x000000000040C75E-mapping.dmp	asyncrat

Executes dropped EXE 3 IoCs

pid	Process
2776	svchost.exe
3668	Windows Update.exe
3024	Setup.exe

Drops startup file 4 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Vooodd.exe	pOwERsHeLl.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows Update.exe	pOwERsHeLl.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows Update.exe	pOwERsHeLl.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Vooodd.exe	pOwERsHeLl.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
21	api.ipify.org
22	api.ipify.org

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2776 set thread context of 3356	2776	svchost.exe	81
PID 3668 set thread context of 3804	3668	Windows Update.exe	86

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe Systems Incorporated\Adobe Acrobat Pro\Setup.exe	A33BE1069F51683E3EF5290BEDAD88F032DF7B67FDE89.exe
File opened for modification	C:\Program Files (x86)\Adobe Systems Incorporated\Adobe Acrobat Pro\Uninstall.exe	A33BE1069F51683E3EF5290BEDAD88F032DF7B67FDE89.exe
File created	C:\Program Files (x86)\Adobe Systems Incorporated\Adobe Acrobat Pro\Uninstall.ini	A33BE1069F51683E3EF5290BEDAD88F032DF7B67FDE89.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2776	svchost.exe
2776	svchost.exe
1184	pOwERsHeLl.exe
1184	pOwERsHeLl.exe
1184	pOwERsHeLl.exe
3476	pOwERsHeLl.exe
3476	pOwERsHeLl.exe
3476	pOwERsHeLl.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	2776	svchost.exe
Token: SeDebugPrivilege	1184	pOwERsHeLl.exe
Token: SeDebugPrivilege	3356	RegSvcs.exe
Token: SeDebugPrivilege	3476	pOwERsHeLl.exe
Token: SeDebugPrivilege	3804	RegSvcs.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
3024	Setup.exe
3024	Setup.exe
3024	Setup.exe
3024	Setup.exe
3804	RegSvcs.exe

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 3128 wrote to memory of 2776	3128	A33BE1069F51683E3EF5290BEDAD88F032DF7B67FDE89.exe	75
PID 3128 wrote to memory of 2776	3128	A33BE1069F51683E3EF5290BEDAD88F032DF7B67FDE89.exe	75
PID 3128 wrote to memory of 2776	3128	A33BE1069F51683E3EF5290BEDAD88F032DF7B67FDE89.exe	75
PID 2776 wrote to memory of 2772	2776	svchost.exe	80
PID 2776 wrote to memory of 2772	2776	svchost.exe	80
PID 2776 wrote to memory of 2772	2776	svchost.exe	80
PID 2776 wrote to memory of 3356	2776	svchost.exe	81
PID 2776 wrote to memory of 3356	2776	svchost.exe	81
PID 2776 wrote to memory of 3356	2776	svchost.exe	81
PID 2776 wrote to memory of 3356	2776	svchost.exe	81
PID 2776 wrote to memory of 3356	2776	svchost.exe	81
PID 2776 wrote to memory of 3356	2776	svchost.exe	81
PID 2776 wrote to memory of 3356	2776	svchost.exe	81
PID 2776 wrote to memory of 3356	2776	svchost.exe	81
PID 2776 wrote to memory of 1184	2776	svchost.exe	82
PID 2776 wrote to memory of 1184	2776	svchost.exe	82
PID 2776 wrote to memory of 1184	2776	svchost.exe	82
PID 3128 wrote to memory of 3668	3128	A33BE1069F51683E3EF5290BEDAD88F032DF7B67FDE89.exe	84
PID 3128 wrote to memory of 3668	3128	A33BE1069F51683E3EF5290BEDAD88F032DF7B67FDE89.exe	84
PID 3128 wrote to memory of 3668	3128	A33BE1069F51683E3EF5290BEDAD88F032DF7B67FDE89.exe	84
PID 3668 wrote to memory of 3804	3668	Windows Update.exe	86
PID 3668 wrote to memory of 3804	3668	Windows Update.exe	86
PID 3668 wrote to memory of 3804	3668	Windows Update.exe	86
PID 3668 wrote to memory of 3804	3668	Windows Update.exe	86
PID 3668 wrote to memory of 3804	3668	Windows Update.exe	86
PID 3668 wrote to memory of 3804	3668	Windows Update.exe	86
PID 3668 wrote to memory of 3804	3668	Windows Update.exe	86
PID 3668 wrote to memory of 3804	3668	Windows Update.exe	86
PID 3668 wrote to memory of 3476	3668	Windows Update.exe	87
PID 3668 wrote to memory of 3476	3668	Windows Update.exe	87
PID 3668 wrote to memory of 3476	3668	Windows Update.exe	87
PID 3128 wrote to memory of 3024	3128	A33BE1069F51683E3EF5290BEDAD88F032DF7B67FDE89.exe	89
PID 3128 wrote to memory of 3024	3128	A33BE1069F51683E3EF5290BEDAD88F032DF7B67FDE89.exe	89
PID 3128 wrote to memory of 3024	3128	A33BE1069F51683E3EF5290BEDAD88F032DF7B67FDE89.exe	89

C:\Users\Admin\AppData\Local\Temp\A33BE1069F51683E3EF5290BEDAD88F032DF7B67FDE89.exe
"C:\Users\Admin\AppData\Local\Temp\A33BE1069F51683E3EF5290BEDAD88F032DF7B67FDE89.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:3128
- C:\Users\Admin\AppData\Roaming\svchost.exe
  "C:\Users\Admin\AppData\Roaming\svchost.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2776
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
    3⤵
    PID:2772
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3356
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\pOwERsHeLl.exe
    "pOwERsHeLl.exe" Copy-Item 'C:\Users\Admin\AppData\Roaming\svchost.exe' 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Vooodd.exe'
    3⤵
    - Drops startup file
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1184
- C:\Users\Admin\AppData\Roaming\Windows Update.exe
  "C:\Users\Admin\AppData\Roaming\Windows Update.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:3668
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:3804
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\pOwERsHeLl.exe
    "pOwERsHeLl.exe" Copy-Item 'C:\Users\Admin\AppData\Roaming\Windows Update.exe' 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows Update.exe'
    3⤵
    - Drops startup file
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3476
- C:\Program Files (x86)\Adobe Systems Incorporated\Adobe Acrobat Pro\Setup.exe
  "C:\Program Files (x86)\Adobe Systems Incorporated\Adobe Acrobat Pro\Setup.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3024

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1184-145-0x0000000007CF0000-0x0000000007CF1000-memory.dmp

Download

memory/1184-154-0x0000000009210000-0x0000000009211000-memory.dmp

Download

memory/1184-156-0x0000000006683000-0x0000000006684000-memory.dmp

Download

memory/1184-153-0x0000000008A30000-0x0000000008A31000-memory.dmp

Download

memory/1184-133-0x0000000006580000-0x0000000006581000-memory.dmp

Download

memory/1184-152-0x00000000089E0000-0x00000000089E1000-memory.dmp

Download

memory/1184-135-0x0000000006CC0000-0x0000000006CC1000-memory.dmp

Download

memory/1184-137-0x0000000006C50000-0x0000000006C51000-memory.dmp

Download

memory/1184-138-0x0000000007360000-0x0000000007361000-memory.dmp

Download

memory/1184-139-0x0000000006680000-0x0000000006681000-memory.dmp

Download

memory/1184-140-0x0000000006682000-0x0000000006683000-memory.dmp

Download

memory/1184-141-0x00000000074D0000-0x00000000074D1000-memory.dmp

Download

memory/1184-142-0x0000000007540000-0x0000000007541000-memory.dmp

Download

memory/1184-143-0x00000000078D0000-0x00000000078D1000-memory.dmp

Download

memory/1184-144-0x0000000007F00000-0x0000000007F01000-memory.dmp

Download

memory/1184-151-0x0000000008C70000-0x0000000008C71000-memory.dmp

Download

memory/2776-124-0x0000000005B01000-0x0000000005B02000-memory.dmp

Download

memory/2776-117-0x0000000000680000-0x0000000000681000-memory.dmp

Download

memory/2776-119-0x0000000005440000-0x0000000005441000-memory.dmp

Download

memory/2776-120-0x00000000010F0000-0x00000000010FC000-memory.dmp

Download

memory/3356-121-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/3356-150-0x0000000003160000-0x0000000003161000-memory.dmp

Download

memory/3476-185-0x0000000006DB0000-0x0000000006DB1000-memory.dmp

Download

memory/3476-186-0x0000000006DB2000-0x0000000006DB3000-memory.dmp

Download

memory/3476-200-0x0000000006DB3000-0x0000000006DB4000-memory.dmp

Download

memory/3476-177-0x0000000007B70000-0x0000000007B71000-memory.dmp

Download

memory/3476-180-0x00000000085C0000-0x00000000085C1000-memory.dmp

Download

memory/3668-132-0x0000000000C60000-0x0000000000C61000-memory.dmp

Download

memory/3668-164-0x0000000002EF0000-0x0000000002EF1000-memory.dmp

Download

memory/3804-161-0x0000000000400000-0x0000000000484000-memory.dmp

Download

memory/3804-184-0x0000000004DC0000-0x0000000004DC1000-memory.dmp

Download

memory/3804-188-0x0000000004D80000-0x000000000527E000-memory.dmp

Download

memory/3804-198-0x0000000005E90000-0x0000000005E91000-memory.dmp

Download

memory/3804-199-0x00000000051E0000-0x00000000051E1000-memory.dmp

Download

memory/3804-173-0x0000000004E20000-0x0000000004E21000-memory.dmp

Download

memory/3804-201-0x0000000005A30000-0x0000000005A31000-memory.dmp

Download