asyncrat | 866ac65940057d6e1a125eda23a12d6743d75e6ff3a74ff6d53debb3fe90a368

Resubmissions

21-01-2025 11:37

250121-nrfehs1pby 10

12-07-2021 19:05

210712-p4pm4lvw8x 10

Analysis

max time kernel
135s
max time network
155s
platform
windows10_x64
resource
win10v20210410
submitted
12-07-2021 19:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8a2abab20bf75ac19eaa73be3b09219d.exe
Size

455KB
MD5

8a2abab20bf75ac19eaa73be3b09219d
SHA1

c0fa652bb151644bf76b55f3c9d68cb5e8d7faf3
SHA256

866ac65940057d6e1a125eda23a12d6743d75e6ff3a74ff6d53debb3fe90a368
SHA512

e8842b9f47a5dce906ddca3dfbb608eba660c80364ed0b02b48c33e161df3e95226d713177733e7591cc7eccecb3f48e1a731576a90d6fbda194de98de5495c9

Score

10^/10

asyncrat link pdf persistence rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

sbmsbm20.duckdns.org:2020

sbmsbm20.duckdns.org:3040

sbmsbm20.duckdns.org:4040

hpdndbnb.duckdns.org:2020

hpdndbnb.duckdns.org:3040

hpdndbnb.duckdns.org:4040

Mutex

AsyncMutex_6SI8OkPnk

Attributes

aes_key
Lvyod3VuSZyfscnKiu0YIwvTV1TQp7CD
anti_detection
false
autorun
true
bdos
false
delay
Default
host
sbmsbm20.duckdns.org,hpdndbnb.duckdns.org
hwid
3
install_file
install_folder
%Temp%
mutex
AsyncMutex_6SI8OkPnk
pastebin_config
null
port
2020,3040,4040
version
0.5.7B

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
rat asyncrat

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,\"C:\\Users\\Admin\\AppData\\Local\\Adobe.exe\","	8a2abab20bf75ac19eaa73be3b09219d.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,\"C:\\Users\\Admin\\AppData\\Local\\Adobe.exe\","	Acrobat Reader.exe

Async RAT payload 4 IoCs

rat

resource	yara_rule
behavioral2/memory/416-141-0x0000000000400000-0x0000000000418000-memory.dmp	asyncrat
behavioral2/memory/416-142-0x000000000040C79E-mapping.dmp	asyncrat
behavioral2/memory/3180-161-0x00000000053A0000-0x000000000589E000-memory.dmp	asyncrat
behavioral2/memory/3508-185-0x000000000040C79E-mapping.dmp	asyncrat

Nirsoft 10 IoCs

resource	yara_rule
behavioral2/files/0x000300000001a2e0-133.dat	Nirsoft
behavioral2/files/0x000300000001a2e0-134.dat	Nirsoft
behavioral2/files/0x000300000001a2e0-136.dat	Nirsoft
behavioral2/files/0x000300000001a2e0-138.dat	Nirsoft
behavioral2/files/0x000300000001a2e0-140.dat	Nirsoft
behavioral2/files/0x000200000001ab2f-175.dat	Nirsoft
behavioral2/files/0x000200000001ab2f-176.dat	Nirsoft
behavioral2/files/0x000200000001ab2f-178.dat	Nirsoft
behavioral2/files/0x000200000001ab2f-180.dat	Nirsoft
behavioral2/files/0x000200000001ab2f-182.dat	Nirsoft

Executes dropped EXE 10 IoCs

pid	Process
3864	AdvancedRun.exe
4056	AdvancedRun.exe
3508	AdvancedRun.exe
1068	AdvancedRun.exe
3180	Acrobat Reader.exe
3772	AdvancedRun.exe
3992	AdvancedRun.exe
2344	AdvancedRun.exe
2792	AdvancedRun.exe
3508	Acrobat Reader.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1808 set thread context of 416	1808	8a2abab20bf75ac19eaa73be3b09219d.exe	85
PID 3180 set thread context of 3508	3180	Acrobat Reader.exe	97

HTTP links in PDF interactive object 4 IoCs

Detects HTTP links in interactive objects within PDF files.

pdf link

resource	yara_rule
behavioral2/files/0x000500000001ab28-154.dat	pdf_with_link_action
behavioral2/files/0x000500000001ab28-155.dat	pdf_with_link_action
behavioral2/files/0x000400000001a2e0-183.dat	pdf_with_link_action
behavioral2/files/0x000500000001ab28-186.dat	pdf_with_link_action

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
3328	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
1972	timeout.exe

Suspicious behavior: EnumeratesProcesses 53 IoCs

pid	Process
3864	AdvancedRun.exe
3864	AdvancedRun.exe
3864	AdvancedRun.exe
3864	AdvancedRun.exe
4056	AdvancedRun.exe
4056	AdvancedRun.exe
4056	AdvancedRun.exe
4056	AdvancedRun.exe
3508	AdvancedRun.exe
3508	AdvancedRun.exe
3508	AdvancedRun.exe
3508	AdvancedRun.exe
1068	AdvancedRun.exe
1068	AdvancedRun.exe
1068	AdvancedRun.exe
1068	AdvancedRun.exe
1808	8a2abab20bf75ac19eaa73be3b09219d.exe
1808	8a2abab20bf75ac19eaa73be3b09219d.exe
1808	8a2abab20bf75ac19eaa73be3b09219d.exe
1808	8a2abab20bf75ac19eaa73be3b09219d.exe
1808	8a2abab20bf75ac19eaa73be3b09219d.exe
1808	8a2abab20bf75ac19eaa73be3b09219d.exe
416	8a2abab20bf75ac19eaa73be3b09219d.exe
416	8a2abab20bf75ac19eaa73be3b09219d.exe
416	8a2abab20bf75ac19eaa73be3b09219d.exe
416	8a2abab20bf75ac19eaa73be3b09219d.exe
416	8a2abab20bf75ac19eaa73be3b09219d.exe
416	8a2abab20bf75ac19eaa73be3b09219d.exe
416	8a2abab20bf75ac19eaa73be3b09219d.exe
416	8a2abab20bf75ac19eaa73be3b09219d.exe
416	8a2abab20bf75ac19eaa73be3b09219d.exe
416	8a2abab20bf75ac19eaa73be3b09219d.exe
416	8a2abab20bf75ac19eaa73be3b09219d.exe
416	8a2abab20bf75ac19eaa73be3b09219d.exe
416	8a2abab20bf75ac19eaa73be3b09219d.exe
3772	AdvancedRun.exe
3772	AdvancedRun.exe
3772	AdvancedRun.exe
3772	AdvancedRun.exe
3992	AdvancedRun.exe
3992	AdvancedRun.exe
3992	AdvancedRun.exe
3992	AdvancedRun.exe
2344	AdvancedRun.exe
2344	AdvancedRun.exe
2344	AdvancedRun.exe
2344	AdvancedRun.exe
2792	AdvancedRun.exe
2792	AdvancedRun.exe
2792	AdvancedRun.exe
2792	AdvancedRun.exe
3180	Acrobat Reader.exe
3180	Acrobat Reader.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	1808	8a2abab20bf75ac19eaa73be3b09219d.exe
Token: SeDebugPrivilege	3864	AdvancedRun.exe
Token: SeImpersonatePrivilege	3864	AdvancedRun.exe
Token: SeDebugPrivilege	4056	AdvancedRun.exe
Token: SeImpersonatePrivilege	4056	AdvancedRun.exe
Token: SeDebugPrivilege	3508	AdvancedRun.exe
Token: SeImpersonatePrivilege	3508	AdvancedRun.exe
Token: SeDebugPrivilege	1068	AdvancedRun.exe
Token: SeImpersonatePrivilege	1068	AdvancedRun.exe
Token: SeDebugPrivilege	416	8a2abab20bf75ac19eaa73be3b09219d.exe
Token: SeDebugPrivilege	3180	Acrobat Reader.exe
Token: SeDebugPrivilege	3772	AdvancedRun.exe
Token: SeImpersonatePrivilege	3772	AdvancedRun.exe
Token: SeDebugPrivilege	3992	AdvancedRun.exe
Token: SeImpersonatePrivilege	3992	AdvancedRun.exe
Token: SeDebugPrivilege	2344	AdvancedRun.exe
Token: SeImpersonatePrivilege	2344	AdvancedRun.exe
Token: SeDebugPrivilege	2792	AdvancedRun.exe
Token: SeImpersonatePrivilege	2792	AdvancedRun.exe
Token: SeDebugPrivilege	3508	Acrobat Reader.exe

Suspicious use of WriteProcessMemory 58 IoCs

description	pid	Process	procid_target
PID 1808 wrote to memory of 3864	1808	8a2abab20bf75ac19eaa73be3b09219d.exe	79
PID 1808 wrote to memory of 3864	1808	8a2abab20bf75ac19eaa73be3b09219d.exe	79
PID 1808 wrote to memory of 3864	1808	8a2abab20bf75ac19eaa73be3b09219d.exe	79
PID 3864 wrote to memory of 4056	3864	AdvancedRun.exe	80
PID 3864 wrote to memory of 4056	3864	AdvancedRun.exe	80
PID 3864 wrote to memory of 4056	3864	AdvancedRun.exe	80
PID 1808 wrote to memory of 3508	1808	8a2abab20bf75ac19eaa73be3b09219d.exe	82
PID 1808 wrote to memory of 3508	1808	8a2abab20bf75ac19eaa73be3b09219d.exe	82
PID 1808 wrote to memory of 3508	1808	8a2abab20bf75ac19eaa73be3b09219d.exe	82
PID 3508 wrote to memory of 1068	3508	AdvancedRun.exe	83
PID 3508 wrote to memory of 1068	3508	AdvancedRun.exe	83
PID 3508 wrote to memory of 1068	3508	AdvancedRun.exe	83
PID 1808 wrote to memory of 3136	1808	8a2abab20bf75ac19eaa73be3b09219d.exe	84
PID 1808 wrote to memory of 3136	1808	8a2abab20bf75ac19eaa73be3b09219d.exe	84
PID 1808 wrote to memory of 3136	1808	8a2abab20bf75ac19eaa73be3b09219d.exe	84
PID 1808 wrote to memory of 416	1808	8a2abab20bf75ac19eaa73be3b09219d.exe	85
PID 1808 wrote to memory of 416	1808	8a2abab20bf75ac19eaa73be3b09219d.exe	85
PID 1808 wrote to memory of 416	1808	8a2abab20bf75ac19eaa73be3b09219d.exe	85
PID 1808 wrote to memory of 416	1808	8a2abab20bf75ac19eaa73be3b09219d.exe	85
PID 1808 wrote to memory of 416	1808	8a2abab20bf75ac19eaa73be3b09219d.exe	85
PID 1808 wrote to memory of 416	1808	8a2abab20bf75ac19eaa73be3b09219d.exe	85
PID 1808 wrote to memory of 416	1808	8a2abab20bf75ac19eaa73be3b09219d.exe	85
PID 1808 wrote to memory of 416	1808	8a2abab20bf75ac19eaa73be3b09219d.exe	85
PID 416 wrote to memory of 492	416	8a2abab20bf75ac19eaa73be3b09219d.exe	86
PID 416 wrote to memory of 492	416	8a2abab20bf75ac19eaa73be3b09219d.exe	86
PID 416 wrote to memory of 492	416	8a2abab20bf75ac19eaa73be3b09219d.exe	86
PID 416 wrote to memory of 3928	416	8a2abab20bf75ac19eaa73be3b09219d.exe	88
PID 416 wrote to memory of 3928	416	8a2abab20bf75ac19eaa73be3b09219d.exe	88
PID 416 wrote to memory of 3928	416	8a2abab20bf75ac19eaa73be3b09219d.exe	88
PID 492 wrote to memory of 3328	492	cmd.exe	90
PID 492 wrote to memory of 3328	492	cmd.exe	90
PID 492 wrote to memory of 3328	492	cmd.exe	90
PID 3928 wrote to memory of 1972	3928	cmd.exe	91
PID 3928 wrote to memory of 1972	3928	cmd.exe	91
PID 3928 wrote to memory of 1972	3928	cmd.exe	91
PID 3928 wrote to memory of 3180	3928	cmd.exe	92
PID 3928 wrote to memory of 3180	3928	cmd.exe	92
PID 3928 wrote to memory of 3180	3928	cmd.exe	92
PID 3180 wrote to memory of 3772	3180	Acrobat Reader.exe	93
PID 3180 wrote to memory of 3772	3180	Acrobat Reader.exe	93
PID 3180 wrote to memory of 3772	3180	Acrobat Reader.exe	93
PID 3772 wrote to memory of 3992	3772	AdvancedRun.exe	94
PID 3772 wrote to memory of 3992	3772	AdvancedRun.exe	94
PID 3772 wrote to memory of 3992	3772	AdvancedRun.exe	94
PID 3180 wrote to memory of 2344	3180	Acrobat Reader.exe	95
PID 3180 wrote to memory of 2344	3180	Acrobat Reader.exe	95
PID 3180 wrote to memory of 2344	3180	Acrobat Reader.exe	95
PID 2344 wrote to memory of 2792	2344	AdvancedRun.exe	96
PID 2344 wrote to memory of 2792	2344	AdvancedRun.exe	96
PID 2344 wrote to memory of 2792	2344	AdvancedRun.exe	96
PID 3180 wrote to memory of 3508	3180	Acrobat Reader.exe	97
PID 3180 wrote to memory of 3508	3180	Acrobat Reader.exe	97
PID 3180 wrote to memory of 3508	3180	Acrobat Reader.exe	97
PID 3180 wrote to memory of 3508	3180	Acrobat Reader.exe	97
PID 3180 wrote to memory of 3508	3180	Acrobat Reader.exe	97
PID 3180 wrote to memory of 3508	3180	Acrobat Reader.exe	97
PID 3180 wrote to memory of 3508	3180	Acrobat Reader.exe	97
PID 3180 wrote to memory of 3508	3180	Acrobat Reader.exe	97

C:\Users\Admin\AppData\Local\Temp\8a2abab20bf75ac19eaa73be3b09219d.exe
"C:\Users\Admin\AppData\Local\Temp\8a2abab20bf75ac19eaa73be3b09219d.exe"
1⤵
- Modifies WinLogon for persistence
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1808
- C:\Users\Admin\AppData\Local\Temp\AdvancedRun.exe
  "C:\Users\Admin\AppData\Local\Temp\AdvancedRun.exe" /EXEFilename "C:\Windows\System32\sc.exe" /WindowState 0 /CommandLine "stop WinDefend" /StartDirectory "" /RunAs 8 /Run
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3864
- - C:\Users\Admin\AppData\Local\Temp\AdvancedRun.exe
    "C:\Users\Admin\AppData\Local\Temp\AdvancedRun.exe" /SpecialRun 4101d8 3864
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4056
- C:\Users\Admin\AppData\Local\Temp\AdvancedRun.exe
  "C:\Users\Admin\AppData\Local\Temp\AdvancedRun.exe" /EXEFilename "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" /WindowState 0 /CommandLine "rmdir 'C:\ProgramData\Microsoft\Windows Defender' -Recurse" /StartDirectory "" /RunAs 8 /Run
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3508
- - C:\Users\Admin\AppData\Local\Temp\AdvancedRun.exe
    "C:\Users\Admin\AppData\Local\Temp\AdvancedRun.exe" /SpecialRun 4101d8 3508
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1068
- C:\Users\Admin\AppData\Local\Temp\8a2abab20bf75ac19eaa73be3b09219d.exe
  C:\Users\Admin\AppData\Local\Temp\8a2abab20bf75ac19eaa73be3b09219d.exe
  2⤵
  PID:3136
- C:\Users\Admin\AppData\Local\Temp\8a2abab20bf75ac19eaa73be3b09219d.exe
  C:\Users\Admin\AppData\Local\Temp\8a2abab20bf75ac19eaa73be3b09219d.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:416
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Acrobat Reader" /tr '"C:\Users\Admin\AppData\Local\Temp\Acrobat Reader.exe"' & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:492
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /f /sc onlogon /rl highest /tn "Acrobat Reader" /tr '"C:\Users\Admin\AppData\Local\Temp\Acrobat Reader.exe"'
      4⤵
      Creates scheduled task(s)
      PID:3328
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp1D7C.tmp.bat""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3928
  - - C:\Windows\SysWOW64\timeout.exe
      timeout 3
      4⤵
      Delays execution with timeout.exe
      PID:1972
  - - C:\Users\Admin\AppData\Local\Temp\Acrobat Reader.exe
      "C:\Users\Admin\AppData\Local\Temp\Acrobat Reader.exe"
      4⤵
      Modifies WinLogon for persistence
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3180
    - - C:\Users\Admin\AppData\Local\Temp\AdvancedRun.exe
        
        "C:\Users\Admin\AppData\Local\Temp\AdvancedRun.exe" /EXEFilename "C:\Windows\System32\sc.exe" /WindowState 0 /CommandLine "stop WinDefend" /StartDirectory "" /RunAs 8 /Run
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3772
      - C:\Users\Admin\AppData\Local\Temp\AdvancedRun.exe
        
        "C:\Users\Admin\AppData\Local\Temp\AdvancedRun.exe" /SpecialRun 4101d8 3772
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3992
    - - C:\Users\Admin\AppData\Local\Temp\AdvancedRun.exe
        
        "C:\Users\Admin\AppData\Local\Temp\AdvancedRun.exe" /EXEFilename "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" /WindowState 0 /CommandLine "rmdir 'C:\ProgramData\Microsoft\Windows Defender' -Recurse" /StartDirectory "" /RunAs 8 /Run
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2344
      - C:\Users\Admin\AppData\Local\Temp\AdvancedRun.exe
        
        "C:\Users\Admin\AppData\Local\Temp\AdvancedRun.exe" /SpecialRun 4101d8 2344
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2792
    - - C:\Users\Admin\AppData\Local\Temp\Acrobat Reader.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Acrobat Reader.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3508

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Winlogon Helper DLL

T1004

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/416-141-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/416-146-0x0000000005240000-0x0000000005241000-memory.dmp

Filesize
4KB

Download
memory/416-147-0x0000000005350000-0x0000000005351000-memory.dmp

Filesize
4KB

Download
memory/1808-114-0x00000000006E0000-0x00000000006E1000-memory.dmp

Filesize
4KB

Download
memory/1808-122-0x0000000006C60000-0x0000000006C61000-memory.dmp

Filesize
4KB

Download
memory/1808-116-0x0000000005500000-0x0000000005501000-memory.dmp

Filesize
4KB

Download
memory/1808-117-0x0000000005000000-0x0000000005001000-memory.dmp

Filesize
4KB

Download
memory/1808-118-0x0000000004EF0000-0x0000000004F82000-memory.dmp

Filesize
584KB

Download
memory/1808-119-0x0000000004F90000-0x0000000004F91000-memory.dmp

Filesize
4KB

Download
memory/1808-120-0x0000000006BB0000-0x0000000006BF3000-memory.dmp

Filesize
268KB

Download
memory/1808-121-0x0000000006C80000-0x0000000006C81000-memory.dmp

Filesize
4KB

Download
memory/1808-127-0x0000000007590000-0x00000000075F9000-memory.dmp

Filesize
420KB

Download
memory/3180-161-0x00000000053A0000-0x000000000589E000-memory.dmp

Filesize
5.0MB

Download
memory/3508-190-0x0000000005190000-0x0000000005191000-memory.dmp

Filesize
4KB

Download