asyncrat | d49479f1e5b04736f8bab7ff79f8cd3574234fa244b1f414b74b1fd91f87d1fb

General

Target

877446a3230a1bdc809f50ad1477c3fd.exe
Size

385KB
MD5

877446a3230a1bdc809f50ad1477c3fd
SHA1

54480aba9a090e9efb15695a55888c19b3dc183e
SHA256

d49479f1e5b04736f8bab7ff79f8cd3574234fa244b1f414b74b1fd91f87d1fb
SHA512

484c7dcf5a04f68f7b76ce5fee094cecf1353d0e46c9368b105cbe0b1fa18d18d584a679f4bbd95b658b898e668767ed69df546e411939141c158cfe2ed130b1

Score

10^/10

asyncrat rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

C2

omomom.ac.ug:6970

omkarusdajvc.ac.ug:6970

Mutex

6SI8OkPnkxzcasd

Attributes

aes_key
sEiaxlqpFmHMU8l5j0Ycz8apFoEBTERY
anti_detection
false
autorun
false
bdos
false
delay
XX
host
omomom.ac.ug,omkarusdajvc.ac.ug
hwid
3
install_file
install_folder
%AppData%
mutex
6SI8OkPnkxzcasd
pastebin_config
null
port
6970
version
0.5.7B

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
rat asyncrat

Async RAT payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/904-70-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat
behavioral1/memory/904-71-0x000000000040C71E-mapping.dmp	asyncrat
behavioral1/memory/904-72-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat

Suspicious use of SetThreadContext 1 IoCs

Processes:

877446a3230a1bdc809f50ad1477c3fd.exe

description pid process target process

PID 1304 set thread context of 904 1304 877446a3230a1bdc809f50ad1477c3fd.exe 877446a3230a1bdc809f50ad1477c3fd.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

796 schtasks.exe

description	pid	process	target process
PID 1304 set thread context of 904	1304	877446a3230a1bdc809f50ad1477c3fd.exe	877446a3230a1bdc809f50ad1477c3fd.exe

pid	process
796	schtasks.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

877446a3230a1bdc809f50ad1477c3fd.exe

description	pid	process	target process
PID 1304 wrote to memory of 796	1304	877446a3230a1bdc809f50ad1477c3fd.exe	schtasks.exe
PID 1304 wrote to memory of 796	1304	877446a3230a1bdc809f50ad1477c3fd.exe	schtasks.exe
PID 1304 wrote to memory of 796	1304	877446a3230a1bdc809f50ad1477c3fd.exe	schtasks.exe
PID 1304 wrote to memory of 796	1304	877446a3230a1bdc809f50ad1477c3fd.exe	schtasks.exe
PID 1304 wrote to memory of 904	1304	877446a3230a1bdc809f50ad1477c3fd.exe	877446a3230a1bdc809f50ad1477c3fd.exe
PID 1304 wrote to memory of 904	1304	877446a3230a1bdc809f50ad1477c3fd.exe	877446a3230a1bdc809f50ad1477c3fd.exe
PID 1304 wrote to memory of 904	1304	877446a3230a1bdc809f50ad1477c3fd.exe	877446a3230a1bdc809f50ad1477c3fd.exe
PID 1304 wrote to memory of 904	1304	877446a3230a1bdc809f50ad1477c3fd.exe	877446a3230a1bdc809f50ad1477c3fd.exe
PID 1304 wrote to memory of 904	1304	877446a3230a1bdc809f50ad1477c3fd.exe	877446a3230a1bdc809f50ad1477c3fd.exe
PID 1304 wrote to memory of 904	1304	877446a3230a1bdc809f50ad1477c3fd.exe	877446a3230a1bdc809f50ad1477c3fd.exe
PID 1304 wrote to memory of 904	1304	877446a3230a1bdc809f50ad1477c3fd.exe	877446a3230a1bdc809f50ad1477c3fd.exe
PID 1304 wrote to memory of 904	1304	877446a3230a1bdc809f50ad1477c3fd.exe	877446a3230a1bdc809f50ad1477c3fd.exe
PID 1304 wrote to memory of 904	1304	877446a3230a1bdc809f50ad1477c3fd.exe	877446a3230a1bdc809f50ad1477c3fd.exe

C:\Users\Admin\AppData\Local\Temp\877446a3230a1bdc809f50ad1477c3fd.exe
"C:\Users\Admin\AppData\Local\Temp\877446a3230a1bdc809f50ad1477c3fd.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1304

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\awXFuL" /XML "C:\Users\Admin\AppData\Local\Temp\tmp3968.tmp"
2⤵
- Creates scheduled task(s)
PID:796

C:\Users\Admin\AppData\Local\Temp\877446a3230a1bdc809f50ad1477c3fd.exe
"{path}"
2⤵
PID:904

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp3968.tmp
MD5
c938421fa5d0a6a1d397a3debf939057

SHA1
f350c4735d66d409bca38dbfa8b29bf3c613fe9b

SHA256
429f39e493570fef03ef3acc980fc415988549ff24ac24957a658c363a996c15

SHA512
a6bc6f72bb8c42cf101a9ae2f084d1a1a3b97c5f3019d35c72d2cd16bd163a13a024236a7bfadef6d8b173cb5297e99469f0b9a3dde14699045b1d4baba2c875

Download Submit
memory/796-68-0x0000000000000000-mapping.dmp

Download
memory/904-75-0x00000000045F0000-0x00000000045F1000-memory.dmp

Filesize
4KB

Download
memory/904-74-0x0000000075551000-0x0000000075553000-memory.dmp

Filesize
8KB

Download
memory/904-72-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/904-71-0x000000000040C71E-mapping.dmp

Download
memory/904-70-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1304-64-0x0000000000390000-0x0000000000392000-memory.dmp

Filesize
8KB

Download
memory/1304-67-0x0000000001F10000-0x0000000001F29000-memory.dmp

Filesize
100KB

Download
memory/1304-66-0x00000000057D0000-0x0000000005839000-memory.dmp

Filesize
420KB

Download
memory/1304-65-0x0000000000545000-0x0000000000556000-memory.dmp

Filesize
68KB

Download
memory/1304-60-0x0000000010B00000-0x0000000010B01000-memory.dmp

Filesize
4KB

Download
memory/1304-63-0x0000000000540000-0x0000000000541000-memory.dmp

Filesize
4KB

Download
memory/1304-62-0x0000000000580000-0x00000000005C2000-memory.dmp

Filesize
264KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads