asyncrat | 523110e3cb2270e27ac155a73ea6491a46ac6c8ef80f5d0172714298306415b4

General

Target

Statement from NTXSD.exe
Size

231KB
MD5

bab69227c1d989368b0480224cdc7659
SHA1

67c0a6efd1180371a572d439a330c01bb71f49fc
SHA256

523110e3cb2270e27ac155a73ea6491a46ac6c8ef80f5d0172714298306415b4
SHA512

c0a83fc3760a17b2c3000dfbb6b2f7cbee6fc4f91af2c3d574f550bc5fe28a0f59426ff57852e176b9a7ab4ef85a5ceb9ff9e6d09b5d67ee06850e90e8cbf015

Score

10^/10

asyncrat persistence rat suricata

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

C2

212.129.4.112:6606

212.129.4.112:7707

212.129.4.112:8808

51.75.191.89:6606

51.75.191.89:7707

51.75.191.89:8808

Mutex

AsyncMutex_6SI8OkPnk

Attributes

aes_key
hUpxNEHNQk3CtJdHJrTmysO9IVsvpbpS
anti_detection
false
autorun
false
bdos
false
delay
Default
host
212.129.4.112,51.75.191.89
hwid
3
install_file
install_folder
%AppData%
mutex
AsyncMutex_6SI8OkPnk
pastebin_config
null
port
6606,7707,8808
version
0.5.7B

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
rat asyncrat
suricata: ET MALWARE Observed Malicious SSL Cert (AsyncRAT Server)
suricata

Async RAT payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1600-65-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat
behavioral1/memory/1600-66-0x000000000040C73E-mapping.dmp	asyncrat
behavioral1/memory/1600-67-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat

Downloads MZ/PE file

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

Statement from NTXSD.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\CiEXMHAdMxYExZrNHxMnINnDE = "C:\\Users\\Admin\\AppData\\Roaming\\ZTdRhRvNAqIXDvEmslgSRcHtT\\wAGZF.exe"	Statement from NTXSD.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

Statement from NTXSD.exe

description pid process target process

PID 484 set thread context of 1600 484 Statement from NTXSD.exe RegSvcs.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Statement from NTXSD.exeRegSvcs.exe

description pid process

Token: SeDebugPrivilege 484 Statement from NTXSD.exe
Token: SeDebugPrivilege 1600 RegSvcs.exe

description	pid	process	target process
PID 484 set thread context of 1600	484	Statement from NTXSD.exe	RegSvcs.exe

description	pid	process
Token: SeDebugPrivilege	484	Statement from NTXSD.exe
Token: SeDebugPrivilege	1600	RegSvcs.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

Statement from NTXSD.exe

description	pid	process	target process
PID 484 wrote to memory of 1600	484	Statement from NTXSD.exe	RegSvcs.exe
PID 484 wrote to memory of 1600	484	Statement from NTXSD.exe	RegSvcs.exe
PID 484 wrote to memory of 1600	484	Statement from NTXSD.exe	RegSvcs.exe
PID 484 wrote to memory of 1600	484	Statement from NTXSD.exe	RegSvcs.exe
PID 484 wrote to memory of 1600	484	Statement from NTXSD.exe	RegSvcs.exe
PID 484 wrote to memory of 1600	484	Statement from NTXSD.exe	RegSvcs.exe
PID 484 wrote to memory of 1600	484	Statement from NTXSD.exe	RegSvcs.exe
PID 484 wrote to memory of 1600	484	Statement from NTXSD.exe	RegSvcs.exe
PID 484 wrote to memory of 1600	484	Statement from NTXSD.exe	RegSvcs.exe
PID 484 wrote to memory of 1600	484	Statement from NTXSD.exe	RegSvcs.exe
PID 484 wrote to memory of 1600	484	Statement from NTXSD.exe	RegSvcs.exe
PID 484 wrote to memory of 1600	484	Statement from NTXSD.exe	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\Statement from NTXSD.exe
"C:\Users\Admin\AppData\Local\Temp\Statement from NTXSD.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:484

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1600

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/484-60-0x0000000000970000-0x0000000000971000-memory.dmp

Filesize
4KB

Download
memory/484-62-0x0000000000550000-0x0000000000551000-memory.dmp

Filesize
4KB

Download
memory/484-63-0x0000000000555000-0x0000000000566000-memory.dmp

Filesize
68KB

Download
memory/484-64-0x00000000089D0000-0x0000000008AE8000-memory.dmp

Filesize
1.1MB

Download
memory/1600-65-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1600-66-0x000000000040C73E-mapping.dmp

Download
memory/1600-67-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1600-69-0x0000000075AD1000-0x0000000075AD3000-memory.dmp

Filesize
8KB

Download
memory/1600-70-0x0000000004AF0000-0x0000000004AF1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads