asyncrat | 11972f7634307a1756dbe8033b2dc51932e7ac47d17748bfacc604b54a732346

General

Target

B8604C6F07270DC6EB0925C3FEADEB4F.exe
Size

3.4MB
MD5

b8604c6f07270dc6eb0925c3feadeb4f
SHA1

c50588308cbb54b8f759b23037b3089e370089c5
SHA256

11972f7634307a1756dbe8033b2dc51932e7ac47d17748bfacc604b54a732346
SHA512

c8eea1975a9eab4d49187217a6f9d0e72f75f3b9c06319bf8c25ef2dda70fc88a7e86fec6a431495ceab6c1883286492c289c8a0b11974769660d1cddde58f6b

Score

10^/10

asyncrat rat suricata

Malware Config

Extracted

Family

asyncrat

Version

0.5.6D

C2

milla.publicvm.com:6606

milla.publicvm.com:7707

milla.publicvm.com:8808

Mutex

hzizmtfuyizxxugkf

Attributes

aes_key
8O0108t0cNZA65PD4CGxRxmuF31uXw1E
anti_detection
false
autorun
true
bdos
false
delay
Default
host
milla.publicvm.com
hwid
10
install_file
install_folder
%AppData%
mutex
hzizmtfuyizxxugkf
pastebin_config
null
port
6606,7707,8808
version
0.5.6D

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
rat asyncrat
suricata: ET MALWARE Observed Malicious SSL Cert (AsyncRAT Server)
suricata

Async RAT payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1992-63-0x0000000000470000-0x000000000047C000-memory.dmp	asyncrat

Executes dropped EXE 1 IoCs

Processes:

mccleaner.exe

pid process

1744 mccleaner.exe
Loads dropped DLL 1 IoCs

Processes:

cmd.exe

pid process

1752 cmd.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1912 schtasks.exe
Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

744 timeout.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

B8604C6F07270DC6EB0925C3FEADEB4F.exe

pid process

1992 B8604C6F07270DC6EB0925C3FEADEB4F.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

B8604C6F07270DC6EB0925C3FEADEB4F.exemccleaner.exe

description pid process

Token: SeDebugPrivilege 1992 B8604C6F07270DC6EB0925C3FEADEB4F.exe
Token: SeDebugPrivilege 1744 mccleaner.exe

pid	process
1744	mccleaner.exe

pid	process
1752	cmd.exe

pid	process
1912	schtasks.exe

pid	process
744	timeout.exe

pid	process
1992	B8604C6F07270DC6EB0925C3FEADEB4F.exe

description	pid	process
Token: SeDebugPrivilege	1992	B8604C6F07270DC6EB0925C3FEADEB4F.exe
Token: SeDebugPrivilege	1744	mccleaner.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

B8604C6F07270DC6EB0925C3FEADEB4F.execmd.execmd.exe

description	pid	process	target process
PID 1992 wrote to memory of 1016	1992	B8604C6F07270DC6EB0925C3FEADEB4F.exe	cmd.exe
PID 1992 wrote to memory of 1016	1992	B8604C6F07270DC6EB0925C3FEADEB4F.exe	cmd.exe
PID 1992 wrote to memory of 1016	1992	B8604C6F07270DC6EB0925C3FEADEB4F.exe	cmd.exe
PID 1992 wrote to memory of 1016	1992	B8604C6F07270DC6EB0925C3FEADEB4F.exe	cmd.exe
PID 1992 wrote to memory of 1752	1992	B8604C6F07270DC6EB0925C3FEADEB4F.exe	cmd.exe
PID 1992 wrote to memory of 1752	1992	B8604C6F07270DC6EB0925C3FEADEB4F.exe	cmd.exe
PID 1992 wrote to memory of 1752	1992	B8604C6F07270DC6EB0925C3FEADEB4F.exe	cmd.exe
PID 1992 wrote to memory of 1752	1992	B8604C6F07270DC6EB0925C3FEADEB4F.exe	cmd.exe
PID 1016 wrote to memory of 1912	1016	cmd.exe	schtasks.exe
PID 1016 wrote to memory of 1912	1016	cmd.exe	schtasks.exe
PID 1016 wrote to memory of 1912	1016	cmd.exe	schtasks.exe
PID 1016 wrote to memory of 1912	1016	cmd.exe	schtasks.exe
PID 1752 wrote to memory of 744	1752	cmd.exe	timeout.exe
PID 1752 wrote to memory of 744	1752	cmd.exe	timeout.exe
PID 1752 wrote to memory of 744	1752	cmd.exe	timeout.exe
PID 1752 wrote to memory of 744	1752	cmd.exe	timeout.exe
PID 1752 wrote to memory of 1744	1752	cmd.exe	mccleaner.exe
PID 1752 wrote to memory of 1744	1752	cmd.exe	mccleaner.exe
PID 1752 wrote to memory of 1744	1752	cmd.exe	mccleaner.exe
PID 1752 wrote to memory of 1744	1752	cmd.exe	mccleaner.exe

C:\Users\Admin\AppData\Local\Temp\B8604C6F07270DC6EB0925C3FEADEB4F.exe
"C:\Users\Admin\AppData\Local\Temp\B8604C6F07270DC6EB0925C3FEADEB4F.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1992

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /ru system /rl highest /tn B8604C6F07270DC6EB0925C3FEADEB4F /tr '"C:\Users\Admin\AppData\Roaming\mccleaner.exe"' & exit
2⤵
- Suspicious use of WriteProcessMemory
PID:1016

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /f /sc onlogon /ru system /rl highest /tn B8604C6F07270DC6EB0925C3FEADEB4F /tr '"C:\Users\Admin\AppData\Roaming\mccleaner.exe"'
3⤵
- Creates scheduled task(s)
PID:1912

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp7494.tmp.bat""
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1752

C:\Windows\SysWOW64\timeout.exe
timeout 3
3⤵
- Delays execution with timeout.exe
PID:744

C:\Users\Admin\AppData\Roaming\mccleaner.exe
"C:\Users\Admin\AppData\Roaming\mccleaner.exe"
3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1744

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp7494.tmp.bat
MD5
791f7dba7d379c3da624fa1ac6eff6a3

SHA1
3b85b653209b3e8853cec78516a0b71d8dd9b703

SHA256
30e3b3a7e2f5fb28304866b5eef651a533f22686a0351048f045ae83f88bc62b

SHA512
501409e4fa5d5a751822c7934c272267929b32483b04e67c7f9cc69e57418710c9809a1a813097ce80447e848c28c80ae7df5b544000cab88e85b2ec466945a3

Download Submit
C:\Users\Admin\AppData\Roaming\mccleaner.exe
MD5
b8604c6f07270dc6eb0925c3feadeb4f

SHA1
c50588308cbb54b8f759b23037b3089e370089c5

SHA256
11972f7634307a1756dbe8033b2dc51932e7ac47d17748bfacc604b54a732346

SHA512
c8eea1975a9eab4d49187217a6f9d0e72f75f3b9c06319bf8c25ef2dda70fc88a7e86fec6a431495ceab6c1883286492c289c8a0b11974769660d1cddde58f6b

Download Submit
C:\Users\Admin\AppData\Roaming\mccleaner.exe
MD5
b8604c6f07270dc6eb0925c3feadeb4f

SHA1
c50588308cbb54b8f759b23037b3089e370089c5

SHA256
11972f7634307a1756dbe8033b2dc51932e7ac47d17748bfacc604b54a732346

SHA512
c8eea1975a9eab4d49187217a6f9d0e72f75f3b9c06319bf8c25ef2dda70fc88a7e86fec6a431495ceab6c1883286492c289c8a0b11974769660d1cddde58f6b

Download Submit
\Users\Admin\AppData\Roaming\mccleaner.exe
MD5
b8604c6f07270dc6eb0925c3feadeb4f

SHA1
c50588308cbb54b8f759b23037b3089e370089c5

SHA256
11972f7634307a1756dbe8033b2dc51932e7ac47d17748bfacc604b54a732346

SHA512
c8eea1975a9eab4d49187217a6f9d0e72f75f3b9c06319bf8c25ef2dda70fc88a7e86fec6a431495ceab6c1883286492c289c8a0b11974769660d1cddde58f6b

Download Submit
memory/744-68-0x0000000000000000-mapping.dmp

Download
memory/1016-64-0x0000000000000000-mapping.dmp

Download
memory/1744-71-0x0000000000000000-mapping.dmp

Download
memory/1744-73-0x00000000001F0000-0x00000000001F1000-memory.dmp

Filesize
4KB

Download
memory/1744-76-0x0000000000630000-0x0000000000631000-memory.dmp

Filesize
4KB

Download
memory/1752-65-0x0000000000000000-mapping.dmp

Download
memory/1912-66-0x0000000000000000-mapping.dmp

Download
memory/1992-60-0x0000000001180000-0x0000000001181000-memory.dmp

Filesize
4KB

Download
memory/1992-63-0x0000000000470000-0x000000000047C000-memory.dmp

Filesize
48KB

Download
memory/1992-62-0x0000000001040000-0x0000000001041000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads