asyncrat | 11972f7634307a1756dbe8033b2dc51932e7ac47d17748bfacc604b54a732346

General

Target

B8604C6F07270DC6EB0925C3FEADEB4F.exe
Size

3.4MB
MD5

b8604c6f07270dc6eb0925c3feadeb4f
SHA1

c50588308cbb54b8f759b23037b3089e370089c5
SHA256

11972f7634307a1756dbe8033b2dc51932e7ac47d17748bfacc604b54a732346
SHA512

c8eea1975a9eab4d49187217a6f9d0e72f75f3b9c06319bf8c25ef2dda70fc88a7e86fec6a431495ceab6c1883286492c289c8a0b11974769660d1cddde58f6b

Score

10^/10

asyncrat rat suricata

Malware Config

Extracted

Family

asyncrat

Version

0.5.6D

C2

milla.publicvm.com:6606

milla.publicvm.com:7707

milla.publicvm.com:8808

Mutex

hzizmtfuyizxxugkf

Attributes

aes_key
8O0108t0cNZA65PD4CGxRxmuF31uXw1E
anti_detection
false
autorun
true
bdos
false
delay
Default
host
milla.publicvm.com
hwid
10
install_file
install_folder
%AppData%
mutex
hzizmtfuyizxxugkf
pastebin_config
null
port
6606,7707,8808
version
0.5.6D

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
rat asyncrat
suricata: ET MALWARE Observed Malicious SSL Cert (AsyncRAT Server)
suricata

Async RAT payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/3156-120-0x0000000004F20000-0x0000000004F2C000-memory.dmp	asyncrat

Executes dropped EXE 1 IoCs

Processes:

mccleaner.exe

pid process

4044 mccleaner.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

3928 schtasks.exe
Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

3148 timeout.exe

pid	process
4044	mccleaner.exe

pid	process
3928	schtasks.exe

pid	process
3148	timeout.exe

Suspicious behavior: EnumeratesProcesses 15 IoCs

Processes:

B8604C6F07270DC6EB0925C3FEADEB4F.exe

pid	process
3156	B8604C6F07270DC6EB0925C3FEADEB4F.exe
3156	B8604C6F07270DC6EB0925C3FEADEB4F.exe
3156	B8604C6F07270DC6EB0925C3FEADEB4F.exe
3156	B8604C6F07270DC6EB0925C3FEADEB4F.exe
3156	B8604C6F07270DC6EB0925C3FEADEB4F.exe
3156	B8604C6F07270DC6EB0925C3FEADEB4F.exe
3156	B8604C6F07270DC6EB0925C3FEADEB4F.exe
3156	B8604C6F07270DC6EB0925C3FEADEB4F.exe
3156	B8604C6F07270DC6EB0925C3FEADEB4F.exe
3156	B8604C6F07270DC6EB0925C3FEADEB4F.exe
3156	B8604C6F07270DC6EB0925C3FEADEB4F.exe
3156	B8604C6F07270DC6EB0925C3FEADEB4F.exe
3156	B8604C6F07270DC6EB0925C3FEADEB4F.exe
3156	B8604C6F07270DC6EB0925C3FEADEB4F.exe
3156	B8604C6F07270DC6EB0925C3FEADEB4F.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

B8604C6F07270DC6EB0925C3FEADEB4F.exemccleaner.exe

description pid process

Token: SeDebugPrivilege 3156 B8604C6F07270DC6EB0925C3FEADEB4F.exe
Token: SeDebugPrivilege 4044 mccleaner.exe

description	pid	process
Token: SeDebugPrivilege	3156	B8604C6F07270DC6EB0925C3FEADEB4F.exe
Token: SeDebugPrivilege	4044	mccleaner.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

B8604C6F07270DC6EB0925C3FEADEB4F.execmd.execmd.exe

description	pid	process	target process
PID 3156 wrote to memory of 3412	3156	B8604C6F07270DC6EB0925C3FEADEB4F.exe	cmd.exe
PID 3156 wrote to memory of 3412	3156	B8604C6F07270DC6EB0925C3FEADEB4F.exe	cmd.exe
PID 3156 wrote to memory of 3412	3156	B8604C6F07270DC6EB0925C3FEADEB4F.exe	cmd.exe
PID 3156 wrote to memory of 3740	3156	B8604C6F07270DC6EB0925C3FEADEB4F.exe	cmd.exe
PID 3156 wrote to memory of 3740	3156	B8604C6F07270DC6EB0925C3FEADEB4F.exe	cmd.exe
PID 3156 wrote to memory of 3740	3156	B8604C6F07270DC6EB0925C3FEADEB4F.exe	cmd.exe
PID 3412 wrote to memory of 3928	3412	cmd.exe	schtasks.exe
PID 3412 wrote to memory of 3928	3412	cmd.exe	schtasks.exe
PID 3412 wrote to memory of 3928	3412	cmd.exe	schtasks.exe
PID 3740 wrote to memory of 3148	3740	cmd.exe	timeout.exe
PID 3740 wrote to memory of 3148	3740	cmd.exe	timeout.exe
PID 3740 wrote to memory of 3148	3740	cmd.exe	timeout.exe
PID 3740 wrote to memory of 4044	3740	cmd.exe	mccleaner.exe
PID 3740 wrote to memory of 4044	3740	cmd.exe	mccleaner.exe
PID 3740 wrote to memory of 4044	3740	cmd.exe	mccleaner.exe

C:\Users\Admin\AppData\Local\Temp\B8604C6F07270DC6EB0925C3FEADEB4F.exe
"C:\Users\Admin\AppData\Local\Temp\B8604C6F07270DC6EB0925C3FEADEB4F.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3156

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /ru system /rl highest /tn B8604C6F07270DC6EB0925C3FEADEB4F /tr '"C:\Users\Admin\AppData\Roaming\mccleaner.exe"' & exit
2⤵
- Suspicious use of WriteProcessMemory
PID:3412

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /f /sc onlogon /ru system /rl highest /tn B8604C6F07270DC6EB0925C3FEADEB4F /tr '"C:\Users\Admin\AppData\Roaming\mccleaner.exe"'
3⤵
- Creates scheduled task(s)
PID:3928

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp4A8C.tmp.bat""
2⤵
- Suspicious use of WriteProcessMemory
PID:3740

C:\Windows\SysWOW64\timeout.exe
timeout 3
3⤵
- Delays execution with timeout.exe
PID:3148

C:\Users\Admin\AppData\Roaming\mccleaner.exe
"C:\Users\Admin\AppData\Roaming\mccleaner.exe"
3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4044

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp4A8C.tmp.bat
MD5
20bf2f42fd6c05203021040ddcff9ab8

SHA1
54824ff2b524771ba3b174660a2528e67d0bda4e

SHA256
4a914ac93f5678b3599f9837c782a569fbb31f31555092fabe6c302885ce6c07

SHA512
784bae33f7eb8e341bc436a08075dddee3e81ac8c05b04ee91fdd2cdb74f5a0c98d21426d19f8e28a6d3f1a3dbc05e2717db86a744780e491af00707d7ac78e8

Download Submit
C:\Users\Admin\AppData\Roaming\mccleaner.exe
MD5
b8604c6f07270dc6eb0925c3feadeb4f

SHA1
c50588308cbb54b8f759b23037b3089e370089c5

SHA256
11972f7634307a1756dbe8033b2dc51932e7ac47d17748bfacc604b54a732346

SHA512
c8eea1975a9eab4d49187217a6f9d0e72f75f3b9c06319bf8c25ef2dda70fc88a7e86fec6a431495ceab6c1883286492c289c8a0b11974769660d1cddde58f6b

Download Submit
C:\Users\Admin\AppData\Roaming\mccleaner.exe
MD5
b8604c6f07270dc6eb0925c3feadeb4f

SHA1
c50588308cbb54b8f759b23037b3089e370089c5

SHA256
11972f7634307a1756dbe8033b2dc51932e7ac47d17748bfacc604b54a732346

SHA512
c8eea1975a9eab4d49187217a6f9d0e72f75f3b9c06319bf8c25ef2dda70fc88a7e86fec6a431495ceab6c1883286492c289c8a0b11974769660d1cddde58f6b

Download Submit
memory/3148-126-0x0000000000000000-mapping.dmp

Download
memory/3156-116-0x0000000005440000-0x0000000005441000-memory.dmp

Filesize
4KB

Download
memory/3156-117-0x0000000004F40000-0x0000000004F41000-memory.dmp

Filesize
4KB

Download
memory/3156-118-0x0000000004FE0000-0x0000000004FE1000-memory.dmp

Filesize
4KB

Download
memory/3156-119-0x0000000004EF0000-0x0000000004EF1000-memory.dmp

Filesize
4KB

Download
memory/3156-120-0x0000000004F20000-0x0000000004F2C000-memory.dmp

Filesize
48KB

Download
memory/3156-121-0x0000000004F40000-0x000000000543E000-memory.dmp

Filesize
5.0MB

Download
memory/3156-114-0x00000000002D0000-0x00000000002D1000-memory.dmp

Filesize
4KB

Download
memory/3412-122-0x0000000000000000-mapping.dmp

Download
memory/3740-123-0x0000000000000000-mapping.dmp

Download
memory/3928-125-0x0000000000000000-mapping.dmp

Download
memory/4044-127-0x0000000000000000-mapping.dmp

Download
memory/4044-137-0x0000000005260000-0x000000000575E000-memory.dmp

Filesize
5.0MB

Download
memory/4044-138-0x0000000007C90000-0x0000000007C91000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads