asyncrat | 79c980bfebcae8726171a7cb2ff931f0da8bad4edd0fd0beb088e32ad1d1c7a7

General

Target

4623254c01d5f7aacd77ce78329a0976.exe
Size

770KB
MD5

4623254c01d5f7aacd77ce78329a0976
SHA1

10c144749fb54444b65a2cea0f3a18fc08a5a0a2
SHA256

79c980bfebcae8726171a7cb2ff931f0da8bad4edd0fd0beb088e32ad1d1c7a7
SHA512

b0cfa65b7875b4b4a8b06d92f1595c724dc9698246cae920cbbd5e0d8da955c8f573ed459a64ad35799f31bf301c2dd5df4b350afb83225b5954196c7ac5e500

Score

10^/10

asyncrat rat suricata

Malware Config

Extracted

Family

asyncrat

Version

0.5.6D

C2

79.134.225.22:7890

Mutex

plpwufojgjumnqp

Attributes

aes_key
YRR6qoQ9k1oF6WSlJmfPDS5io7Iq9moG
anti_detection
false
autorun
false
bdos
false
delay
Muva
host
79.134.225.22
hwid
25
install_file
install_folder
%AppData%
mutex
plpwufojgjumnqp
pastebin_config
null
port
7890
version
0.5.6D

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
rat asyncrat
suricata: ET MALWARE Observed Malicious SSL Cert (AsyncRAT Server)
suricata

Async RAT payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1752-69-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat
behavioral1/memory/1752-70-0x000000000040C60E-mapping.dmp	asyncrat
behavioral1/memory/1752-71-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat

Suspicious use of SetThreadContext 1 IoCs

Processes:

4623254c01d5f7aacd77ce78329a0976.exe

description pid process target process

PID 2016 set thread context of 1752 2016 4623254c01d5f7aacd77ce78329a0976.exe 4623254c01d5f7aacd77ce78329a0976.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1468 schtasks.exe

description	pid	process	target process
PID 2016 set thread context of 1752	2016	4623254c01d5f7aacd77ce78329a0976.exe	4623254c01d5f7aacd77ce78329a0976.exe

pid	process
1468	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

4623254c01d5f7aacd77ce78329a0976.exe

pid	process
2016	4623254c01d5f7aacd77ce78329a0976.exe
2016	4623254c01d5f7aacd77ce78329a0976.exe
2016	4623254c01d5f7aacd77ce78329a0976.exe
2016	4623254c01d5f7aacd77ce78329a0976.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

4623254c01d5f7aacd77ce78329a0976.exe4623254c01d5f7aacd77ce78329a0976.exe

description pid process

Token: SeDebugPrivilege 2016 4623254c01d5f7aacd77ce78329a0976.exe
Token: SeDebugPrivilege 1752 4623254c01d5f7aacd77ce78329a0976.exe

description	pid	process
Token: SeDebugPrivilege	2016	4623254c01d5f7aacd77ce78329a0976.exe
Token: SeDebugPrivilege	1752	4623254c01d5f7aacd77ce78329a0976.exe

Suspicious use of WriteProcessMemory 25 IoCs

Processes:

4623254c01d5f7aacd77ce78329a0976.exe

C:\Users\Admin\AppData\Local\Temp\4623254c01d5f7aacd77ce78329a0976.exe
"C:\Users\Admin\AppData\Local\Temp\4623254c01d5f7aacd77ce78329a0976.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2016

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\CRPrKapxQE" /XML "C:\Users\Admin\AppData\Local\Temp\tmp845C.tmp"
2⤵
- Creates scheduled task(s)
PID:1468

C:\Users\Admin\AppData\Local\Temp\4623254c01d5f7aacd77ce78329a0976.exe
"{path}"
2⤵
PID:1012

C:\Users\Admin\AppData\Local\Temp\4623254c01d5f7aacd77ce78329a0976.exe
"{path}"
2⤵
PID:852

C:\Users\Admin\AppData\Local\Temp\4623254c01d5f7aacd77ce78329a0976.exe
"{path}"
2⤵
PID:1972

C:\Users\Admin\AppData\Local\Temp\4623254c01d5f7aacd77ce78329a0976.exe
"{path}"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1752

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp845C.tmp
MD5
861450c49d3e65e7480ded5c6bdd3f4d

SHA1
6a3b6aee1b60e71423a695d63f8af97157ff654a

SHA256
6911201aae40230a480a9b5811d5f31d9caefe95e0d9dc3b0e7a8182b2d35e5c

SHA512
aebeaa6607bfe21d27acf9c13faf635dbe193a3839dde6ba27f0955d0915239a62d9373e4c18b40b6272e3cc6f761909132b8783118a208b112521eb5c2d1d62

Download Submit
memory/1468-67-0x0000000000000000-mapping.dmp

Download
memory/1752-70-0x000000000040C60E-mapping.dmp

Download
memory/1752-69-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1752-71-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1752-73-0x00000000754F1000-0x00000000754F3000-memory.dmp

Filesize
8KB

Download
memory/1752-74-0x0000000004FF0000-0x0000000004FF1000-memory.dmp

Filesize
4KB

Download
memory/2016-64-0x0000000000520000-0x0000000000522000-memory.dmp

Filesize
8KB

Download
memory/2016-65-0x0000000004C10000-0x0000000004C6F000-memory.dmp

Filesize
380KB

Download
memory/2016-66-0x0000000000720000-0x000000000072E000-memory.dmp

Filesize
56KB

Download
memory/2016-63-0x0000000004AA0000-0x0000000004AA1000-memory.dmp

Filesize
4KB

Download
memory/2016-62-0x0000000000270000-0x00000000002AB000-memory.dmp

Filesize
236KB

Download
memory/2016-60-0x00000000002C0000-0x00000000002C1000-memory.dmp

Filesize
4KB

Download

description	pid	process	target process
PID 2016 wrote to memory of 1468	2016	4623254c01d5f7aacd77ce78329a0976.exe	schtasks.exe
PID 2016 wrote to memory of 1468	2016	4623254c01d5f7aacd77ce78329a0976.exe	schtasks.exe
PID 2016 wrote to memory of 1468	2016	4623254c01d5f7aacd77ce78329a0976.exe	schtasks.exe
PID 2016 wrote to memory of 1468	2016	4623254c01d5f7aacd77ce78329a0976.exe	schtasks.exe
PID 2016 wrote to memory of 1012	2016	4623254c01d5f7aacd77ce78329a0976.exe	4623254c01d5f7aacd77ce78329a0976.exe
PID 2016 wrote to memory of 1012	2016	4623254c01d5f7aacd77ce78329a0976.exe	4623254c01d5f7aacd77ce78329a0976.exe
PID 2016 wrote to memory of 1012	2016	4623254c01d5f7aacd77ce78329a0976.exe	4623254c01d5f7aacd77ce78329a0976.exe
PID 2016 wrote to memory of 1012	2016	4623254c01d5f7aacd77ce78329a0976.exe	4623254c01d5f7aacd77ce78329a0976.exe
PID 2016 wrote to memory of 852	2016	4623254c01d5f7aacd77ce78329a0976.exe	4623254c01d5f7aacd77ce78329a0976.exe
PID 2016 wrote to memory of 852	2016	4623254c01d5f7aacd77ce78329a0976.exe	4623254c01d5f7aacd77ce78329a0976.exe
PID 2016 wrote to memory of 852	2016	4623254c01d5f7aacd77ce78329a0976.exe	4623254c01d5f7aacd77ce78329a0976.exe
PID 2016 wrote to memory of 852	2016	4623254c01d5f7aacd77ce78329a0976.exe	4623254c01d5f7aacd77ce78329a0976.exe
PID 2016 wrote to memory of 1972	2016	4623254c01d5f7aacd77ce78329a0976.exe	4623254c01d5f7aacd77ce78329a0976.exe
PID 2016 wrote to memory of 1972	2016	4623254c01d5f7aacd77ce78329a0976.exe	4623254c01d5f7aacd77ce78329a0976.exe
PID 2016 wrote to memory of 1972	2016	4623254c01d5f7aacd77ce78329a0976.exe	4623254c01d5f7aacd77ce78329a0976.exe
PID 2016 wrote to memory of 1972	2016	4623254c01d5f7aacd77ce78329a0976.exe	4623254c01d5f7aacd77ce78329a0976.exe
PID 2016 wrote to memory of 1752	2016	4623254c01d5f7aacd77ce78329a0976.exe	4623254c01d5f7aacd77ce78329a0976.exe
PID 2016 wrote to memory of 1752	2016	4623254c01d5f7aacd77ce78329a0976.exe	4623254c01d5f7aacd77ce78329a0976.exe
PID 2016 wrote to memory of 1752	2016	4623254c01d5f7aacd77ce78329a0976.exe	4623254c01d5f7aacd77ce78329a0976.exe
PID 2016 wrote to memory of 1752	2016	4623254c01d5f7aacd77ce78329a0976.exe	4623254c01d5f7aacd77ce78329a0976.exe
PID 2016 wrote to memory of 1752	2016	4623254c01d5f7aacd77ce78329a0976.exe	4623254c01d5f7aacd77ce78329a0976.exe
PID 2016 wrote to memory of 1752	2016	4623254c01d5f7aacd77ce78329a0976.exe	4623254c01d5f7aacd77ce78329a0976.exe
PID 2016 wrote to memory of 1752	2016	4623254c01d5f7aacd77ce78329a0976.exe	4623254c01d5f7aacd77ce78329a0976.exe
PID 2016 wrote to memory of 1752	2016	4623254c01d5f7aacd77ce78329a0976.exe	4623254c01d5f7aacd77ce78329a0976.exe
PID 2016 wrote to memory of 1752	2016	4623254c01d5f7aacd77ce78329a0976.exe	4623254c01d5f7aacd77ce78329a0976.exe

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads