asyncrat | 6034df19af145c0f4c222c8ca73ecf6ea81d0be52fee85fa6def13beb5f2608a

Analysis

max time kernel
104s
max time network
155s
platform
windows10_x64
resource
win10v20210410
submitted
16/08/2021, 11:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
CV of Masuduzzaman.pdf.exe
Size 1.0MB
Sample210816-k89xanpec6
SHA256 6034df19af145c0f4c222c8ca73ecf6ea81d0be52fee85fa6def13beb5f2608a
MD5 2c26c911ac8cf780b55cada3e0f72ada
SHA1 0e0d202f496a388640642e6ba89b6ba37f9ad2d4
SHA512 f31166f12a0f71f0b1c9b467a005c46968b0e679a4cdaf0de0a28113bd9b1f644fdd0928df6125f63aeb803823f489119279353ca72c382d7b54d6ccd1b220b5
MD5 SHA1 SHA512

Score

10^/10

asyncrat rat suricata

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

79.134.225.9:3030

Mutex

AsyncMutex_6SI8OkPnk

Attributes

aes_key
DVBf5Vpi0o2J7L04EdDhPpjnY6JlNhSk
anti_detection
false
autorun
true
bdos
false
delay
Default
host
79.134.225.9
hwid
3
install_file
install_folder
%AppData%
mutex
AsyncMutex_6SI8OkPnk
pastebin_config
null
port
3030
version
0.5.7B

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
rat asyncrat
suricata: ET MALWARE Observed Malicious SSL Cert (AsyncRAT Server)
suricata: ET MALWARE Observed Malicious SSL Cert (AsyncRAT Server)
suricata

Async RAT payload 3 IoCs

rat

resource	yara_rule
behavioral2/memory/3992-127-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat
behavioral2/memory/3992-128-0x000000000040D06E-mapping.dmp	asyncrat
behavioral2/memory/672-156-0x000000000040D06E-mapping.dmp	asyncrat

Executes dropped EXE 2 IoCs

pid	Process
2804	dew.exe
672	dew.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 3228 set thread context of 3992	3228	CV of Masuduzzaman.pdf.exe	81
PID 2804 set thread context of 672	2804	dew.exe	91

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1324	schtasks.exe
4008	schtasks.exe
1672	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
192	timeout.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
3992	CV of Masuduzzaman.pdf.exe
3992	CV of Masuduzzaman.pdf.exe
3992	CV of Masuduzzaman.pdf.exe
3992	CV of Masuduzzaman.pdf.exe
3992	CV of Masuduzzaman.pdf.exe
3992	CV of Masuduzzaman.pdf.exe
3992	CV of Masuduzzaman.pdf.exe
3992	CV of Masuduzzaman.pdf.exe
3992	CV of Masuduzzaman.pdf.exe
3992	CV of Masuduzzaman.pdf.exe
3992	CV of Masuduzzaman.pdf.exe
3992	CV of Masuduzzaman.pdf.exe
3992	CV of Masuduzzaman.pdf.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3992	CV of Masuduzzaman.pdf.exe
Token: SeDebugPrivilege	672	dew.exe

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 3228 wrote to memory of 1324	3228	CV of Masuduzzaman.pdf.exe	79
PID 3228 wrote to memory of 1324	3228	CV of Masuduzzaman.pdf.exe	79
PID 3228 wrote to memory of 1324	3228	CV of Masuduzzaman.pdf.exe	79
PID 3228 wrote to memory of 3992	3228	CV of Masuduzzaman.pdf.exe	81
PID 3228 wrote to memory of 3992	3228	CV of Masuduzzaman.pdf.exe	81
PID 3228 wrote to memory of 3992	3228	CV of Masuduzzaman.pdf.exe	81
PID 3228 wrote to memory of 3992	3228	CV of Masuduzzaman.pdf.exe	81
PID 3228 wrote to memory of 3992	3228	CV of Masuduzzaman.pdf.exe	81
PID 3228 wrote to memory of 3992	3228	CV of Masuduzzaman.pdf.exe	81
PID 3228 wrote to memory of 3992	3228	CV of Masuduzzaman.pdf.exe	81
PID 3228 wrote to memory of 3992	3228	CV of Masuduzzaman.pdf.exe	81
PID 3992 wrote to memory of 1852	3992	CV of Masuduzzaman.pdf.exe	82
PID 3992 wrote to memory of 1852	3992	CV of Masuduzzaman.pdf.exe	82
PID 3992 wrote to memory of 1852	3992	CV of Masuduzzaman.pdf.exe	82
PID 3992 wrote to memory of 3856	3992	CV of Masuduzzaman.pdf.exe	84
PID 3992 wrote to memory of 3856	3992	CV of Masuduzzaman.pdf.exe	84
PID 3992 wrote to memory of 3856	3992	CV of Masuduzzaman.pdf.exe	84
PID 1852 wrote to memory of 4008	1852	cmd.exe	86
PID 1852 wrote to memory of 4008	1852	cmd.exe	86
PID 1852 wrote to memory of 4008	1852	cmd.exe	86
PID 3856 wrote to memory of 192	3856	cmd.exe	87
PID 3856 wrote to memory of 192	3856	cmd.exe	87
PID 3856 wrote to memory of 192	3856	cmd.exe	87
PID 3856 wrote to memory of 2804	3856	cmd.exe	88
PID 3856 wrote to memory of 2804	3856	cmd.exe	88
PID 3856 wrote to memory of 2804	3856	cmd.exe	88
PID 2804 wrote to memory of 1672	2804	dew.exe	89
PID 2804 wrote to memory of 1672	2804	dew.exe	89
PID 2804 wrote to memory of 1672	2804	dew.exe	89
PID 2804 wrote to memory of 672	2804	dew.exe	91
PID 2804 wrote to memory of 672	2804	dew.exe	91
PID 2804 wrote to memory of 672	2804	dew.exe	91
PID 2804 wrote to memory of 672	2804	dew.exe	91
PID 2804 wrote to memory of 672	2804	dew.exe	91
PID 2804 wrote to memory of 672	2804	dew.exe	91
PID 2804 wrote to memory of 672	2804	dew.exe	91
PID 2804 wrote to memory of 672	2804	dew.exe	91

C:\Users\Admin\AppData\Local\Temp\CV of Masuduzzaman.pdf.exe
"C:\Users\Admin\AppData\Local\Temp\CV of Masuduzzaman.pdf.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3228
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\XfinYUYTBGkPG" /XML "C:\Users\Admin\AppData\Local\Temp\tmpC375.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:1324
- C:\Users\Admin\AppData\Local\Temp\CV of Masuduzzaman.pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\CV of Masuduzzaman.pdf.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3992
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "dew" /tr '"C:\Users\Admin\AppData\Roaming\dew.exe"' & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1852
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /f /sc onlogon /rl highest /tn "dew" /tr '"C:\Users\Admin\AppData\Roaming\dew.exe"'
      4⤵
      Creates scheduled task(s)
      PID:4008
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpD789.tmp.bat""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3856
  - - C:\Windows\SysWOW64\timeout.exe
      timeout 3
      4⤵
      Delays execution with timeout.exe
      PID:192
  - - C:\Users\Admin\AppData\Roaming\dew.exe
      "C:\Users\Admin\AppData\Roaming\dew.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of WriteProcessMemory
      PID:2804
    - - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\XfinYUYTBGkPG" /XML "C:\Users\Admin\AppData\Local\Temp\tmp9655.tmp"
        5⤵
        Creates scheduled task(s)
        
        PID:1672
    - - C:\Users\Admin\AppData\Roaming\dew.exe
        
        "C:\Users\Admin\AppData\Roaming\dew.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:672

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/672-161-0x0000000005570000-0x0000000005571000-memory.dmp

Download

memory/672-164-0x00000000060C0000-0x00000000060C1000-memory.dmp

Download

memory/2804-149-0x00000000051E0000-0x000000000527C000-memory.dmp

Download

memory/3228-119-0x0000000004E40000-0x0000000004EDC000-memory.dmp

Download

memory/3228-114-0x00000000005B0000-0x00000000005B1000-memory.dmp

Download

memory/3228-116-0x0000000004EE0000-0x0000000004EE1000-memory.dmp

Download

memory/3228-117-0x0000000005530000-0x0000000005531000-memory.dmp

Download

memory/3228-118-0x0000000005030000-0x0000000005031000-memory.dmp

Download

memory/3228-124-0x0000000006EB0000-0x0000000006EBD000-memory.dmp

Download

memory/3228-122-0x00000000086D0000-0x00000000086E1000-memory.dmp

Download

memory/3228-120-0x0000000004ED0000-0x0000000004ED1000-memory.dmp

Download

memory/3228-123-0x00000000087A0000-0x000000000881D000-memory.dmp

Download

memory/3228-121-0x0000000005190000-0x0000000005191000-memory.dmp

Download

memory/3992-132-0x0000000005110000-0x0000000005111000-memory.dmp

Download

memory/3992-127-0x0000000000400000-0x0000000000412000-memory.dmp

Download