asyncrat | fcd5fc495b4f81bf91491b52e1759cf93794bf135fed6469a5d1e0663dfb6c3e

Analysis

max time kernel
147s
max time network
155s
platform
windows7_x64
resource
win7-en-20210920
submitted
22/09/2021, 13:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
fcd5fc495b4f81bf91491b52e1759cf93794bf135fed6469a5d1e0663dfb6c3e.exe
Size 701KB
Sample210922-ql9saafdam
SHA256 fcd5fc495b4f81bf91491b52e1759cf93794bf135fed6469a5d1e0663dfb6c3e
MD5 4d5f50841ae2d1f19a30b2e345844c21
SHA1 17b5d2875f7e5ae18b192e0f99c26f8145f985ee
SHA512 b45cb27909e592be4084f71462e3d73757b26d6a43e0252e436adf73a283fb2a613b3c4f33411c25ba10c26bbec90dbdc1113068f5634ff6771f7cb47c11d485
MD5 SHA1 SHA512

Score

10^/10

asyncrat asas rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.7A

Botnet

asas

exelelo.zapto.org:7707

Mutex

kpkayajfadh

Attributes

anti_vm
false
bsod
false
delay
1
install
false
install_folder
%AppData%
pastebin_config
null

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
rat asyncrat

Async RAT payload 4 IoCs

rat

resource	yara_rule
behavioral1/memory/1512-57-0x000000000040C61E-mapping.dmp	asyncrat
behavioral1/memory/1512-56-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat
behavioral1/memory/1512-58-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat
behavioral1/memory/1176-72-0x000000000040C61E-mapping.dmp	asyncrat

Executes dropped EXE 1 IoCs

pid	Process
1680	gg.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1400 set thread context of 1512	1400	fcd5fc495b4f81bf91491b52e1759cf93794bf135fed6469a5d1e0663dfb6c3e.exe	27
PID 1680 set thread context of 1176	1680	gg.exe	35

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
332	schtasks.exe
1780	schtasks.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1400	fcd5fc495b4f81bf91491b52e1759cf93794bf135fed6469a5d1e0663dfb6c3e.exe
Token: SeDebugPrivilege	1680	gg.exe

Suspicious use of WriteProcessMemory 46 IoCs

description	pid	Process	procid_target
PID 1400 wrote to memory of 1512	1400	fcd5fc495b4f81bf91491b52e1759cf93794bf135fed6469a5d1e0663dfb6c3e.exe	27
PID 1400 wrote to memory of 1512	1400	fcd5fc495b4f81bf91491b52e1759cf93794bf135fed6469a5d1e0663dfb6c3e.exe	27
PID 1400 wrote to memory of 1512	1400	fcd5fc495b4f81bf91491b52e1759cf93794bf135fed6469a5d1e0663dfb6c3e.exe	27
PID 1400 wrote to memory of 1512	1400	fcd5fc495b4f81bf91491b52e1759cf93794bf135fed6469a5d1e0663dfb6c3e.exe	27
PID 1400 wrote to memory of 1512	1400	fcd5fc495b4f81bf91491b52e1759cf93794bf135fed6469a5d1e0663dfb6c3e.exe	27
PID 1400 wrote to memory of 1512	1400	fcd5fc495b4f81bf91491b52e1759cf93794bf135fed6469a5d1e0663dfb6c3e.exe	27
PID 1400 wrote to memory of 1512	1400	fcd5fc495b4f81bf91491b52e1759cf93794bf135fed6469a5d1e0663dfb6c3e.exe	27
PID 1400 wrote to memory of 1512	1400	fcd5fc495b4f81bf91491b52e1759cf93794bf135fed6469a5d1e0663dfb6c3e.exe	27
PID 1400 wrote to memory of 1512	1400	fcd5fc495b4f81bf91491b52e1759cf93794bf135fed6469a5d1e0663dfb6c3e.exe	27
PID 1400 wrote to memory of 1488	1400	fcd5fc495b4f81bf91491b52e1759cf93794bf135fed6469a5d1e0663dfb6c3e.exe	28
PID 1400 wrote to memory of 1488	1400	fcd5fc495b4f81bf91491b52e1759cf93794bf135fed6469a5d1e0663dfb6c3e.exe	28
PID 1400 wrote to memory of 1488	1400	fcd5fc495b4f81bf91491b52e1759cf93794bf135fed6469a5d1e0663dfb6c3e.exe	28
PID 1400 wrote to memory of 1488	1400	fcd5fc495b4f81bf91491b52e1759cf93794bf135fed6469a5d1e0663dfb6c3e.exe	28
PID 1400 wrote to memory of 1788	1400	fcd5fc495b4f81bf91491b52e1759cf93794bf135fed6469a5d1e0663dfb6c3e.exe	30
PID 1400 wrote to memory of 1788	1400	fcd5fc495b4f81bf91491b52e1759cf93794bf135fed6469a5d1e0663dfb6c3e.exe	30
PID 1400 wrote to memory of 1788	1400	fcd5fc495b4f81bf91491b52e1759cf93794bf135fed6469a5d1e0663dfb6c3e.exe	30
PID 1400 wrote to memory of 1788	1400	fcd5fc495b4f81bf91491b52e1759cf93794bf135fed6469a5d1e0663dfb6c3e.exe	30
PID 1488 wrote to memory of 332	1488	cmd.exe	32
PID 1488 wrote to memory of 332	1488	cmd.exe	32
PID 1488 wrote to memory of 332	1488	cmd.exe	32
PID 1488 wrote to memory of 332	1488	cmd.exe	32
PID 1484 wrote to memory of 1680	1484	taskeng.exe	34
PID 1484 wrote to memory of 1680	1484	taskeng.exe	34
PID 1484 wrote to memory of 1680	1484	taskeng.exe	34
PID 1484 wrote to memory of 1680	1484	taskeng.exe	34
PID 1680 wrote to memory of 1176	1680	gg.exe	35
PID 1680 wrote to memory of 1176	1680	gg.exe	35
PID 1680 wrote to memory of 1176	1680	gg.exe	35
PID 1680 wrote to memory of 1176	1680	gg.exe	35
PID 1680 wrote to memory of 1176	1680	gg.exe	35
PID 1680 wrote to memory of 1176	1680	gg.exe	35
PID 1680 wrote to memory of 1176	1680	gg.exe	35
PID 1680 wrote to memory of 1176	1680	gg.exe	35
PID 1680 wrote to memory of 1176	1680	gg.exe	35
PID 1680 wrote to memory of 836	1680	gg.exe	36
PID 1680 wrote to memory of 836	1680	gg.exe	36
PID 1680 wrote to memory of 836	1680	gg.exe	36
PID 1680 wrote to memory of 836	1680	gg.exe	36
PID 1680 wrote to memory of 544	1680	gg.exe	37
PID 1680 wrote to memory of 544	1680	gg.exe	37
PID 1680 wrote to memory of 544	1680	gg.exe	37
PID 1680 wrote to memory of 544	1680	gg.exe	37
PID 836 wrote to memory of 1780	836	cmd.exe	40
PID 836 wrote to memory of 1780	836	cmd.exe	40
PID 836 wrote to memory of 1780	836	cmd.exe	40
PID 836 wrote to memory of 1780	836	cmd.exe	40

C:\Users\Admin\AppData\Local\Temp\fcd5fc495b4f81bf91491b52e1759cf93794bf135fed6469a5d1e0663dfb6c3e.exe
"C:\Users\Admin\AppData\Local\Temp\fcd5fc495b4f81bf91491b52e1759cf93794bf135fed6469a5d1e0663dfb6c3e.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1400
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
  2⤵
  PID:1512
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /sc minute /mo 1 /tn "Nano" /tr "'C:\Users\Admin\AppData\Roaming\gg\gg.exe'" /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1488
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "Nano" /tr "'C:\Users\Admin\AppData\Roaming\gg\gg.exe'" /f
    3⤵
    - Creates scheduled task(s)
    PID:332
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\fcd5fc495b4f81bf91491b52e1759cf93794bf135fed6469a5d1e0663dfb6c3e.exe" "C:\Users\Admin\AppData\Roaming\gg\gg.exe"
  2⤵
  PID:1788

C:\Windows\system32\taskeng.exe
taskeng.exe {3DCACF8C-2EE2-463D-B748-F114F0CAE14B} S-1-5-21-3456797065-1076791440-4146276586-1000:JZCKHXIN\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:1484
- C:\Users\Admin\AppData\Roaming\gg\gg.exe
  C:\Users\Admin\AppData\Roaming\gg\gg.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1680
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
    3⤵
    PID:1176
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c schtasks /create /sc minute /mo 1 /tn "Nano" /tr "'C:\Users\Admin\AppData\Roaming\gg\gg.exe'" /f
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:836
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /sc minute /mo 1 /tn "Nano" /tr "'C:\Users\Admin\AppData\Roaming\gg\gg.exe'" /f
      4⤵
      Creates scheduled task(s)
      PID:1780
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Roaming\gg\gg.exe" "C:\Users\Admin\AppData\Roaming\gg\gg.exe"
    3⤵
    PID:544

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Scripting

T1064

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Scripting

T1064

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1176-79-0x0000000000D80000-0x0000000000D81000-memory.dmp

Download

memory/1400-53-0x0000000000370000-0x0000000000371000-memory.dmp

Download

memory/1400-55-0x0000000004E00000-0x0000000004E01000-memory.dmp

Download

memory/1512-64-0x0000000005110000-0x0000000005111000-memory.dmp

Download

memory/1512-56-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/1512-58-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/1512-63-0x0000000075871000-0x0000000075873000-memory.dmp

Download

memory/1680-68-0x0000000000EA0000-0x0000000000EA1000-memory.dmp

Download

memory/1680-70-0x0000000004E50000-0x0000000004E51000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads