asyncrat | fcd5fc495b4f81bf91491b52e1759cf93794bf135fed6469a5d1e0663dfb6c3e

Analysis

max time kernel
155s
max time network
156s
platform
windows10_x64
resource
win10-en-20210920
submitted
22/09/2021, 13:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
fcd5fc495b4f81bf91491b52e1759cf93794bf135fed6469a5d1e0663dfb6c3e.exe
Size 701KB
Sample210922-ql9saafdam
SHA256 fcd5fc495b4f81bf91491b52e1759cf93794bf135fed6469a5d1e0663dfb6c3e
MD5 4d5f50841ae2d1f19a30b2e345844c21
SHA1 17b5d2875f7e5ae18b192e0f99c26f8145f985ee
SHA512 b45cb27909e592be4084f71462e3d73757b26d6a43e0252e436adf73a283fb2a613b3c4f33411c25ba10c26bbec90dbdc1113068f5634ff6771f7cb47c11d485
MD5 SHA1 SHA512

Score

10^/10

asyncrat asas rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.7A

Botnet

asas

exelelo.zapto.org:7707

Mutex

kpkayajfadh

Attributes

anti_vm
false
bsod
false
delay
1
install
false
install_folder
%AppData%
pastebin_config
null

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
rat asyncrat

Async RAT payload 3 IoCs

rat

resource	yara_rule
behavioral2/memory/2616-122-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat
behavioral2/memory/2616-123-0x000000000040C61E-mapping.dmp	asyncrat
behavioral2/memory/1064-143-0x000000000040C61E-mapping.dmp	asyncrat

Executes dropped EXE 1 IoCs

pid	Process
680	gg.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2284 set thread context of 2616	2284	fcd5fc495b4f81bf91491b52e1759cf93794bf135fed6469a5d1e0663dfb6c3e.exe	70
PID 680 set thread context of 1064	680	gg.exe	77

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
3804	schtasks.exe
4080	schtasks.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2284	fcd5fc495b4f81bf91491b52e1759cf93794bf135fed6469a5d1e0663dfb6c3e.exe
Token: SeDebugPrivilege	680	gg.exe

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 2284 wrote to memory of 2616	2284	fcd5fc495b4f81bf91491b52e1759cf93794bf135fed6469a5d1e0663dfb6c3e.exe	70
PID 2284 wrote to memory of 2616	2284	fcd5fc495b4f81bf91491b52e1759cf93794bf135fed6469a5d1e0663dfb6c3e.exe	70
PID 2284 wrote to memory of 2616	2284	fcd5fc495b4f81bf91491b52e1759cf93794bf135fed6469a5d1e0663dfb6c3e.exe	70
PID 2284 wrote to memory of 2616	2284	fcd5fc495b4f81bf91491b52e1759cf93794bf135fed6469a5d1e0663dfb6c3e.exe	70
PID 2284 wrote to memory of 2616	2284	fcd5fc495b4f81bf91491b52e1759cf93794bf135fed6469a5d1e0663dfb6c3e.exe	70
PID 2284 wrote to memory of 2616	2284	fcd5fc495b4f81bf91491b52e1759cf93794bf135fed6469a5d1e0663dfb6c3e.exe	70
PID 2284 wrote to memory of 2616	2284	fcd5fc495b4f81bf91491b52e1759cf93794bf135fed6469a5d1e0663dfb6c3e.exe	70
PID 2284 wrote to memory of 2616	2284	fcd5fc495b4f81bf91491b52e1759cf93794bf135fed6469a5d1e0663dfb6c3e.exe	70
PID 2284 wrote to memory of 3812	2284	fcd5fc495b4f81bf91491b52e1759cf93794bf135fed6469a5d1e0663dfb6c3e.exe	71
PID 2284 wrote to memory of 3812	2284	fcd5fc495b4f81bf91491b52e1759cf93794bf135fed6469a5d1e0663dfb6c3e.exe	71
PID 2284 wrote to memory of 3812	2284	fcd5fc495b4f81bf91491b52e1759cf93794bf135fed6469a5d1e0663dfb6c3e.exe	71
PID 2284 wrote to memory of 3564	2284	fcd5fc495b4f81bf91491b52e1759cf93794bf135fed6469a5d1e0663dfb6c3e.exe	72
PID 2284 wrote to memory of 3564	2284	fcd5fc495b4f81bf91491b52e1759cf93794bf135fed6469a5d1e0663dfb6c3e.exe	72
PID 2284 wrote to memory of 3564	2284	fcd5fc495b4f81bf91491b52e1759cf93794bf135fed6469a5d1e0663dfb6c3e.exe	72
PID 3812 wrote to memory of 3804	3812	cmd.exe	75
PID 3812 wrote to memory of 3804	3812	cmd.exe	75
PID 3812 wrote to memory of 3804	3812	cmd.exe	75
PID 680 wrote to memory of 1064	680	gg.exe	77
PID 680 wrote to memory of 1064	680	gg.exe	77
PID 680 wrote to memory of 1064	680	gg.exe	77
PID 680 wrote to memory of 1064	680	gg.exe	77
PID 680 wrote to memory of 1064	680	gg.exe	77
PID 680 wrote to memory of 1064	680	gg.exe	77
PID 680 wrote to memory of 1064	680	gg.exe	77
PID 680 wrote to memory of 1064	680	gg.exe	77
PID 680 wrote to memory of 828	680	gg.exe	78
PID 680 wrote to memory of 828	680	gg.exe	78
PID 680 wrote to memory of 828	680	gg.exe	78
PID 680 wrote to memory of 344	680	gg.exe	79
PID 680 wrote to memory of 344	680	gg.exe	79
PID 680 wrote to memory of 344	680	gg.exe	79
PID 828 wrote to memory of 4080	828	cmd.exe	82
PID 828 wrote to memory of 4080	828	cmd.exe	82
PID 828 wrote to memory of 4080	828	cmd.exe	82

C:\Users\Admin\AppData\Local\Temp\fcd5fc495b4f81bf91491b52e1759cf93794bf135fed6469a5d1e0663dfb6c3e.exe
"C:\Users\Admin\AppData\Local\Temp\fcd5fc495b4f81bf91491b52e1759cf93794bf135fed6469a5d1e0663dfb6c3e.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2284
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
  2⤵
  PID:2616
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /sc minute /mo 1 /tn "Nano" /tr "'C:\Users\Admin\AppData\Roaming\gg\gg.exe'" /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3812
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "Nano" /tr "'C:\Users\Admin\AppData\Roaming\gg\gg.exe'" /f
    3⤵
    - Creates scheduled task(s)
    PID:3804
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\fcd5fc495b4f81bf91491b52e1759cf93794bf135fed6469a5d1e0663dfb6c3e.exe" "C:\Users\Admin\AppData\Roaming\gg\gg.exe"
  2⤵
  PID:3564

C:\Users\Admin\AppData\Roaming\gg\gg.exe
C:\Users\Admin\AppData\Roaming\gg\gg.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:680
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
  2⤵
  PID:1064
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /sc minute /mo 1 /tn "Nano" /tr "'C:\Users\Admin\AppData\Roaming\gg\gg.exe'" /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:828
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "Nano" /tr "'C:\Users\Admin\AppData\Roaming\gg\gg.exe'" /f
    3⤵
    - Creates scheduled task(s)
    PID:4080
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Roaming\gg\gg.exe" "C:\Users\Admin\AppData\Roaming\gg\gg.exe"
  2⤵
  PID:344

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Scripting

T1064

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Scripting

T1064

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/680-141-0x00000000027A0000-0x00000000027A1000-memory.dmp

Download

memory/680-135-0x0000000000200000-0x0000000000201000-memory.dmp

Download

memory/1064-152-0x0000000009100000-0x0000000009101000-memory.dmp

Download

memory/2284-121-0x0000000002570000-0x0000000002571000-memory.dmp

Download

memory/2284-115-0x0000000000AD0000-0x0000000000AD1000-memory.dmp

Download

memory/2284-120-0x0000000004CE0000-0x0000000004CE1000-memory.dmp

Download

memory/2284-119-0x0000000004BD0000-0x0000000004BD1000-memory.dmp

Download

memory/2284-118-0x0000000004D00000-0x0000000004D01000-memory.dmp

Download

memory/2284-117-0x0000000005160000-0x0000000005161000-memory.dmp

Download

memory/2616-132-0x0000000009800000-0x0000000009801000-memory.dmp

Download

memory/2616-122-0x0000000000400000-0x0000000000412000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads