asyncrat | 24dbb145167a5e82b5f9184c0e738073f99dda4e288c92d61519a8dee5546d59

Analysis

max time kernel
146s
max time network
149s
platform
windows10_x64
resource
win10-en-20210920
submitted
23/09/2021, 14:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Image003.jpg.exe
Size 445KB
Sample210923-rlp9baeedj
SHA256 24dbb145167a5e82b5f9184c0e738073f99dda4e288c92d61519a8dee5546d59
MD5 d7b169e952b47e9ebd9b672b9d8e3377
SHA1 6d00c8fb6d52929dd86a070908eec9472c5c4ec2
SHA512 7304c3df3b0df5a218b8500eb6bc5d844b397639f043b3b845f706a772f8a53ca7769720484bcc4361886fda8c3dfdd16c8a5120c5370196ae83d62b3dbf1f43
MD5 SHA1 SHA512

Score

10^/10

asyncrat rat

Malware Config

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
rat asyncrat

Async RAT payload 4 IoCs

rat

resource	yara_rule
behavioral2/memory/3244-126-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat
behavioral2/memory/3244-127-0x000000000040D06E-mapping.dmp	asyncrat
behavioral2/memory/2904-147-0x0000000004F10000-0x000000000540E000-memory.dmp	asyncrat
behavioral2/memory/2860-153-0x000000000040D06E-mapping.dmp	asyncrat

Executes dropped EXE 2 IoCs

pid	Process
2904	dew.exe
2860	dew.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2348 set thread context of 3244	2348	Image003.jpg.exe	72
PID 2904 set thread context of 2860	2904	dew.exe	83

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
3448	schtasks.exe
1052	schtasks.exe
2848	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
1248	timeout.exe

Suspicious behavior: EnumeratesProcesses 15 IoCs

pid	Process
3244	Image003.jpg.exe
3244	Image003.jpg.exe
3244	Image003.jpg.exe
3244	Image003.jpg.exe
3244	Image003.jpg.exe
3244	Image003.jpg.exe
3244	Image003.jpg.exe
3244	Image003.jpg.exe
3244	Image003.jpg.exe
3244	Image003.jpg.exe
3244	Image003.jpg.exe
3244	Image003.jpg.exe
3244	Image003.jpg.exe
3244	Image003.jpg.exe
3244	Image003.jpg.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3244	Image003.jpg.exe
Token: SeDebugPrivilege	2860	dew.exe

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 2348 wrote to memory of 3448	2348	Image003.jpg.exe	70
PID 2348 wrote to memory of 3448	2348	Image003.jpg.exe	70
PID 2348 wrote to memory of 3448	2348	Image003.jpg.exe	70
PID 2348 wrote to memory of 3244	2348	Image003.jpg.exe	72
PID 2348 wrote to memory of 3244	2348	Image003.jpg.exe	72
PID 2348 wrote to memory of 3244	2348	Image003.jpg.exe	72
PID 2348 wrote to memory of 3244	2348	Image003.jpg.exe	72
PID 2348 wrote to memory of 3244	2348	Image003.jpg.exe	72
PID 2348 wrote to memory of 3244	2348	Image003.jpg.exe	72
PID 2348 wrote to memory of 3244	2348	Image003.jpg.exe	72
PID 2348 wrote to memory of 3244	2348	Image003.jpg.exe	72
PID 3244 wrote to memory of 1268	3244	Image003.jpg.exe	73
PID 3244 wrote to memory of 1268	3244	Image003.jpg.exe	73
PID 3244 wrote to memory of 1268	3244	Image003.jpg.exe	73
PID 3244 wrote to memory of 1272	3244	Image003.jpg.exe	75
PID 3244 wrote to memory of 1272	3244	Image003.jpg.exe	75
PID 3244 wrote to memory of 1272	3244	Image003.jpg.exe	75
PID 1268 wrote to memory of 1052	1268	cmd.exe	77
PID 1268 wrote to memory of 1052	1268	cmd.exe	77
PID 1268 wrote to memory of 1052	1268	cmd.exe	77
PID 1272 wrote to memory of 1248	1272	cmd.exe	78
PID 1272 wrote to memory of 1248	1272	cmd.exe	78
PID 1272 wrote to memory of 1248	1272	cmd.exe	78
PID 1272 wrote to memory of 2904	1272	cmd.exe	79
PID 1272 wrote to memory of 2904	1272	cmd.exe	79
PID 1272 wrote to memory of 2904	1272	cmd.exe	79
PID 2904 wrote to memory of 2848	2904	dew.exe	82
PID 2904 wrote to memory of 2848	2904	dew.exe	82
PID 2904 wrote to memory of 2848	2904	dew.exe	82
PID 2904 wrote to memory of 2860	2904	dew.exe	83
PID 2904 wrote to memory of 2860	2904	dew.exe	83
PID 2904 wrote to memory of 2860	2904	dew.exe	83
PID 2904 wrote to memory of 2860	2904	dew.exe	83
PID 2904 wrote to memory of 2860	2904	dew.exe	83
PID 2904 wrote to memory of 2860	2904	dew.exe	83
PID 2904 wrote to memory of 2860	2904	dew.exe	83
PID 2904 wrote to memory of 2860	2904	dew.exe	83

C:\Users\Admin\AppData\Local\Temp\Image003.jpg.exe
"C:\Users\Admin\AppData\Local\Temp\Image003.jpg.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2348
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\xkVuIrUrlrA" /XML "C:\Users\Admin\AppData\Local\Temp\tmp1A30.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:3448
- C:\Users\Admin\AppData\Local\Temp\Image003.jpg.exe
  "C:\Users\Admin\AppData\Local\Temp\Image003.jpg.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3244
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "dew" /tr '"C:\Users\Admin\AppData\Roaming\dew.exe"' & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1268
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /f /sc onlogon /rl highest /tn "dew" /tr '"C:\Users\Admin\AppData\Roaming\dew.exe"'
      4⤵
      Creates scheduled task(s)
      PID:1052
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp2EA2.tmp.bat""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1272
  - - C:\Windows\SysWOW64\timeout.exe
      timeout 3
      4⤵
      Delays execution with timeout.exe
      PID:1248
  - - C:\Users\Admin\AppData\Roaming\dew.exe
      "C:\Users\Admin\AppData\Roaming\dew.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of WriteProcessMemory
      PID:2904
    - - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\xkVuIrUrlrA" /XML "C:\Users\Admin\AppData\Local\Temp\tmpDC19.tmp"
        5⤵
        Creates scheduled task(s)
        
        PID:2848
    - - C:\Users\Admin\AppData\Roaming\dew.exe
        
        "C:\Users\Admin\AppData\Roaming\dew.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2860

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2348-119-0x0000000004D60000-0x000000000525E000-memory.dmp

Download

memory/2348-120-0x0000000004D10000-0x0000000004D11000-memory.dmp

Download

memory/2348-124-0x0000000007520000-0x000000000753D000-memory.dmp

Download

memory/2348-117-0x0000000005260000-0x0000000005261000-memory.dmp

Download

memory/2348-115-0x0000000000470000-0x0000000000471000-memory.dmp

Download

memory/2348-118-0x0000000004D60000-0x0000000004D61000-memory.dmp

Download

memory/2348-123-0x00000000074C0000-0x000000000750D000-memory.dmp

Download

memory/2348-122-0x00000000073A0000-0x00000000073A1000-memory.dmp

Download

memory/2348-121-0x00000000050D0000-0x00000000050ED000-memory.dmp

Download

memory/2860-158-0x0000000005410000-0x0000000005411000-memory.dmp

Download

memory/2904-147-0x0000000004F10000-0x000000000540E000-memory.dmp

Download

memory/3244-126-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/3244-131-0x0000000005340000-0x0000000005341000-memory.dmp

Download