asyncrat | e628eb00a34bd2527ddfe81d6882a4c653aeb23d5070ffffe9eeddd3521a1a5c

Analysis

max time kernel
122s
max time network
149s
platform
windows10_x64
resource
win10-en-20210920
submitted
24/09/2021, 08:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
P.O-20210923120155HT.exe
Size 222KB
Sample210924-j9ll2agda3
SHA256 e628eb00a34bd2527ddfe81d6882a4c653aeb23d5070ffffe9eeddd3521a1a5c
MD5 dd2e72612360910a7a2363c768906627
SHA1 73ec5d7404c8f800a6fca2262e291389418aace8
SHA512 136760667f0f00a959fde8f7b3317f70184c2a6b7b9a2e99cab988d0c246ecf0a4f817c3a08bea13aeac2017ec70fbb64163871dc4e3652e232e697f7f4e318f
MD5 SHA1 SHA512

Score

10^/10

asyncrat default evasion rat spyware stealer trojan

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

Default

185.140.53.47:2424

Mutex

AsyncMutex_6SI8OkPnk

Attributes

anti_vm
false
bsod
false
delay
3
install
false
install_folder
%AppData%
pastebin_config
null

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
rat asyncrat
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral2/memory/2064-138-0x0000000005D20000-0x0000000005D2B000-memory.dmp	asyncrat

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Windows security modification 2 TTPs 4 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths	P.O-20210923120155HT.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions	P.O-20210923120155HT.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Resources\Themes\쓢쓀쓃쓰쓲쓯쓭쓀쓱쒽쓰쓚쓲쓱쓂\svchost.exe = "0"	P.O-20210923120155HT.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\P.O-20210923120155HT.exe = "0"	P.O-20210923120155HT.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Resources\Themes\쓢쓀쓃쓰쓲쓯쓭쓀쓱쒽쓰쓚쓲쓱쓂\svchost.exe	P.O-20210923120155HT.exe
File opened for modification	C:\Windows\Resources\Themes\쓢쓀쓃쓰쓲쓯쓭쓀쓱쒽쓰쓚쓲쓱쓂\svchost.exe	P.O-20210923120155HT.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
2092	powershell.exe
1960	powershell.exe
2624	powershell.exe
1960	powershell.exe
2624	powershell.exe
2092	powershell.exe
1960	powershell.exe
2624	powershell.exe
2092	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2064	P.O-20210923120155HT.exe
Token: SeDebugPrivilege	2092	powershell.exe
Token: SeDebugPrivilege	1960	powershell.exe
Token: SeDebugPrivilege	2624	powershell.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 2064 wrote to memory of 2624	2064	P.O-20210923120155HT.exe	70
PID 2064 wrote to memory of 2624	2064	P.O-20210923120155HT.exe	70
PID 2064 wrote to memory of 2624	2064	P.O-20210923120155HT.exe	70
PID 2064 wrote to memory of 2092	2064	P.O-20210923120155HT.exe	72
PID 2064 wrote to memory of 2092	2064	P.O-20210923120155HT.exe	72
PID 2064 wrote to memory of 2092	2064	P.O-20210923120155HT.exe	72
PID 2064 wrote to memory of 1960	2064	P.O-20210923120155HT.exe	74
PID 2064 wrote to memory of 1960	2064	P.O-20210923120155HT.exe	74
PID 2064 wrote to memory of 1960	2064	P.O-20210923120155HT.exe	74
PID 2064 wrote to memory of 2176	2064	P.O-20210923120155HT.exe	77
PID 2064 wrote to memory of 2176	2064	P.O-20210923120155HT.exe	77
PID 2064 wrote to memory of 2176	2064	P.O-20210923120155HT.exe	77
PID 2176 wrote to memory of 660	2176	cmd.exe	79
PID 2176 wrote to memory of 660	2176	cmd.exe	79
PID 2176 wrote to memory of 660	2176	cmd.exe	79

C:\Users\Admin\AppData\Local\Temp\P.O-20210923120155HT.exe
"C:\Users\Admin\AppData\Local\Temp\P.O-20210923120155HT.exe"
1⤵
- Windows security modification
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2064
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Resources\Themes\쓢쓀쓃쓰쓲쓯쓭쓀쓱쒽쓰쓚쓲쓱쓂\svchost.exe" -Force
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2624
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\P.O-20210923120155HT.exe" -Force
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2092
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Resources\Themes\쓢쓀쓃쓰쓲쓯쓭쓀쓱쒽쓰쓚쓲쓱쓂\svchost.exe" -Force
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1960
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\afycap.exe"' & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2176
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\afycap.exe"'
    3⤵
    PID:660

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1960-211-0x0000000007560000-0x0000000007561000-memory.dmp

Download

memory/1960-145-0x0000000008000000-0x0000000008001000-memory.dmp

Download

memory/1960-260-0x00000000072B3000-0x00000000072B4000-memory.dmp

Download

memory/1960-191-0x000000007F430000-0x000000007F431000-memory.dmp

Download

memory/1960-185-0x0000000009980000-0x00000000099B3000-memory.dmp

Download

memory/1960-163-0x0000000008A00000-0x0000000008A01000-memory.dmp

Download

memory/1960-156-0x00000000072B2000-0x00000000072B3000-memory.dmp

Download

memory/1960-157-0x00000000080F0000-0x00000000080F1000-memory.dmp

Download

memory/1960-153-0x00000000072B0000-0x00000000072B1000-memory.dmp

Download

memory/1960-148-0x0000000008360000-0x0000000008361000-memory.dmp

Download

memory/2064-137-0x0000000005D30000-0x0000000005D31000-memory.dmp

Download

memory/2064-138-0x0000000005D20000-0x0000000005D2B000-memory.dmp

Download

memory/2064-118-0x0000000005C10000-0x0000000005C66000-memory.dmp

Download

memory/2064-119-0x0000000006170000-0x0000000006171000-memory.dmp

Download

memory/2064-115-0x0000000000750000-0x0000000000751000-memory.dmp

Download

memory/2064-117-0x0000000004F70000-0x0000000004F71000-memory.dmp

Download

memory/2064-130-0x0000000005D60000-0x0000000005D61000-memory.dmp

Download

memory/2064-120-0x0000000004ED0000-0x0000000004F6C000-memory.dmp

Download

memory/2092-154-0x0000000001180000-0x0000000001181000-memory.dmp

Download

memory/2092-268-0x0000000001183000-0x0000000001184000-memory.dmp

Download

memory/2092-139-0x0000000006AE0000-0x0000000006AE1000-memory.dmp

Download

memory/2092-155-0x0000000001182000-0x0000000001183000-memory.dmp

Download

memory/2092-195-0x000000007EFB0000-0x000000007EFB1000-memory.dmp

Download

memory/2092-142-0x0000000006B80000-0x0000000006B81000-memory.dmp

Download

memory/2624-226-0x00000000095F0000-0x00000000095F1000-memory.dmp

Download

memory/2624-199-0x000000007E7F0000-0x000000007E7F1000-memory.dmp

Download

memory/2624-160-0x0000000008730000-0x0000000008731000-memory.dmp

Download

memory/2624-264-0x00000000049D3000-0x00000000049D4000-memory.dmp

Download

memory/2624-152-0x00000000049D2000-0x00000000049D3000-memory.dmp

Download

memory/2624-151-0x00000000049D0000-0x00000000049D1000-memory.dmp

Download

memory/2624-132-0x0000000007580000-0x0000000007581000-memory.dmp

Download

memory/2624-126-0x0000000004A30000-0x0000000004A31000-memory.dmp

Download