asyncrat | 7fcb98579512e3df028c8199b530d8e027d55a871d2afb81aeb5994adac814bf

General

Target

8febef9e39284335678e45955722d6a6.exe
Size

617KB
MD5

8febef9e39284335678e45955722d6a6
SHA1

0f5de2557c7cef0c486157089cf2b761ca8839d7
SHA256

7fcb98579512e3df028c8199b530d8e027d55a871d2afb81aeb5994adac814bf
SHA512

e8b70e73b960b4fa3fa209baaf702990dc4a153cca85eca5a9586ab42dab82d99d6ecec15c9ed043cca2637710f2921f94b2a2b934c9960fe36514cdf4ceacbf

Score

10^/10

asyncrat bitrat 1 persistence rat trojan

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

1

C2

185.157.160.136:1973

Mutex

df4Rtg34dFjwr7ujp3

Attributes

anti_vm
false
bsod
false
delay
38
install
false
install_folder
%AppData%
pastebin_config
null

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
rat asyncrat
BitRAT
BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
trojan bitrat

BitRAT Payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1076-79-0x0000000000400000-0x00000000007CE000-memory.dmp	family_bitrat
behavioral1/memory/1076-80-0x000000000068A488-mapping.dmp	family_bitrat
behavioral1/memory/1076-81-0x0000000000400000-0x00000000007CE000-memory.dmp	family_bitrat

Async RAT payload 4 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/796-58-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat
behavioral1/memory/796-59-0x000000000040C6BE-mapping.dmp	asyncrat
behavioral1/memory/796-60-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat
behavioral1/memory/796-64-0x00000000006A0000-0x00000000006BB000-memory.dmp	asyncrat

Executes dropped EXE 1 IoCs

Processes:

ylbhgj.exe

pid process

1988 ylbhgj.exe
Loads dropped DLL 2 IoCs

Processes:

powershell.exe

pid process

1012 powershell.exe
1012 powershell.exe

pid	process
1988	ylbhgj.exe

pid	process
1012	powershell.exe
1012	powershell.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

8febef9e39284335678e45955722d6a6.exeylbhgj.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Windows\CurrentVersion\Run	8febef9e39284335678e45955722d6a6.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Windows\CurrentVersion\Run\rka = "C:\\Users\\Admin\\AppData\\Roaming\\rga\\rpa.exe"	8febef9e39284335678e45955722d6a6.exe
Key created	\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Windows\CurrentVersion\Run	ylbhgj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Windows\CurrentVersion\Run\fg = "C:\\Users\\Admin\\AppData\\Roaming\\df\\gh.exe"	ylbhgj.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs

Processes:

RegSvcs.exe

pid process

1076 RegSvcs.exe
1076 RegSvcs.exe
1076 RegSvcs.exe
1076 RegSvcs.exe
1076 RegSvcs.exe

pid	process
1076	RegSvcs.exe
1076	RegSvcs.exe
1076	RegSvcs.exe
1076	RegSvcs.exe
1076	RegSvcs.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

8febef9e39284335678e45955722d6a6.exeylbhgj.exe

description	pid	process	target process
PID 560 set thread context of 796	560	8febef9e39284335678e45955722d6a6.exe	RegSvcs.exe
PID 1988 set thread context of 1076	1988	ylbhgj.exe	RegSvcs.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

RegSvcs.exepowershell.exe

pid process

796 RegSvcs.exe
1012 powershell.exe
1012 powershell.exe
1012 powershell.exe

pid	process
796	RegSvcs.exe
1012	powershell.exe
1012	powershell.exe
1012	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

RegSvcs.exepowershell.exeRegSvcs.exe

description	pid	process
Token: SeDebugPrivilege	796	RegSvcs.exe
Token: SeDebugPrivilege	1012	powershell.exe
Token: SeDebugPrivilege	1076	RegSvcs.exe
Token: SeShutdownPrivilege	1076	RegSvcs.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

8febef9e39284335678e45955722d6a6.exeylbhgj.exeRegSvcs.exe

pid process

560 8febef9e39284335678e45955722d6a6.exe
1988 ylbhgj.exe
1076 RegSvcs.exe
1076 RegSvcs.exe

pid	process
560	8febef9e39284335678e45955722d6a6.exe
1988	ylbhgj.exe
1076	RegSvcs.exe
1076	RegSvcs.exe

Suspicious use of WriteProcessMemory 39 IoCs

Processes:

8febef9e39284335678e45955722d6a6.exeRegSvcs.execmd.exepowershell.exeylbhgj.exe

description	pid	process	target process
PID 560 wrote to memory of 796	560	8febef9e39284335678e45955722d6a6.exe	RegSvcs.exe
PID 560 wrote to memory of 796	560	8febef9e39284335678e45955722d6a6.exe	RegSvcs.exe
PID 560 wrote to memory of 796	560	8febef9e39284335678e45955722d6a6.exe	RegSvcs.exe
PID 560 wrote to memory of 796	560	8febef9e39284335678e45955722d6a6.exe	RegSvcs.exe
PID 560 wrote to memory of 796	560	8febef9e39284335678e45955722d6a6.exe	RegSvcs.exe
PID 560 wrote to memory of 796	560	8febef9e39284335678e45955722d6a6.exe	RegSvcs.exe
PID 560 wrote to memory of 796	560	8febef9e39284335678e45955722d6a6.exe	RegSvcs.exe
PID 560 wrote to memory of 796	560	8febef9e39284335678e45955722d6a6.exe	RegSvcs.exe
PID 560 wrote to memory of 796	560	8febef9e39284335678e45955722d6a6.exe	RegSvcs.exe
PID 560 wrote to memory of 796	560	8febef9e39284335678e45955722d6a6.exe	RegSvcs.exe
PID 560 wrote to memory of 796	560	8febef9e39284335678e45955722d6a6.exe	RegSvcs.exe
PID 560 wrote to memory of 796	560	8febef9e39284335678e45955722d6a6.exe	RegSvcs.exe
PID 796 wrote to memory of 916	796	RegSvcs.exe	cmd.exe
PID 796 wrote to memory of 916	796	RegSvcs.exe	cmd.exe
PID 796 wrote to memory of 916	796	RegSvcs.exe	cmd.exe
PID 796 wrote to memory of 916	796	RegSvcs.exe	cmd.exe
PID 916 wrote to memory of 1012	916	cmd.exe	powershell.exe
PID 916 wrote to memory of 1012	916	cmd.exe	powershell.exe
PID 916 wrote to memory of 1012	916	cmd.exe	powershell.exe
PID 916 wrote to memory of 1012	916	cmd.exe	powershell.exe
PID 1012 wrote to memory of 1988	1012	powershell.exe	ylbhgj.exe
PID 1012 wrote to memory of 1988	1012	powershell.exe	ylbhgj.exe
PID 1012 wrote to memory of 1988	1012	powershell.exe	ylbhgj.exe
PID 1012 wrote to memory of 1988	1012	powershell.exe	ylbhgj.exe
PID 1988 wrote to memory of 1076	1988	ylbhgj.exe	RegSvcs.exe
PID 1988 wrote to memory of 1076	1988	ylbhgj.exe	RegSvcs.exe
PID 1988 wrote to memory of 1076	1988	ylbhgj.exe	RegSvcs.exe
PID 1988 wrote to memory of 1076	1988	ylbhgj.exe	RegSvcs.exe
PID 1988 wrote to memory of 1076	1988	ylbhgj.exe	RegSvcs.exe
PID 1988 wrote to memory of 1076	1988	ylbhgj.exe	RegSvcs.exe
PID 1988 wrote to memory of 1076	1988	ylbhgj.exe	RegSvcs.exe
PID 1988 wrote to memory of 1076	1988	ylbhgj.exe	RegSvcs.exe
PID 1988 wrote to memory of 1076	1988	ylbhgj.exe	RegSvcs.exe
PID 1988 wrote to memory of 1076	1988	ylbhgj.exe	RegSvcs.exe
PID 1988 wrote to memory of 1076	1988	ylbhgj.exe	RegSvcs.exe
PID 1988 wrote to memory of 1076	1988	ylbhgj.exe	RegSvcs.exe
PID 1988 wrote to memory of 1076	1988	ylbhgj.exe	RegSvcs.exe
PID 1988 wrote to memory of 1076	1988	ylbhgj.exe	RegSvcs.exe
PID 1988 wrote to memory of 1076	1988	ylbhgj.exe	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\8febef9e39284335678e45955722d6a6.exe
"C:\Users\Admin\AppData\Local\Temp\8febef9e39284335678e45955722d6a6.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:560

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:796

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\ylbhgj.exe"' & exit
3⤵
- Suspicious use of WriteProcessMemory
PID:916

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\ylbhgj.exe"'
4⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1012

C:\Users\Admin\AppData\Local\Temp\ylbhgj.exe
"C:\Users\Admin\AppData\Local\Temp\ylbhgj.exe"
5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1988

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
6⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1076

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\ylbhgj.exe
MD5
353bf835f7858ee5a1a77e70cef01607

SHA1
2db1b8bb53f5c7b45db326695065efd6e0ac5867

SHA256
688d8eaf46e1fc66223d9fb5f1beae9127b1ad16ecfbb080e84dccff2e146d08

SHA512
00b2d9ba1887fef99165de5e1b386c3a3b4780f6baf2525206fa8a364d7ebf0267659877f303ad0fb2918868b26c02dfe9901b7228d79ef79c409ef1253dfff8

Download Submit
C:\Users\Admin\AppData\Local\Temp\ylbhgj.exe
MD5
353bf835f7858ee5a1a77e70cef01607

SHA1
2db1b8bb53f5c7b45db326695065efd6e0ac5867

SHA256
688d8eaf46e1fc66223d9fb5f1beae9127b1ad16ecfbb080e84dccff2e146d08

SHA512
00b2d9ba1887fef99165de5e1b386c3a3b4780f6baf2525206fa8a364d7ebf0267659877f303ad0fb2918868b26c02dfe9901b7228d79ef79c409ef1253dfff8

Download Submit
\Users\Admin\AppData\Local\Temp\ylbhgj.exe
MD5
353bf835f7858ee5a1a77e70cef01607

SHA1
2db1b8bb53f5c7b45db326695065efd6e0ac5867

SHA256
688d8eaf46e1fc66223d9fb5f1beae9127b1ad16ecfbb080e84dccff2e146d08

SHA512
00b2d9ba1887fef99165de5e1b386c3a3b4780f6baf2525206fa8a364d7ebf0267659877f303ad0fb2918868b26c02dfe9901b7228d79ef79c409ef1253dfff8

Download Submit
\Users\Admin\AppData\Local\Temp\ylbhgj.exe
MD5
353bf835f7858ee5a1a77e70cef01607

SHA1
2db1b8bb53f5c7b45db326695065efd6e0ac5867

SHA256
688d8eaf46e1fc66223d9fb5f1beae9127b1ad16ecfbb080e84dccff2e146d08

SHA512
00b2d9ba1887fef99165de5e1b386c3a3b4780f6baf2525206fa8a364d7ebf0267659877f303ad0fb2918868b26c02dfe9901b7228d79ef79c409ef1253dfff8

Download Submit
memory/560-56-0x0000000000220000-0x000000000022A000-memory.dmp

Filesize
40KB

Download
memory/560-57-0x0000000075321000-0x0000000075323000-memory.dmp

Filesize
8KB

Download
memory/560-55-0x0000000000220000-0x0000000000226000-memory.dmp

Filesize
24KB

Download
memory/796-60-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/796-58-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/796-59-0x000000000040C6BE-mapping.dmp

Download
memory/796-63-0x0000000004F20000-0x0000000004F21000-memory.dmp

Filesize
4KB

Download
memory/796-64-0x00000000006A0000-0x00000000006BB000-memory.dmp

Filesize
108KB

Download
memory/916-65-0x0000000000000000-mapping.dmp

Download
memory/1012-70-0x00000000004A2000-0x00000000004A4000-memory.dmp

Filesize
8KB

Download
memory/1012-69-0x00000000004A1000-0x00000000004A2000-memory.dmp

Filesize
4KB

Download
memory/1012-68-0x00000000004A0000-0x00000000004A1000-memory.dmp

Filesize
4KB

Download
memory/1012-66-0x0000000000000000-mapping.dmp

Download
memory/1076-79-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/1076-80-0x000000000068A488-mapping.dmp

Download
memory/1076-81-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/1988-74-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads