asyncrat | 14f5b515b14887c84e5e18151d51d75d6df4aaccda161391060c6a71b786a18a

General

Target

LOI-20210510473689004882.exe
Size

855KB
MD5

aa4f46e132510172e5beb140a7f03957
SHA1

2f6e2b495a79bdfe69b8ef0ecb3dd656d2d348a9
SHA256

f7daabadaa1974b529e8db367a07d128b60724cc54c4dfcc008c35c124b77929
SHA512

99dfb511267bc3072e9bfc42cc3bb8fe1bb32af7a303a03fa04ae46b9c5cbec2101d3e1e9a5c8011ceb3260c25d322e6f336bf63fe2b0b79600cb3c0e312bce5

Score

10^/10

asyncrat default agilenet rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

Default

C2

127.0.0.1:6606

127.0.0.1:7707

127.0.0.1:8808

127.0.0.1:3578

194.127.178.3:6606

194.127.178.3:7707

194.127.178.3:8808

194.127.178.3:3578

aliensoldier.duckdns.org:6606

aliensoldier.duckdns.org:7707

aliensoldier.duckdns.org:8808

aliensoldier.duckdns.org:3578

Mutex

AsyncMutex_6SI8OkPnk

Attributes

anti_vm
false
bsod
false
delay
3
install
false
install_folder
%AppData%
pastebin_config
null

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
rat asyncrat

Async RAT payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/2868-129-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat
behavioral2/memory/2868-130-0x000000000040C7CE-mapping.dmp	asyncrat

Executes dropped EXE 1 IoCs

Processes:

InstallUtil.exe

pid process

2868 InstallUtil.exe

pid	process
2868	InstallUtil.exe

Obfuscated with Agile.Net obfuscator 2 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

Processes:

resource	yara_rule
behavioral2/memory/1676-123-0x00000000057E0000-0x0000000005801000-memory.dmp	agile_net
behavioral2/memory/1676-126-0x00000000053F0000-0x00000000058EE000-memory.dmp	agile_net

Suspicious use of SetThreadContext 1 IoCs

Processes:

LOI-20210510473689004882.exe

description pid process target process

PID 1676 set thread context of 2868 1676 LOI-20210510473689004882.exe InstallUtil.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

LOI-20210510473689004882.exe

pid process

1676 LOI-20210510473689004882.exe
1676 LOI-20210510473689004882.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

LOI-20210510473689004882.exe

description pid process

Token: SeDebugPrivilege 1676 LOI-20210510473689004882.exe

description	pid	process	target process
PID 1676 set thread context of 2868	1676	LOI-20210510473689004882.exe	InstallUtil.exe

pid	process
1676	LOI-20210510473689004882.exe
1676	LOI-20210510473689004882.exe

description	pid	process
Token: SeDebugPrivilege	1676	LOI-20210510473689004882.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

LOI-20210510473689004882.exe

description	pid	process	target process
PID 1676 wrote to memory of 2868	1676	LOI-20210510473689004882.exe	InstallUtil.exe
PID 1676 wrote to memory of 2868	1676	LOI-20210510473689004882.exe	InstallUtil.exe
PID 1676 wrote to memory of 2868	1676	LOI-20210510473689004882.exe	InstallUtil.exe
PID 1676 wrote to memory of 2868	1676	LOI-20210510473689004882.exe	InstallUtil.exe
PID 1676 wrote to memory of 2868	1676	LOI-20210510473689004882.exe	InstallUtil.exe
PID 1676 wrote to memory of 2868	1676	LOI-20210510473689004882.exe	InstallUtil.exe
PID 1676 wrote to memory of 2868	1676	LOI-20210510473689004882.exe	InstallUtil.exe
PID 1676 wrote to memory of 2868	1676	LOI-20210510473689004882.exe	InstallUtil.exe

C:\Users\Admin\AppData\Local\Temp\LOI-20210510473689004882.exe
"C:\Users\Admin\AppData\Local\Temp\LOI-20210510473689004882.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1676

C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe
"C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe"
2⤵
- Executes dropped EXE
PID:2868

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe
MD5
91c9ae9c9a17a9db5e08b120e668c74c

SHA1
50770954c1ceb0bb6f1d5d3f2de2a0a065773723

SHA256
e56a7e5d3ab9675555e2897fc3faa2dd9265008a4967a7d54030ab8184d2d38f

SHA512
ca504af192e3318359d4742a2ef26ae1b5d040a4f9942782e02549a310158d5d5dbf919b4c748c31ee609d2046bd23ee0c22712891c86ae4a1e3a58c6e67647e

Download Submit
C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe
MD5
91c9ae9c9a17a9db5e08b120e668c74c

SHA1
50770954c1ceb0bb6f1d5d3f2de2a0a065773723

SHA256
e56a7e5d3ab9675555e2897fc3faa2dd9265008a4967a7d54030ab8184d2d38f

SHA512
ca504af192e3318359d4742a2ef26ae1b5d040a4f9942782e02549a310158d5d5dbf919b4c748c31ee609d2046bd23ee0c22712891c86ae4a1e3a58c6e67647e

Download Submit
memory/1676-125-0x0000000006940000-0x0000000006941000-memory.dmp

Filesize
4KB

Download
memory/1676-126-0x00000000053F0000-0x00000000058EE000-memory.dmp

Filesize
5.0MB

Download
memory/1676-121-0x0000000005740000-0x0000000005741000-memory.dmp

Filesize
4KB

Download
memory/1676-122-0x00000000053F0000-0x00000000058EE000-memory.dmp

Filesize
5.0MB

Download
memory/1676-123-0x00000000057E0000-0x0000000005801000-memory.dmp

Filesize
132KB

Download
memory/1676-124-0x0000000006980000-0x0000000006981000-memory.dmp

Filesize
4KB

Download
memory/1676-116-0x0000000000800000-0x0000000000801000-memory.dmp

Filesize
4KB

Download
memory/1676-120-0x00000000053F0000-0x00000000053F1000-memory.dmp

Filesize
4KB

Download
memory/1676-127-0x00000000072D0000-0x00000000072DB000-memory.dmp

Filesize
44KB

Download
memory/1676-128-0x00000000098B0000-0x00000000098B1000-memory.dmp

Filesize
4KB

Download
memory/1676-118-0x00000000058F0000-0x00000000058F1000-memory.dmp

Filesize
4KB

Download
memory/1676-119-0x00000000052D0000-0x00000000052D1000-memory.dmp

Filesize
4KB

Download
memory/2868-130-0x000000000040C7CE-mapping.dmp

Download
memory/2868-129-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2868-135-0x0000000004FD0000-0x0000000004FD1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads