asyncrat | 5d355666219db06acc93d01c0973c0c0a5db514b5af2c43dd7d97075d7b78914

General

Target
61c1c1ea4c4ffb7fa6c1c707c8d41c61.exe
Size 65KB
Sample211129-fe5jwaeef5
SHA256 5d355666219db06acc93d01c0973c0c0a5db514b5af2c43dd7d97075d7b78914
MD5 61c1c1ea4c4ffb7fa6c1c707c8d41c61
SHA1 0fe8956f681aac08e2138c015d75ed8e99e6e05f
SHA512 3e554bb5158554d81f7a9c82b05f6b858453d3e58d6666d0d9ecb61faecb96d02e60640e40ee63a8f06b492d63a880f584ab7b2105d7b4d861f63ee008a9ea88
MD5 SHA1 SHA512

Score

10^/10

asyncrat eliza rat

Malware Config

Extracted

Family

asyncrat

Version

VenomRAT_HVNC 5.0.4

Botnet

Eliza

C2

74.119.195.9:4821

Mutex

ElizaVenom

Attributes

anti_vm
false
bsod
false
delay
6
install
true
install_file
msvc.exe
install_folder
%AppData%
pastebin_config
null

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
rat asyncrat

Async RAT payload 2 IoCs

rat

resource	yara_rule
behavioral1/files/0x0007000000012208-64.dat	asyncrat
behavioral1/files/0x0007000000012208-65.dat	asyncrat

Executes dropped EXE 1 IoCs

pid	Process
828	msvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1796	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
1772	timeout.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
692	61c1c1ea4c4ffb7fa6c1c707c8d41c61.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	692	61c1c1ea4c4ffb7fa6c1c707c8d41c61.exe
Token: SeDebugPrivilege	828	msvc.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 692 wrote to memory of 1524	692	61c1c1ea4c4ffb7fa6c1c707c8d41c61.exe	28
PID 692 wrote to memory of 1524	692	61c1c1ea4c4ffb7fa6c1c707c8d41c61.exe	28
PID 692 wrote to memory of 1524	692	61c1c1ea4c4ffb7fa6c1c707c8d41c61.exe	28
PID 692 wrote to memory of 1932	692	61c1c1ea4c4ffb7fa6c1c707c8d41c61.exe	30
PID 692 wrote to memory of 1932	692	61c1c1ea4c4ffb7fa6c1c707c8d41c61.exe	30
PID 692 wrote to memory of 1932	692	61c1c1ea4c4ffb7fa6c1c707c8d41c61.exe	30
PID 1524 wrote to memory of 1796	1524	cmd.exe	32
PID 1524 wrote to memory of 1796	1524	cmd.exe	32
PID 1524 wrote to memory of 1796	1524	cmd.exe	32
PID 1932 wrote to memory of 1772	1932	cmd.exe	33
PID 1932 wrote to memory of 1772	1932	cmd.exe	33
PID 1932 wrote to memory of 1772	1932	cmd.exe	33
PID 1932 wrote to memory of 828	1932	cmd.exe	34
PID 1932 wrote to memory of 828	1932	cmd.exe	34
PID 1932 wrote to memory of 828	1932	cmd.exe	34

C:\Users\Admin\AppData\Local\Temp\61c1c1ea4c4ffb7fa6c1c707c8d41c61.exe
"C:\Users\Admin\AppData\Local\Temp\61c1c1ea4c4ffb7fa6c1c707c8d41c61.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:692
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "msvc" /tr '"C:\Users\Admin\AppData\Roaming\msvc.exe"' & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1524
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc onlogon /rl highest /tn "msvc" /tr '"C:\Users\Admin\AppData\Roaming\msvc.exe"'
    3⤵
    - Creates scheduled task(s)
    PID:1796
- C:\Windows\system32\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpE051.tmp.bat""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1932
- - C:\Windows\system32\timeout.exe
    timeout 3
    3⤵
    - Delays execution with timeout.exe
    PID:1772
- - C:\Users\Admin\AppData\Roaming\msvc.exe
    "C:\Users\Admin\AppData\Roaming\msvc.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:828

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/692-55-0x0000000000B30000-0x0000000000B31000-memory.dmp

Download

memory/692-57-0x00000000002B0000-0x00000000002B2000-memory.dmp

Download

memory/828-66-0x0000000001170000-0x0000000001171000-memory.dmp

Download

memory/828-68-0x000000001ADE0000-0x000000001ADE2000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads