asyncrat | 1418386128ff3aea3604cf4295bfa49c56ed30b6a2b47112cd742a74448101eb

General

Target

1418386128ff3aea3604cf4295bfa49c56ed30b6a2b47112cd742a74448101eb.exe
Size

676KB
MD5

57b64705c9b52be9842eb45e2721a0d5
SHA1

0bea50c1a2205f7bbb8419fb970beb936866e9aa
SHA256

1418386128ff3aea3604cf4295bfa49c56ed30b6a2b47112cd742a74448101eb
SHA512

28d8f1edb21458ea2e072033f24c409e2f767d14934278d80a50551e946826d50e6cafb6ac2a4e76510f1580692b1cdd3d6acf9d4b701d7c3954b79ec89a10a5

Score

10^/10

asyncrat 3 persistence rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

3

C2

217.64.149.93:1973

Mutex

df4Rtg34dFt5ynrew

Attributes

anti_vm
false
bsod
false
delay
3
install
false
install_folder
%AppData%
pastebin_config
null

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
rat asyncrat

Async RAT payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/3460-129-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat
behavioral1/memory/3460-130-0x000000000040C6BE-mapping.dmp	asyncrat

Executes dropped EXE 3 IoCs

Processes:

RegAsm.exeRegAsm.exeRegAsm.exe

pid process

1564 RegAsm.exe
1016 RegAsm.exe
3460 RegAsm.exe

pid	process
1564	RegAsm.exe
1016	RegAsm.exe
3460	RegAsm.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

1418386128ff3aea3604cf4295bfa49c56ed30b6a2b47112cd742a74448101eb.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Windows\CurrentVersion\Run\ght = "\"C:\\Users\\Admin\\AppData\\Roaming\\ght.exe\""	1418386128ff3aea3604cf4295bfa49c56ed30b6a2b47112cd742a74448101eb.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

1418386128ff3aea3604cf4295bfa49c56ed30b6a2b47112cd742a74448101eb.exe

description	pid	process	target process
PID 1288 set thread context of 3460	1288	1418386128ff3aea3604cf4295bfa49c56ed30b6a2b47112cd742a74448101eb.exe	RegAsm.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

1418386128ff3aea3604cf4295bfa49c56ed30b6a2b47112cd742a74448101eb.exe

pid	process
1288	1418386128ff3aea3604cf4295bfa49c56ed30b6a2b47112cd742a74448101eb.exe
1288	1418386128ff3aea3604cf4295bfa49c56ed30b6a2b47112cd742a74448101eb.exe
1288	1418386128ff3aea3604cf4295bfa49c56ed30b6a2b47112cd742a74448101eb.exe
1288	1418386128ff3aea3604cf4295bfa49c56ed30b6a2b47112cd742a74448101eb.exe
1288	1418386128ff3aea3604cf4295bfa49c56ed30b6a2b47112cd742a74448101eb.exe
1288	1418386128ff3aea3604cf4295bfa49c56ed30b6a2b47112cd742a74448101eb.exe
1288	1418386128ff3aea3604cf4295bfa49c56ed30b6a2b47112cd742a74448101eb.exe
1288	1418386128ff3aea3604cf4295bfa49c56ed30b6a2b47112cd742a74448101eb.exe
1288	1418386128ff3aea3604cf4295bfa49c56ed30b6a2b47112cd742a74448101eb.exe
1288	1418386128ff3aea3604cf4295bfa49c56ed30b6a2b47112cd742a74448101eb.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

1418386128ff3aea3604cf4295bfa49c56ed30b6a2b47112cd742a74448101eb.exeRegAsm.exe

description	pid	process
Token: SeDebugPrivilege	1288	1418386128ff3aea3604cf4295bfa49c56ed30b6a2b47112cd742a74448101eb.exe
Token: SeDebugPrivilege	3460	RegAsm.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

1418386128ff3aea3604cf4295bfa49c56ed30b6a2b47112cd742a74448101eb.exe

description	pid	process	target process
PID 1288 wrote to memory of 1564	1288	1418386128ff3aea3604cf4295bfa49c56ed30b6a2b47112cd742a74448101eb.exe	RegAsm.exe
PID 1288 wrote to memory of 1564	1288	1418386128ff3aea3604cf4295bfa49c56ed30b6a2b47112cd742a74448101eb.exe	RegAsm.exe
PID 1288 wrote to memory of 1564	1288	1418386128ff3aea3604cf4295bfa49c56ed30b6a2b47112cd742a74448101eb.exe	RegAsm.exe
PID 1288 wrote to memory of 1016	1288	1418386128ff3aea3604cf4295bfa49c56ed30b6a2b47112cd742a74448101eb.exe	RegAsm.exe
PID 1288 wrote to memory of 1016	1288	1418386128ff3aea3604cf4295bfa49c56ed30b6a2b47112cd742a74448101eb.exe	RegAsm.exe
PID 1288 wrote to memory of 1016	1288	1418386128ff3aea3604cf4295bfa49c56ed30b6a2b47112cd742a74448101eb.exe	RegAsm.exe
PID 1288 wrote to memory of 3460	1288	1418386128ff3aea3604cf4295bfa49c56ed30b6a2b47112cd742a74448101eb.exe	RegAsm.exe
PID 1288 wrote to memory of 3460	1288	1418386128ff3aea3604cf4295bfa49c56ed30b6a2b47112cd742a74448101eb.exe	RegAsm.exe
PID 1288 wrote to memory of 3460	1288	1418386128ff3aea3604cf4295bfa49c56ed30b6a2b47112cd742a74448101eb.exe	RegAsm.exe
PID 1288 wrote to memory of 3460	1288	1418386128ff3aea3604cf4295bfa49c56ed30b6a2b47112cd742a74448101eb.exe	RegAsm.exe
PID 1288 wrote to memory of 3460	1288	1418386128ff3aea3604cf4295bfa49c56ed30b6a2b47112cd742a74448101eb.exe	RegAsm.exe
PID 1288 wrote to memory of 3460	1288	1418386128ff3aea3604cf4295bfa49c56ed30b6a2b47112cd742a74448101eb.exe	RegAsm.exe
PID 1288 wrote to memory of 3460	1288	1418386128ff3aea3604cf4295bfa49c56ed30b6a2b47112cd742a74448101eb.exe	RegAsm.exe
PID 1288 wrote to memory of 3460	1288	1418386128ff3aea3604cf4295bfa49c56ed30b6a2b47112cd742a74448101eb.exe	RegAsm.exe

C:\Users\Admin\AppData\Local\Temp\1418386128ff3aea3604cf4295bfa49c56ed30b6a2b47112cd742a74448101eb.exe
"C:\Users\Admin\AppData\Local\Temp\1418386128ff3aea3604cf4295bfa49c56ed30b6a2b47112cd742a74448101eb.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1288

C:\Users\Admin\AppData\Local\Temp\RegAsm.exe
C:\Users\Admin\AppData\Local\Temp\RegAsm.exe
2⤵
- Executes dropped EXE
PID:1564

C:\Users\Admin\AppData\Local\Temp\RegAsm.exe
C:\Users\Admin\AppData\Local\Temp\RegAsm.exe
2⤵
- Executes dropped EXE
PID:1016

C:\Users\Admin\AppData\Local\Temp\RegAsm.exe
C:\Users\Admin\AppData\Local\Temp\RegAsm.exe
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3460

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RegAsm.exe
MD5
b58b926c3574d28d5b7fdd2ca3ec30d5

SHA1
d260c4ffd603a9cfc057fcb83d678b1cecdf86f9

SHA256
6e70b56d748c4ccab13cc8a055d3795ea0dd95fe3b70568d7d3ac0c6621140a3

SHA512
b13cb998822b716b695013bcd6dec62a2290567d0d1743b2d982ca084235cf69c6ea1fc91c9d4e62657c6f9e102c7c60e81296ab055ffe43b887c5f8ec8958ab

Download Submit
C:\Users\Admin\AppData\Local\Temp\RegAsm.exe
MD5
b58b926c3574d28d5b7fdd2ca3ec30d5

SHA1
d260c4ffd603a9cfc057fcb83d678b1cecdf86f9

SHA256
6e70b56d748c4ccab13cc8a055d3795ea0dd95fe3b70568d7d3ac0c6621140a3

SHA512
b13cb998822b716b695013bcd6dec62a2290567d0d1743b2d982ca084235cf69c6ea1fc91c9d4e62657c6f9e102c7c60e81296ab055ffe43b887c5f8ec8958ab

Download Submit
C:\Users\Admin\AppData\Local\Temp\RegAsm.exe
MD5
b58b926c3574d28d5b7fdd2ca3ec30d5

SHA1
d260c4ffd603a9cfc057fcb83d678b1cecdf86f9

SHA256
6e70b56d748c4ccab13cc8a055d3795ea0dd95fe3b70568d7d3ac0c6621140a3

SHA512
b13cb998822b716b695013bcd6dec62a2290567d0d1743b2d982ca084235cf69c6ea1fc91c9d4e62657c6f9e102c7c60e81296ab055ffe43b887c5f8ec8958ab

Download Submit
C:\Users\Admin\AppData\Local\Temp\RegAsm.exe
MD5
b58b926c3574d28d5b7fdd2ca3ec30d5

SHA1
d260c4ffd603a9cfc057fcb83d678b1cecdf86f9

SHA256
6e70b56d748c4ccab13cc8a055d3795ea0dd95fe3b70568d7d3ac0c6621140a3

SHA512
b13cb998822b716b695013bcd6dec62a2290567d0d1743b2d982ca084235cf69c6ea1fc91c9d4e62657c6f9e102c7c60e81296ab055ffe43b887c5f8ec8958ab

Download Submit
memory/1288-120-0x0000000005BF0000-0x0000000005BF1000-memory.dmp

Filesize
4KB

Download
memory/1288-124-0x00000000070F0000-0x000000000715C000-memory.dmp

Filesize
432KB

Download
memory/1288-125-0x00000000071D0000-0x00000000071D1000-memory.dmp

Filesize
4KB

Download
memory/1288-126-0x00000000071B0000-0x00000000071C4000-memory.dmp

Filesize
80KB

Download
memory/1288-121-0x00000000055D0000-0x00000000055D1000-memory.dmp

Filesize
4KB

Download
memory/1288-122-0x00000000055A0000-0x00000000055A1000-memory.dmp

Filesize
4KB

Download
memory/1288-118-0x0000000000CD0000-0x0000000000CD1000-memory.dmp

Filesize
4KB

Download
memory/1288-123-0x0000000005690000-0x0000000005691000-memory.dmp

Filesize
4KB

Download
memory/3460-129-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/3460-130-0x000000000040C6BE-mapping.dmp

Download
memory/3460-135-0x0000000005030000-0x0000000005031000-memory.dmp

Filesize
4KB

Download
memory/3460-136-0x0000000005810000-0x0000000005811000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads