asyncrat | 53173bd6c646d3f4a8404d0f508caa27fb4ab7a3c2df3e4fe3912bfaa94093c3

Analysis

max time kernel
132s
max time network
149s
platform
windows10_x64
resource
win10-en-20211208
submitted
06/01/2022, 21:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Wire Transfer - Swift Payment Copy.pif.exe
Size 936KB
Sample220106-z5mljacaem
SHA256 53173bd6c646d3f4a8404d0f508caa27fb4ab7a3c2df3e4fe3912bfaa94093c3
MD5 f730ac636236d03762347a19db5be2f3
SHA1 21942c01ec47e2029264742f5c50cd7a906beac9
SHA512 5413b413ef142f55f3f23002c7afa2dbb71beb0fe603b6c483971f9abacd832191e6fce687cf9ff4bf8528755b01238d5728115da281836fe4a4dd8753a615aa
MD5 SHA1 SHA512

Score

10^/10

asyncrat default rat suricata

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

Default

mateking3888.linkpc.net:5849

Mutex

AsyncMutex_6SI8OkPnk

Attributes

anti_vm
false
bsod
false
delay
3
install
true
install_file
basic.exe
install_folder
%AppData%
pastebin_config
null

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
rat asyncrat
suricata: ET MALWARE Observed Malicious SSL Cert (AsyncRAT Server)
suricata: ET MALWARE Observed Malicious SSL Cert (AsyncRAT Server)
suricata

Async RAT payload 7 IoCs

rat

resource	yara_rule
behavioral2/memory/1236-133-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat
behavioral2/memory/1236-134-0x000000000040C74E-mapping.dmp	asyncrat
behavioral2/memory/1236-135-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat
behavioral2/memory/1236-136-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat
behavioral2/memory/3892-413-0x000000000040C74E-mapping.dmp	asyncrat
behavioral2/memory/3892-416-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat
behavioral2/memory/3892-417-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat

Executes dropped EXE 2 IoCs

pid	Process
1592	basic.exe
3892	basic.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2692 set thread context of 1236	2692	Wire Transfer - Swift Payment Copy.pif.exe	72
PID 1592 set thread context of 3892	1592	basic.exe	86

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
3312	schtasks.exe
992	schtasks.exe
2672	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
2120	timeout.exe

Suspicious behavior: EnumeratesProcesses 23 IoCs

pid	Process
2692	Wire Transfer - Swift Payment Copy.pif.exe
2692	Wire Transfer - Swift Payment Copy.pif.exe
812	powershell.exe
812	powershell.exe
812	powershell.exe
1236	Wire Transfer - Swift Payment Copy.pif.exe
1236	Wire Transfer - Swift Payment Copy.pif.exe
1236	Wire Transfer - Swift Payment Copy.pif.exe
1236	Wire Transfer - Swift Payment Copy.pif.exe
1236	Wire Transfer - Swift Payment Copy.pif.exe
1236	Wire Transfer - Swift Payment Copy.pif.exe
1236	Wire Transfer - Swift Payment Copy.pif.exe
1236	Wire Transfer - Swift Payment Copy.pif.exe
1236	Wire Transfer - Swift Payment Copy.pif.exe
1236	Wire Transfer - Swift Payment Copy.pif.exe
1236	Wire Transfer - Swift Payment Copy.pif.exe
1236	Wire Transfer - Swift Payment Copy.pif.exe
1236	Wire Transfer - Swift Payment Copy.pif.exe
1592	basic.exe
1592	basic.exe
2300	powershell.exe
2300	powershell.exe
2300	powershell.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	2692	Wire Transfer - Swift Payment Copy.pif.exe
Token: SeDebugPrivilege	812	powershell.exe
Token: SeDebugPrivilege	1236	Wire Transfer - Swift Payment Copy.pif.exe
Token: SeDebugPrivilege	1592	basic.exe
Token: SeDebugPrivilege	2300	powershell.exe
Token: SeDebugPrivilege	3892	basic.exe

Suspicious use of WriteProcessMemory 43 IoCs

description	pid	Process	procid_target
PID 2692 wrote to memory of 812	2692	Wire Transfer - Swift Payment Copy.pif.exe	68
PID 2692 wrote to memory of 812	2692	Wire Transfer - Swift Payment Copy.pif.exe	68
PID 2692 wrote to memory of 812	2692	Wire Transfer - Swift Payment Copy.pif.exe	68
PID 2692 wrote to memory of 3312	2692	Wire Transfer - Swift Payment Copy.pif.exe	70
PID 2692 wrote to memory of 3312	2692	Wire Transfer - Swift Payment Copy.pif.exe	70
PID 2692 wrote to memory of 3312	2692	Wire Transfer - Swift Payment Copy.pif.exe	70
PID 2692 wrote to memory of 1236	2692	Wire Transfer - Swift Payment Copy.pif.exe	72
PID 2692 wrote to memory of 1236	2692	Wire Transfer - Swift Payment Copy.pif.exe	72
PID 2692 wrote to memory of 1236	2692	Wire Transfer - Swift Payment Copy.pif.exe	72
PID 2692 wrote to memory of 1236	2692	Wire Transfer - Swift Payment Copy.pif.exe	72
PID 2692 wrote to memory of 1236	2692	Wire Transfer - Swift Payment Copy.pif.exe	72
PID 2692 wrote to memory of 1236	2692	Wire Transfer - Swift Payment Copy.pif.exe	72
PID 2692 wrote to memory of 1236	2692	Wire Transfer - Swift Payment Copy.pif.exe	72
PID 2692 wrote to memory of 1236	2692	Wire Transfer - Swift Payment Copy.pif.exe	72
PID 1236 wrote to memory of 3008	1236	Wire Transfer - Swift Payment Copy.pif.exe	73
PID 1236 wrote to memory of 3008	1236	Wire Transfer - Swift Payment Copy.pif.exe	73
PID 1236 wrote to memory of 3008	1236	Wire Transfer - Swift Payment Copy.pif.exe	73
PID 1236 wrote to memory of 2784	1236	Wire Transfer - Swift Payment Copy.pif.exe	75
PID 1236 wrote to memory of 2784	1236	Wire Transfer - Swift Payment Copy.pif.exe	75
PID 1236 wrote to memory of 2784	1236	Wire Transfer - Swift Payment Copy.pif.exe	75
PID 3008 wrote to memory of 992	3008	cmd.exe	77
PID 3008 wrote to memory of 992	3008	cmd.exe	77
PID 3008 wrote to memory of 992	3008	cmd.exe	77
PID 2784 wrote to memory of 2120	2784	cmd.exe	78
PID 2784 wrote to memory of 2120	2784	cmd.exe	78
PID 2784 wrote to memory of 2120	2784	cmd.exe	78
PID 2784 wrote to memory of 1592	2784	cmd.exe	79
PID 2784 wrote to memory of 1592	2784	cmd.exe	79
PID 2784 wrote to memory of 1592	2784	cmd.exe	79
PID 1592 wrote to memory of 2300	1592	basic.exe	82
PID 1592 wrote to memory of 2300	1592	basic.exe	82
PID 1592 wrote to memory of 2300	1592	basic.exe	82
PID 1592 wrote to memory of 2672	1592	basic.exe	84
PID 1592 wrote to memory of 2672	1592	basic.exe	84
PID 1592 wrote to memory of 2672	1592	basic.exe	84
PID 1592 wrote to memory of 3892	1592	basic.exe	86
PID 1592 wrote to memory of 3892	1592	basic.exe	86
PID 1592 wrote to memory of 3892	1592	basic.exe	86
PID 1592 wrote to memory of 3892	1592	basic.exe	86
PID 1592 wrote to memory of 3892	1592	basic.exe	86
PID 1592 wrote to memory of 3892	1592	basic.exe	86
PID 1592 wrote to memory of 3892	1592	basic.exe	86
PID 1592 wrote to memory of 3892	1592	basic.exe	86

C:\Users\Admin\AppData\Local\Temp\Wire Transfer - Swift Payment Copy.pif.exe
"C:\Users\Admin\AppData\Local\Temp\Wire Transfer - Swift Payment Copy.pif.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2692
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\lwiDJbaJaBVdq.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:812
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\lwiDJbaJaBVdq" /XML "C:\Users\Admin\AppData\Local\Temp\tmp6A20.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:3312
- C:\Users\Admin\AppData\Local\Temp\Wire Transfer - Swift Payment Copy.pif.exe
  "C:\Users\Admin\AppData\Local\Temp\Wire Transfer - Swift Payment Copy.pif.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1236
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "basic" /tr '"C:\Users\Admin\AppData\Roaming\basic.exe"' & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3008
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /f /sc onlogon /rl highest /tn "basic" /tr '"C:\Users\Admin\AppData\Roaming\basic.exe"'
      4⤵
      Creates scheduled task(s)
      PID:992
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp7EA2.tmp.bat""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2784
  - - C:\Windows\SysWOW64\timeout.exe
      timeout 3
      4⤵
      Delays execution with timeout.exe
      PID:2120
  - - C:\Users\Admin\AppData\Roaming\basic.exe
      "C:\Users\Admin\AppData\Roaming\basic.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1592
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\lwiDJbaJaBVdq.exe"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2300
    - - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\lwiDJbaJaBVdq" /XML "C:\Users\Admin\AppData\Local\Temp\tmp1227.tmp"
        5⤵
        Creates scheduled task(s)
        
        PID:2672
    - - C:\Users\Admin\AppData\Roaming\basic.exe
        
        "C:\Users\Admin\AppData\Roaming\basic.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3892

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/812-145-0x0000000002940000-0x0000000002941000-memory.dmp

Download

memory/812-142-0x0000000007900000-0x000000000791C000-memory.dmp

Download

memory/812-127-0x0000000002940000-0x0000000002941000-memory.dmp

Download

memory/812-128-0x0000000002940000-0x0000000002941000-memory.dmp

Download

memory/812-130-0x00000000065B0000-0x00000000065E6000-memory.dmp

Download

memory/812-132-0x00000000065A2000-0x00000000065A3000-memory.dmp

Download

memory/812-131-0x00000000065A0000-0x00000000065A1000-memory.dmp

Download

memory/812-370-0x0000000009010000-0x000000000902A000-memory.dmp

Download

memory/812-376-0x0000000008FF0000-0x0000000008FF8000-memory.dmp

Download

memory/812-168-0x0000000009110000-0x00000000091A4000-memory.dmp

Download

memory/812-381-0x0000000008FF0000-0x0000000008FF8000-memory.dmp

Download

memory/812-137-0x0000000006C20000-0x0000000007248000-memory.dmp

Download

memory/812-138-0x0000000007290000-0x00000000072B2000-memory.dmp

Download

memory/812-139-0x0000000007330000-0x0000000007396000-memory.dmp

Download

memory/812-140-0x0000000007410000-0x0000000007476000-memory.dmp

Download

memory/812-141-0x00000000075B0000-0x0000000007900000-memory.dmp

Download

memory/812-375-0x0000000009010000-0x000000000902A000-memory.dmp

Download

memory/812-143-0x0000000007A40000-0x0000000007A8B000-memory.dmp

Download

memory/812-144-0x0000000007D40000-0x0000000007DB6000-memory.dmp

Download

memory/812-175-0x00000000065A3000-0x00000000065A4000-memory.dmp

Download

memory/812-153-0x0000000006C20000-0x0000000007248000-memory.dmp

Download

memory/812-154-0x0000000008DC0000-0x0000000008DF3000-memory.dmp

Download

memory/812-155-0x0000000008DC0000-0x0000000008DF3000-memory.dmp

Download

memory/812-156-0x0000000007290000-0x00000000072B2000-memory.dmp

Download

memory/812-158-0x0000000007330000-0x0000000007396000-memory.dmp

Download

memory/812-157-0x000000007EB90000-0x000000007EB91000-memory.dmp

Download

memory/812-159-0x0000000007410000-0x0000000007476000-memory.dmp

Download

memory/812-160-0x0000000007A40000-0x0000000007A8B000-memory.dmp

Download

memory/812-161-0x0000000007D40000-0x0000000007DB6000-memory.dmp

Download

memory/812-162-0x0000000008BA0000-0x0000000008BBE000-memory.dmp

Download

memory/812-167-0x0000000008F00000-0x0000000008FA5000-memory.dmp

Download

memory/1236-173-0x0000000003380000-0x0000000003381000-memory.dmp

Download

memory/1236-133-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/1236-200-0x0000000005C80000-0x0000000005D1C000-memory.dmp

Download

memory/1236-135-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/1236-136-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/1592-402-0x0000000008950000-0x000000000899B000-memory.dmp

Download

memory/1592-403-0x0000000008B90000-0x0000000008BC8000-memory.dmp

Download

memory/1592-401-0x00000000089F0000-0x0000000008A8C000-memory.dmp

Download

memory/1592-395-0x0000000000C60000-0x0000000000D52000-memory.dmp

Download

memory/1592-400-0x00000000086B0000-0x00000000086BC000-memory.dmp

Download

memory/1592-399-0x00000000055B0000-0x0000000005AAE000-memory.dmp

Download

memory/1592-398-0x0000000005590000-0x000000000559A000-memory.dmp

Download

memory/1592-397-0x00000000055B0000-0x0000000005642000-memory.dmp

Download

memory/1592-396-0x0000000005AB0000-0x0000000005FAE000-memory.dmp

Download

memory/1592-394-0x0000000000C60000-0x0000000000D52000-memory.dmp

Download

memory/2300-420-0x0000000007FD0000-0x0000000008036000-memory.dmp

Download

memory/2300-419-0x0000000007F60000-0x0000000007FC6000-memory.dmp

Download

memory/2300-421-0x0000000008040000-0x0000000008390000-memory.dmp

Download

memory/2300-423-0x0000000008430000-0x000000000844C000-memory.dmp

Download

memory/2300-424-0x00000000089A0000-0x00000000089EB000-memory.dmp

Download

memory/2300-410-0x0000000006F40000-0x0000000006F76000-memory.dmp

Download

memory/2300-425-0x0000000006FD0000-0x0000000006FD1000-memory.dmp

Download

memory/2300-426-0x0000000006FD2000-0x0000000006FD3000-memory.dmp

Download

memory/2300-418-0x0000000007DC0000-0x0000000007DE2000-memory.dmp

Download

memory/2300-411-0x0000000007610000-0x0000000007C38000-memory.dmp

Download

memory/2692-123-0x0000000008440000-0x000000000848B000-memory.dmp

Download

memory/2692-115-0x0000000000180000-0x0000000000272000-memory.dmp

Download

memory/2692-124-0x0000000008580000-0x00000000085B8000-memory.dmp

Download

memory/2692-118-0x0000000004B50000-0x0000000004BE2000-memory.dmp

Download

memory/2692-116-0x0000000000180000-0x0000000000272000-memory.dmp

Download

memory/2692-117-0x0000000005050000-0x000000000554E000-memory.dmp

Download

memory/2692-119-0x0000000004AC0000-0x0000000004ACA000-memory.dmp

Download

memory/2692-120-0x00000000024E0000-0x00000000024E1000-memory.dmp

Download

memory/2692-121-0x00000000081A0000-0x00000000081AC000-memory.dmp

Download

memory/2692-122-0x00000000084E0000-0x000000000857C000-memory.dmp

Download

memory/3892-417-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/3892-416-0x0000000000400000-0x0000000000412000-memory.dmp

Download