asyncrat | 5b476b935cae4bf02299f7dee135b0bb091fd7716b2973d7172e04f4f2985d72

Analysis

max time kernel
122s
max time network
148s
platform
windows7_x64
resource
win7-en-20211208
submitted
22/01/2022, 07:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
IMG_212022100120011.exe
Size 69KB
Sample220122-jm5fmaachj
SHA256 5b476b935cae4bf02299f7dee135b0bb091fd7716b2973d7172e04f4f2985d72
MD5 cecfdefc8f201d03066386a9a6b011f0
SHA1 fd451496139859f387cfef71404d50d042297ca0
SHA512 aed76f8f33573fc1b62fd9e194e797fbccb7209e526ef6dc980882c6b889db6b6742e88d8fad0e0e29bc4620b7ae857be02cab380439cb231748c1fbc3d2fd8b
MD5 SHA1 SHA512

Score

10^/10

asyncrat persistence rat

Malware Config

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
rat asyncrat

Async RAT payload 4 IoCs

rat

resource	yara_rule
behavioral1/memory/1008-63-0x0000000000400000-0x000000000041A000-memory.dmp	asyncrat
behavioral1/memory/1008-64-0x0000000000400000-0x000000000041A000-memory.dmp	asyncrat
behavioral1/memory/1008-65-0x0000000000400000-0x000000000041A000-memory.dmp	asyncrat
behavioral1/memory/1008-66-0x0000000000400000-0x000000000041A000-memory.dmp	asyncrat

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Windows\CurrentVersion\Run\Mword = "\"C:\\Users\\Admin\\AppData\\Roaming\\Word\\Mword.exe\""	IMG_212022100120011.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 956 set thread context of 1008	956	IMG_212022100120011.exe	65

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Runs ping.exe 1 TTPs 12 IoCs

Remote System Discovery

T1018

pid	Process
1252	PING.EXE
640	PING.EXE
1900	PING.EXE
1692	PING.EXE
1012	PING.EXE
1552	PING.EXE
1608	PING.EXE
1264	PING.EXE
416	PING.EXE
2036	PING.EXE
1500	PING.EXE
1944	PING.EXE

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
956	IMG_212022100120011.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	956	IMG_212022100120011.exe
Token: SeDebugPrivilege	1008	IMG_212022100120011.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 956 wrote to memory of 532	956	IMG_212022100120011.exe	27
PID 956 wrote to memory of 532	956	IMG_212022100120011.exe	27
PID 956 wrote to memory of 532	956	IMG_212022100120011.exe	27
PID 956 wrote to memory of 532	956	IMG_212022100120011.exe	27
PID 532 wrote to memory of 640	532	cmd.exe	29
PID 532 wrote to memory of 640	532	cmd.exe	29
PID 532 wrote to memory of 640	532	cmd.exe	29
PID 532 wrote to memory of 640	532	cmd.exe	29
PID 956 wrote to memory of 1684	956	IMG_212022100120011.exe	30
PID 956 wrote to memory of 1684	956	IMG_212022100120011.exe	30
PID 956 wrote to memory of 1684	956	IMG_212022100120011.exe	30
PID 956 wrote to memory of 1684	956	IMG_212022100120011.exe	30
PID 1684 wrote to memory of 416	1684	cmd.exe	32
PID 1684 wrote to memory of 416	1684	cmd.exe	32
PID 1684 wrote to memory of 416	1684	cmd.exe	32
PID 1684 wrote to memory of 416	1684	cmd.exe	32
PID 956 wrote to memory of 1632	956	IMG_212022100120011.exe	33
PID 956 wrote to memory of 1632	956	IMG_212022100120011.exe	33
PID 956 wrote to memory of 1632	956	IMG_212022100120011.exe	33
PID 956 wrote to memory of 1632	956	IMG_212022100120011.exe	33
PID 1632 wrote to memory of 2036	1632	cmd.exe	35
PID 1632 wrote to memory of 2036	1632	cmd.exe	35
PID 1632 wrote to memory of 2036	1632	cmd.exe	35
PID 1632 wrote to memory of 2036	1632	cmd.exe	35
PID 956 wrote to memory of 1460	956	IMG_212022100120011.exe	36
PID 956 wrote to memory of 1460	956	IMG_212022100120011.exe	36
PID 956 wrote to memory of 1460	956	IMG_212022100120011.exe	36
PID 956 wrote to memory of 1460	956	IMG_212022100120011.exe	36
PID 1460 wrote to memory of 1500	1460	cmd.exe	38
PID 1460 wrote to memory of 1500	1460	cmd.exe	38
PID 1460 wrote to memory of 1500	1460	cmd.exe	38
PID 1460 wrote to memory of 1500	1460	cmd.exe	38
PID 956 wrote to memory of 1604	956	IMG_212022100120011.exe	39
PID 956 wrote to memory of 1604	956	IMG_212022100120011.exe	39
PID 956 wrote to memory of 1604	956	IMG_212022100120011.exe	39
PID 956 wrote to memory of 1604	956	IMG_212022100120011.exe	39
PID 1604 wrote to memory of 1900	1604	cmd.exe	41
PID 1604 wrote to memory of 1900	1604	cmd.exe	41
PID 1604 wrote to memory of 1900	1604	cmd.exe	41
PID 1604 wrote to memory of 1900	1604	cmd.exe	41
PID 956 wrote to memory of 1732	956	IMG_212022100120011.exe	42
PID 956 wrote to memory of 1732	956	IMG_212022100120011.exe	42
PID 956 wrote to memory of 1732	956	IMG_212022100120011.exe	42
PID 956 wrote to memory of 1732	956	IMG_212022100120011.exe	42
PID 1732 wrote to memory of 1944	1732	cmd.exe	44
PID 1732 wrote to memory of 1944	1732	cmd.exe	44
PID 1732 wrote to memory of 1944	1732	cmd.exe	44
PID 1732 wrote to memory of 1944	1732	cmd.exe	44
PID 956 wrote to memory of 1408	956	IMG_212022100120011.exe	45
PID 956 wrote to memory of 1408	956	IMG_212022100120011.exe	45
PID 956 wrote to memory of 1408	956	IMG_212022100120011.exe	45
PID 956 wrote to memory of 1408	956	IMG_212022100120011.exe	45
PID 1408 wrote to memory of 1692	1408	cmd.exe	47
PID 1408 wrote to memory of 1692	1408	cmd.exe	47
PID 1408 wrote to memory of 1692	1408	cmd.exe	47
PID 1408 wrote to memory of 1692	1408	cmd.exe	47
PID 956 wrote to memory of 1680	956	IMG_212022100120011.exe	48
PID 956 wrote to memory of 1680	956	IMG_212022100120011.exe	48
PID 956 wrote to memory of 1680	956	IMG_212022100120011.exe	48
PID 956 wrote to memory of 1680	956	IMG_212022100120011.exe	48
PID 1680 wrote to memory of 1552	1680	cmd.exe	50
PID 1680 wrote to memory of 1552	1680	cmd.exe	50
PID 1680 wrote to memory of 1552	1680	cmd.exe	50
PID 1680 wrote to memory of 1552	1680	cmd.exe	50

C:\Users\Admin\AppData\Local\Temp\IMG_212022100120011.exe
"C:\Users\Admin\AppData\Local\Temp\IMG_212022100120011.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:956
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C ping google.com
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:532
- - C:\Windows\SysWOW64\PING.EXE
    ping google.com
    3⤵
    - Runs ping.exe
    PID:640
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C ping facebook.com
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1684
- - C:\Windows\SysWOW64\PING.EXE
    ping facebook.com
    3⤵
    - Runs ping.exe
    PID:416
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C ping twitter.com
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1632
- - C:\Windows\SysWOW64\PING.EXE
    ping twitter.com
    3⤵
    - Runs ping.exe
    PID:2036
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C ping google.com
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1460
- - C:\Windows\SysWOW64\PING.EXE
    ping google.com
    3⤵
    - Runs ping.exe
    PID:1500
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C ping facebook.com
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1604
- - C:\Windows\SysWOW64\PING.EXE
    ping facebook.com
    3⤵
    - Runs ping.exe
    PID:1900
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C ping twitter.com
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1732
- - C:\Windows\SysWOW64\PING.EXE
    ping twitter.com
    3⤵
    - Runs ping.exe
    PID:1944
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C ping google.com
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1408
- - C:\Windows\SysWOW64\PING.EXE
    ping google.com
    3⤵
    - Runs ping.exe
    PID:1692
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C ping facebook.com
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1680
- - C:\Windows\SysWOW64\PING.EXE
    ping facebook.com
    3⤵
    - Runs ping.exe
    PID:1552
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C ping twitter.com
  2⤵
  PID:1592
- - C:\Windows\SysWOW64\PING.EXE
    ping twitter.com
    3⤵
    - Runs ping.exe
    PID:1608
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C ping google.com
  2⤵
  PID:1348
- - C:\Windows\SysWOW64\PING.EXE
    ping google.com
    3⤵
    - Runs ping.exe
    PID:1012
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C ping facebook.com
  2⤵
  PID:416
- - C:\Windows\SysWOW64\PING.EXE
    ping facebook.com
    3⤵
    - Runs ping.exe
    PID:1252
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C ping twitter.com
  2⤵
  PID:896
- - C:\Windows\SysWOW64\PING.EXE
    ping twitter.com
    3⤵
    - Runs ping.exe
    PID:1264
- C:\Users\Admin\AppData\Local\Temp\IMG_212022100120011.exe
  C:\Users\Admin\AppData\Local\Temp\IMG_212022100120011.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1008

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/956-56-0x00000000763B1000-0x00000000763B3000-memory.dmp

Download

memory/956-57-0x0000000004B10000-0x0000000004D10000-memory.dmp

Download

memory/956-58-0x00000000047B0000-0x00000000047FC000-memory.dmp

Download

memory/956-59-0x0000000000680000-0x00000000006B4000-memory.dmp

Download

memory/956-60-0x0000000004A70000-0x0000000004ABC000-memory.dmp

Download

memory/956-55-0x0000000000040000-0x0000000000056000-memory.dmp

Download

memory/1008-61-0x0000000000400000-0x000000000041A000-memory.dmp

Download

memory/1008-63-0x0000000000400000-0x000000000041A000-memory.dmp

Download

memory/1008-64-0x0000000000400000-0x000000000041A000-memory.dmp

Download

memory/1008-65-0x0000000000400000-0x000000000041A000-memory.dmp

Download

memory/1008-66-0x0000000000400000-0x000000000041A000-memory.dmp

Download

memory/1008-68-0x0000000004960000-0x0000000004961000-memory.dmp

Download

memory/1008-62-0x0000000000400000-0x000000000041A000-memory.dmp

Download

memory/1008-70-0x00000000003F0000-0x00000000003FA000-memory.dmp

Download