asyncrat | 5b476b935cae4bf02299f7dee135b0bb091fd7716b2973d7172e04f4f2985d72

Analysis

max time kernel
121s
max time network
142s
platform
windows10_x64
resource
win10-en-20211208
submitted
22/01/2022, 07:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
IMG_212022100120011.exe
Size 69KB
Sample220122-jm5fmaachj
SHA256 5b476b935cae4bf02299f7dee135b0bb091fd7716b2973d7172e04f4f2985d72
MD5 cecfdefc8f201d03066386a9a6b011f0
SHA1 fd451496139859f387cfef71404d50d042297ca0
SHA512 aed76f8f33573fc1b62fd9e194e797fbccb7209e526ef6dc980882c6b889db6b6742e88d8fad0e0e29bc4620b7ae857be02cab380439cb231748c1fbc3d2fd8b
MD5 SHA1 SHA512

Score

10^/10

asyncrat persistence rat

Malware Config

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral2/memory/3560-121-0x0000000000400000-0x000000000041A000-memory.dmp	asyncrat

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Windows\CurrentVersion\Run\Mword = "\"C:\\Users\\Admin\\AppData\\Roaming\\Word\\Mword.exe\""	IMG_212022100120011.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2672 set thread context of 3560	2672	IMG_212022100120011.exe	105

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Runs ping.exe 1 TTPs 12 IoCs

Remote System Discovery

T1018

pid	Process
1868	PING.EXE
3644	PING.EXE
352	PING.EXE
1776	PING.EXE
2544	PING.EXE
684	PING.EXE
3576	PING.EXE
2620	PING.EXE
2356	PING.EXE
644	PING.EXE
592	PING.EXE
3080	PING.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2672	IMG_212022100120011.exe
2672	IMG_212022100120011.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2672	IMG_212022100120011.exe
Token: SeDebugPrivilege	3560	IMG_212022100120011.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2672 wrote to memory of 1004	2672	IMG_212022100120011.exe	69
PID 2672 wrote to memory of 1004	2672	IMG_212022100120011.exe	69
PID 2672 wrote to memory of 1004	2672	IMG_212022100120011.exe	69
PID 1004 wrote to memory of 2620	1004	cmd.exe	71
PID 1004 wrote to memory of 2620	1004	cmd.exe	71
PID 1004 wrote to memory of 2620	1004	cmd.exe	71
PID 2672 wrote to memory of 668	2672	IMG_212022100120011.exe	72
PID 2672 wrote to memory of 668	2672	IMG_212022100120011.exe	72
PID 2672 wrote to memory of 668	2672	IMG_212022100120011.exe	72
PID 668 wrote to memory of 2356	668	cmd.exe	74
PID 668 wrote to memory of 2356	668	cmd.exe	74
PID 668 wrote to memory of 2356	668	cmd.exe	74
PID 2672 wrote to memory of 1000	2672	IMG_212022100120011.exe	75
PID 2672 wrote to memory of 1000	2672	IMG_212022100120011.exe	75
PID 2672 wrote to memory of 1000	2672	IMG_212022100120011.exe	75
PID 1000 wrote to memory of 1868	1000	cmd.exe	77
PID 1000 wrote to memory of 1868	1000	cmd.exe	77
PID 1000 wrote to memory of 1868	1000	cmd.exe	77
PID 2672 wrote to memory of 412	2672	IMG_212022100120011.exe	78
PID 2672 wrote to memory of 412	2672	IMG_212022100120011.exe	78
PID 2672 wrote to memory of 412	2672	IMG_212022100120011.exe	78
PID 412 wrote to memory of 644	412	cmd.exe	80
PID 412 wrote to memory of 644	412	cmd.exe	80
PID 412 wrote to memory of 644	412	cmd.exe	80
PID 2672 wrote to memory of 1480	2672	IMG_212022100120011.exe	81
PID 2672 wrote to memory of 1480	2672	IMG_212022100120011.exe	81
PID 2672 wrote to memory of 1480	2672	IMG_212022100120011.exe	81
PID 1480 wrote to memory of 592	1480	cmd.exe	83
PID 1480 wrote to memory of 592	1480	cmd.exe	83
PID 1480 wrote to memory of 592	1480	cmd.exe	83
PID 2672 wrote to memory of 1300	2672	IMG_212022100120011.exe	84
PID 2672 wrote to memory of 1300	2672	IMG_212022100120011.exe	84
PID 2672 wrote to memory of 1300	2672	IMG_212022100120011.exe	84
PID 1300 wrote to memory of 3644	1300	cmd.exe	86
PID 1300 wrote to memory of 3644	1300	cmd.exe	86
PID 1300 wrote to memory of 3644	1300	cmd.exe	86
PID 2672 wrote to memory of 576	2672	IMG_212022100120011.exe	87
PID 2672 wrote to memory of 576	2672	IMG_212022100120011.exe	87
PID 2672 wrote to memory of 576	2672	IMG_212022100120011.exe	87
PID 576 wrote to memory of 352	576	cmd.exe	89
PID 576 wrote to memory of 352	576	cmd.exe	89
PID 576 wrote to memory of 352	576	cmd.exe	89
PID 2672 wrote to memory of 2624	2672	IMG_212022100120011.exe	90
PID 2672 wrote to memory of 2624	2672	IMG_212022100120011.exe	90
PID 2672 wrote to memory of 2624	2672	IMG_212022100120011.exe	90
PID 2624 wrote to memory of 1776	2624	cmd.exe	92
PID 2624 wrote to memory of 1776	2624	cmd.exe	92
PID 2624 wrote to memory of 1776	2624	cmd.exe	92
PID 2672 wrote to memory of 2104	2672	IMG_212022100120011.exe	93
PID 2672 wrote to memory of 2104	2672	IMG_212022100120011.exe	93
PID 2672 wrote to memory of 2104	2672	IMG_212022100120011.exe	93
PID 2104 wrote to memory of 2544	2104	cmd.exe	95
PID 2104 wrote to memory of 2544	2104	cmd.exe	95
PID 2104 wrote to memory of 2544	2104	cmd.exe	95
PID 2672 wrote to memory of 2704	2672	IMG_212022100120011.exe	96
PID 2672 wrote to memory of 2704	2672	IMG_212022100120011.exe	96
PID 2672 wrote to memory of 2704	2672	IMG_212022100120011.exe	96
PID 2704 wrote to memory of 3080	2704	cmd.exe	98
PID 2704 wrote to memory of 3080	2704	cmd.exe	98
PID 2704 wrote to memory of 3080	2704	cmd.exe	98
PID 2672 wrote to memory of 3388	2672	IMG_212022100120011.exe	99
PID 2672 wrote to memory of 3388	2672	IMG_212022100120011.exe	99
PID 2672 wrote to memory of 3388	2672	IMG_212022100120011.exe	99
PID 3388 wrote to memory of 684	3388	cmd.exe	101

C:\Users\Admin\AppData\Local\Temp\IMG_212022100120011.exe
"C:\Users\Admin\AppData\Local\Temp\IMG_212022100120011.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2672
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C ping google.com
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1004
- - C:\Windows\SysWOW64\PING.EXE
    ping google.com
    3⤵
    - Runs ping.exe
    PID:2620
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C ping facebook.com
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:668
- - C:\Windows\SysWOW64\PING.EXE
    ping facebook.com
    3⤵
    - Runs ping.exe
    PID:2356
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C ping twitter.com
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1000
- - C:\Windows\SysWOW64\PING.EXE
    ping twitter.com
    3⤵
    - Runs ping.exe
    PID:1868
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C ping google.com
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:412
- - C:\Windows\SysWOW64\PING.EXE
    ping google.com
    3⤵
    - Runs ping.exe
    PID:644
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C ping facebook.com
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1480
- - C:\Windows\SysWOW64\PING.EXE
    ping facebook.com
    3⤵
    - Runs ping.exe
    PID:592
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C ping twitter.com
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1300
- - C:\Windows\SysWOW64\PING.EXE
    ping twitter.com
    3⤵
    - Runs ping.exe
    PID:3644
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C ping google.com
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:576
- - C:\Windows\SysWOW64\PING.EXE
    ping google.com
    3⤵
    - Runs ping.exe
    PID:352
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C ping facebook.com
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2624
- - C:\Windows\SysWOW64\PING.EXE
    ping facebook.com
    3⤵
    - Runs ping.exe
    PID:1776
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C ping twitter.com
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2104
- - C:\Windows\SysWOW64\PING.EXE
    ping twitter.com
    3⤵
    - Runs ping.exe
    PID:2544
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C ping google.com
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2704
- - C:\Windows\SysWOW64\PING.EXE
    ping google.com
    3⤵
    - Runs ping.exe
    PID:3080
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C ping facebook.com
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3388
- - C:\Windows\SysWOW64\PING.EXE
    ping facebook.com
    3⤵
    - Runs ping.exe
    PID:684
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C ping twitter.com
  2⤵
  PID:3936
- - C:\Windows\SysWOW64\PING.EXE
    ping twitter.com
    3⤵
    - Runs ping.exe
    PID:3576
- C:\Users\Admin\AppData\Local\Temp\IMG_212022100120011.exe
  C:\Users\Admin\AppData\Local\Temp\IMG_212022100120011.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3560

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2672-115-0x0000000000620000-0x0000000000636000-memory.dmp

Download

memory/2672-116-0x0000000004E20000-0x0000000004E21000-memory.dmp

Download

memory/2672-117-0x0000000004FB0000-0x0000000004FFC000-memory.dmp

Download

memory/2672-118-0x00000000058D0000-0x0000000005904000-memory.dmp

Download

memory/2672-119-0x0000000005C80000-0x0000000005CCC000-memory.dmp

Download

memory/2672-120-0x0000000005D70000-0x0000000005DD6000-memory.dmp

Download

memory/3560-121-0x0000000000400000-0x000000000041A000-memory.dmp

Download

memory/3560-123-0x0000000005860000-0x0000000005861000-memory.dmp

Download

memory/3560-124-0x0000000001750000-0x000000000175A000-memory.dmp

Download

memory/3560-125-0x0000000005D00000-0x0000000005D9C000-memory.dmp

Download

memory/3560-126-0x00000000062A0000-0x000000000679E000-memory.dmp

Download