asyncrat | 5e4bbf19a6e055cc6c2c98ef38288f3465c30e25542b735fbfca921fdb8b95f9

General

Target

5E4BBF19A6E055CC6C2C98EF38288F3465C30E25542B7.exe
Size

486KB
MD5

32cc876191795965e3d5f80cfa90ab3d
SHA1

91eb8879cc44f8361454eb89756fc902e73c3cb1
SHA256

5e4bbf19a6e055cc6c2c98ef38288f3465c30e25542b735fbfca921fdb8b95f9
SHA512

e5f369587c4980bd7aa8590921743f8894777883fec485b2cb726c905d21cf9f4639a2498f2d57520c4eb771b032f4c6882b3679a1af1ce5fd0dacd6c42edb82

Score

10^/10

asyncrat evasion rat

Malware Config

Extracted

Family

asyncrat

Version

v0.2

C2

dhciaicjzis.xyz:1703

aisviua77s.xyz:1703

sakivivjasiv8cozo3.cn:1703

asidivuvuas8rnvns73.xyz:1703

dsijfiudsfiashvu7ds43.xyz:1703

Mutex

afgj6j3umd5uk

Attributes

anti_vm
false
bsod
false
delay
0
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
rat asyncrat

Async RAT payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/2772-122-0x000001F7E8830000-0x000001F7E885A000-memory.dmp	asyncrat
behavioral2/memory/2772-124-0x000001F7E8860000-0x000001F7E8870000-memory.dmp	asyncrat
behavioral2/memory/2772-130-0x000001F7EA5C0000-0x000001F7EB0DE000-memory.dmp	asyncrat

Modifies Windows Firewall 1 TTPs
evasion

Modify Existing Service
T1031
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

28 ipinfo.io
24 checkip.dyndns.org
Suspicious use of SetThreadContext 1 IoCs

Processes:

5E4BBF19A6E055CC6C2C98EF38288F3465C30E25542B7.exe

description pid process target process

PID 2476 set thread context of 2772 2476 5E4BBF19A6E055CC6C2C98EF38288F3465C30E25542B7.exe filehistory.exe

flow	ioc
28	ipinfo.io
24	checkip.dyndns.org

description	pid	process	target process
PID 2476 set thread context of 2772	2476	5E4BBF19A6E055CC6C2C98EF38288F3465C30E25542B7.exe	filehistory.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

filehistory.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	filehistory.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	filehistory.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

filehistory.exe

pid process

2772 filehistory.exe
2772 filehistory.exe
2772 filehistory.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

filehistory.exe

description pid process

Token: SeDebugPrivilege 2772 filehistory.exe

pid	process
2772	filehistory.exe
2772	filehistory.exe
2772	filehistory.exe

description	pid	process
Token: SeDebugPrivilege	2772	filehistory.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

5E4BBF19A6E055CC6C2C98EF38288F3465C30E25542B7.exefilehistory.exe

description	pid	process	target process
PID 2476 wrote to memory of 2772	2476	5E4BBF19A6E055CC6C2C98EF38288F3465C30E25542B7.exe	filehistory.exe
PID 2476 wrote to memory of 2772	2476	5E4BBF19A6E055CC6C2C98EF38288F3465C30E25542B7.exe	filehistory.exe
PID 2476 wrote to memory of 2772	2476	5E4BBF19A6E055CC6C2C98EF38288F3465C30E25542B7.exe	filehistory.exe
PID 2476 wrote to memory of 2772	2476	5E4BBF19A6E055CC6C2C98EF38288F3465C30E25542B7.exe	filehistory.exe
PID 2476 wrote to memory of 2772	2476	5E4BBF19A6E055CC6C2C98EF38288F3465C30E25542B7.exe	filehistory.exe
PID 2476 wrote to memory of 2772	2476	5E4BBF19A6E055CC6C2C98EF38288F3465C30E25542B7.exe	filehistory.exe
PID 2772 wrote to memory of 836	2772	filehistory.exe	netsh.exe
PID 2772 wrote to memory of 836	2772	filehistory.exe	netsh.exe

C:\Users\Admin\AppData\Local\Temp\5E4BBF19A6E055CC6C2C98EF38288F3465C30E25542B7.exe
"C:\Users\Admin\AppData\Local\Temp\5E4BBF19A6E055CC6C2C98EF38288F3465C30E25542B7.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2476

\??\c:\windows\system32\filehistory.exe
c:\windows\system32\filehistory.exe
2⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2772

\??\c:\windows\system32\netsh.exe
"netsh.exe" firewall add allowedprogram c:\windows\system32\filehistory.exe SystemUpdate ENABLE
3⤵
PID:836

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2476-115-0x0000015DD0070000-0x0000015DD00EE000-memory.dmp

Filesize
504KB

Download
memory/2772-116-0x0000000140000000-0x0000000140062000-memory.dmp

Filesize
392KB

Download
memory/2772-117-0x000001F7E6EA0000-0x000001F7E6EC2000-memory.dmp

Filesize
136KB

Download
memory/2772-118-0x000001F7E9160000-0x000001F7E9162000-memory.dmp

Filesize
8KB

Download
memory/2772-119-0x000001F7E9090000-0x000001F7E9106000-memory.dmp

Filesize
472KB

Download
memory/2772-120-0x000001F7E6E70000-0x000001F7E6E85000-memory.dmp

Filesize
84KB

Download
memory/2772-121-0x000001F7E8800000-0x000001F7E8821000-memory.dmp

Filesize
132KB

Download
memory/2772-122-0x000001F7E8830000-0x000001F7E885A000-memory.dmp

Filesize
168KB

Download
memory/2772-123-0x000001F7E8AD0000-0x000001F7E8B1A000-memory.dmp

Filesize
296KB

Download
memory/2772-124-0x000001F7E8860000-0x000001F7E8870000-memory.dmp

Filesize
64KB

Download
memory/2772-125-0x000001F7E9110000-0x000001F7E912E000-memory.dmp

Filesize
120KB

Download
memory/2772-126-0x000001F7EA350000-0x000001F7EA3BA000-memory.dmp

Filesize
424KB

Download
memory/2772-127-0x000001F7E8870000-0x000001F7E887A000-memory.dmp

Filesize
40KB

Download
memory/2772-128-0x000001F7EA3C0000-0x000001F7EA420000-memory.dmp

Filesize
384KB

Download
memory/2772-129-0x000001F7EA420000-0x000001F7EA4B0000-memory.dmp

Filesize
576KB

Download
memory/2772-130-0x000001F7EA5C0000-0x000001F7EB0DE000-memory.dmp

Filesize
11.1MB

Download
memory/2772-131-0x000001F7E88B0000-0x000001F7E88BA000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads