asyncrat | a016b8b59f1c3da0242ef7cfbf2f096a6cd33c12cf7ff0fd93d57557f3675948

General

Target

a016b8b59f1c3da0242ef7cfbf2f096a6cd33c12cf7ff0fd93d57557f3675948.exe
Size

295KB
MD5

c30ab024549c5f092a6ea3dd5c20564d
SHA1

f349ea57c8c43dc1b8c4e3ef618afc96056bce99
SHA256

a016b8b59f1c3da0242ef7cfbf2f096a6cd33c12cf7ff0fd93d57557f3675948
SHA512

35debaec0eacf792f6b354b90a58da9bc97069865461eceff11c763e69c914eed698c9b68104ba17b5778b873dacecc468fdbb18f15d6dfef03a248d7989bba1

Score

10^/10

asyncrat persistence rat

Malware Config

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
rat asyncrat

Async RAT payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/2196-141-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat

Sets service image path in registry 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

a016b8b59f1c3da0242ef7cfbf2f096a6cd33c12cf7ff0fd93d57557f3675948.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Control Panel\International\Geo\Nation	a016b8b59f1c3da0242ef7cfbf2f096a6cd33c12cf7ff0fd93d57557f3675948.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

a016b8b59f1c3da0242ef7cfbf2f096a6cd33c12cf7ff0fd93d57557f3675948.exe

description	pid	process	target process
PID 3992 set thread context of 2196	3992	a016b8b59f1c3da0242ef7cfbf2f096a6cd33c12cf7ff0fd93d57557f3675948.exe	a016b8b59f1c3da0242ef7cfbf2f096a6cd33c12cf7ff0fd93d57557f3675948.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

2996 schtasks.exe

pid	process
2996	schtasks.exe

Modifies data under HKEY_USERS 41 IoCs

Processes:

WaaSMedicAgent.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	WaaSMedicAgent.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exe

pid process

3476 powershell.exe
3476 powershell.exe

pid	process
3476	powershell.exe
3476	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

powershell.exea016b8b59f1c3da0242ef7cfbf2f096a6cd33c12cf7ff0fd93d57557f3675948.exe

description	pid	process
Token: SeDebugPrivilege	3476	powershell.exe
Token: SeDebugPrivilege	2196	a016b8b59f1c3da0242ef7cfbf2f096a6cd33c12cf7ff0fd93d57557f3675948.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

a016b8b59f1c3da0242ef7cfbf2f096a6cd33c12cf7ff0fd93d57557f3675948.exe

description	pid	process	target process
PID 3992 wrote to memory of 3476	3992	a016b8b59f1c3da0242ef7cfbf2f096a6cd33c12cf7ff0fd93d57557f3675948.exe	powershell.exe
PID 3992 wrote to memory of 3476	3992	a016b8b59f1c3da0242ef7cfbf2f096a6cd33c12cf7ff0fd93d57557f3675948.exe	powershell.exe
PID 3992 wrote to memory of 3476	3992	a016b8b59f1c3da0242ef7cfbf2f096a6cd33c12cf7ff0fd93d57557f3675948.exe	powershell.exe
PID 3992 wrote to memory of 2996	3992	a016b8b59f1c3da0242ef7cfbf2f096a6cd33c12cf7ff0fd93d57557f3675948.exe	schtasks.exe
PID 3992 wrote to memory of 2996	3992	a016b8b59f1c3da0242ef7cfbf2f096a6cd33c12cf7ff0fd93d57557f3675948.exe	schtasks.exe
PID 3992 wrote to memory of 2996	3992	a016b8b59f1c3da0242ef7cfbf2f096a6cd33c12cf7ff0fd93d57557f3675948.exe	schtasks.exe
PID 3992 wrote to memory of 2196	3992	a016b8b59f1c3da0242ef7cfbf2f096a6cd33c12cf7ff0fd93d57557f3675948.exe	a016b8b59f1c3da0242ef7cfbf2f096a6cd33c12cf7ff0fd93d57557f3675948.exe
PID 3992 wrote to memory of 2196	3992	a016b8b59f1c3da0242ef7cfbf2f096a6cd33c12cf7ff0fd93d57557f3675948.exe	a016b8b59f1c3da0242ef7cfbf2f096a6cd33c12cf7ff0fd93d57557f3675948.exe
PID 3992 wrote to memory of 2196	3992	a016b8b59f1c3da0242ef7cfbf2f096a6cd33c12cf7ff0fd93d57557f3675948.exe	a016b8b59f1c3da0242ef7cfbf2f096a6cd33c12cf7ff0fd93d57557f3675948.exe
PID 3992 wrote to memory of 2196	3992	a016b8b59f1c3da0242ef7cfbf2f096a6cd33c12cf7ff0fd93d57557f3675948.exe	a016b8b59f1c3da0242ef7cfbf2f096a6cd33c12cf7ff0fd93d57557f3675948.exe
PID 3992 wrote to memory of 2196	3992	a016b8b59f1c3da0242ef7cfbf2f096a6cd33c12cf7ff0fd93d57557f3675948.exe	a016b8b59f1c3da0242ef7cfbf2f096a6cd33c12cf7ff0fd93d57557f3675948.exe
PID 3992 wrote to memory of 2196	3992	a016b8b59f1c3da0242ef7cfbf2f096a6cd33c12cf7ff0fd93d57557f3675948.exe	a016b8b59f1c3da0242ef7cfbf2f096a6cd33c12cf7ff0fd93d57557f3675948.exe
PID 3992 wrote to memory of 2196	3992	a016b8b59f1c3da0242ef7cfbf2f096a6cd33c12cf7ff0fd93d57557f3675948.exe	a016b8b59f1c3da0242ef7cfbf2f096a6cd33c12cf7ff0fd93d57557f3675948.exe
PID 3992 wrote to memory of 2196	3992	a016b8b59f1c3da0242ef7cfbf2f096a6cd33c12cf7ff0fd93d57557f3675948.exe	a016b8b59f1c3da0242ef7cfbf2f096a6cd33c12cf7ff0fd93d57557f3675948.exe

C:\Users\Admin\AppData\Local\Temp\a016b8b59f1c3da0242ef7cfbf2f096a6cd33c12cf7ff0fd93d57557f3675948.exe
"C:\Users\Admin\AppData\Local\Temp\a016b8b59f1c3da0242ef7cfbf2f096a6cd33c12cf7ff0fd93d57557f3675948.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3992

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\mseVlHxH.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3476

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\mseVlHxH" /XML "C:\Users\Admin\AppData\Local\Temp\tmp3C46.tmp"
2⤵
- Creates scheduled task(s)
PID:2996

C:\Users\Admin\AppData\Local\Temp\a016b8b59f1c3da0242ef7cfbf2f096a6cd33c12cf7ff0fd93d57557f3675948.exe
"C:\Users\Admin\AppData\Local\Temp\a016b8b59f1c3da0242ef7cfbf2f096a6cd33c12cf7ff0fd93d57557f3675948.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2196

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p
1⤵
PID:2352

C:\Windows\System32\WaaSMedicAgent.exe
C:\Windows\System32\WaaSMedicAgent.exe b4fd3aa3d0e3d5eea9a91a283fdcebb3 pENXZnoQfkS8lHBIlpwrEQ.0.1.0.0.0
1⤵
- Modifies data under HKEY_USERS
PID:3580

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k wusvcs -p
1⤵
PID:3360

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Registry Run Keys / Startup Folder

1

T1060

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp3C46.tmp
MD5
4427f82f6fe525e69af3b89e402b6ecb

SHA1
93f29def8ce24a77009fde47cadbc9e57ea7e106

SHA256
5d343b7794b2247d52658dd02f8ec74a6c2bad144c578bae09f31bbe1a92daec

SHA512
3347f64fa72a2a103d6404b30d34e3a96f538a6446fc874038f790107cacd676d2c606e1f5b26f472393b1919bec207a6caf6893b3ca23c0741d4a640724086d

Download Submit
memory/2196-144-0x0000000005280000-0x0000000005400000-memory.dmp

Filesize
1.5MB

Download
memory/2196-141-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/3476-146-0x0000000006C20000-0x0000000006C86000-memory.dmp

Filesize
408KB

Download
memory/3476-148-0x0000000007B40000-0x0000000007B5E000-memory.dmp

Filesize
120KB

Download
memory/3476-160-0x0000000009170000-0x0000000009178000-memory.dmp

Filesize
32KB

Download
memory/3476-138-0x00000000042D0000-0x00000000042D1000-memory.dmp

Filesize
4KB

Download
memory/3476-139-0x0000000004180000-0x00000000041B6000-memory.dmp

Filesize
216KB

Download
memory/3476-159-0x0000000009180000-0x000000000919A000-memory.dmp

Filesize
104KB

Download
memory/3476-158-0x0000000009080000-0x000000000908E000-memory.dmp

Filesize
56KB

Download
memory/3476-142-0x00000000042D2000-0x00000000042D3000-memory.dmp

Filesize
4KB

Download
memory/3476-143-0x0000000006EC0000-0x00000000074E8000-memory.dmp

Filesize
6.2MB

Download
memory/3476-157-0x00000000090C0000-0x0000000009156000-memory.dmp

Filesize
600KB

Download
memory/3476-145-0x0000000006B80000-0x0000000006BA2000-memory.dmp

Filesize
136KB

Download
memory/3476-156-0x0000000008ED0000-0x0000000008EDA000-memory.dmp

Filesize
40KB

Download
memory/3476-147-0x0000000006C90000-0x0000000006CF6000-memory.dmp

Filesize
408KB

Download
memory/3476-155-0x0000000008180000-0x000000000819A000-memory.dmp

Filesize
104KB

Download
memory/3476-149-0x00000000042D5000-0x00000000042D7000-memory.dmp

Filesize
8KB

Download
memory/3476-150-0x000000007EE40000-0x000000007EE41000-memory.dmp

Filesize
4KB

Download
memory/3476-151-0x0000000008070000-0x00000000080A2000-memory.dmp

Filesize
200KB

Download
memory/3476-152-0x0000000070E10000-0x0000000070E5C000-memory.dmp

Filesize
304KB

Download
memory/3476-153-0x0000000007F20000-0x0000000007F3E000-memory.dmp

Filesize
120KB

Download
memory/3476-154-0x0000000009500000-0x0000000009B7A000-memory.dmp

Filesize
6.5MB

Download
memory/3992-134-0x0000000005720000-0x000000000572A000-memory.dmp

Filesize
40KB

Download
memory/3992-130-0x0000000000C80000-0x0000000000CD0000-memory.dmp

Filesize
320KB

Download
memory/3992-131-0x0000000005B80000-0x0000000006124000-memory.dmp

Filesize
5.6MB

Download
memory/3992-132-0x0000000005670000-0x0000000005702000-memory.dmp

Filesize
584KB

Download
memory/3992-133-0x00000000055D0000-0x0000000005B74000-memory.dmp

Filesize
5.6MB

Download
memory/3992-135-0x0000000007970000-0x0000000007A0C000-memory.dmp

Filesize
624KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads