asyncrat | bcb3f5843cba83b163c793e06e5d583a021da1c5794fdd7e484e6ad0f9655e8f

General

Target

041e966e088ae931009805da96e4997d.exe
Size

624KB
MD5

041e966e088ae931009805da96e4997d
SHA1

09877b64628255c310a4dd310593a6c52b1db9dc
SHA256

bcb3f5843cba83b163c793e06e5d583a021da1c5794fdd7e484e6ad0f9655e8f
SHA512

c201f5b6c3a223e2064abcd7966edfd01f5df9f5e5d0c59a4d376141a86a60252e1c5cd6b1409d93dc6ee6ab886d271f5790ebae5d6721361f2f7a044dbf7290

Score

10^/10

asyncrat rat

Malware Config

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
rat asyncrat

Async RAT payload 4 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/668-63-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat
behavioral1/memory/668-64-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat
behavioral1/memory/668-65-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat
behavioral1/memory/668-66-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat

Suspicious use of SetThreadContext 1 IoCs

Processes:

041e966e088ae931009805da96e4997d.exe

description pid process target process

PID 1568 set thread context of 668 1568 041e966e088ae931009805da96e4997d.exe 041e966e088ae931009805da96e4997d.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

528 schtasks.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid process

560 powershell.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

powershell.exe041e966e088ae931009805da96e4997d.exe

description pid process

Token: SeDebugPrivilege 560 powershell.exe
Token: SeDebugPrivilege 668 041e966e088ae931009805da96e4997d.exe

description	pid	process	target process
PID 1568 set thread context of 668	1568	041e966e088ae931009805da96e4997d.exe	041e966e088ae931009805da96e4997d.exe

pid	process
528	schtasks.exe

pid	process
560	powershell.exe

description	pid	process
Token: SeDebugPrivilege	560	powershell.exe
Token: SeDebugPrivilege	668	041e966e088ae931009805da96e4997d.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

041e966e088ae931009805da96e4997d.exe

description	pid	process	target process
PID 1568 wrote to memory of 560	1568	041e966e088ae931009805da96e4997d.exe	powershell.exe
PID 1568 wrote to memory of 560	1568	041e966e088ae931009805da96e4997d.exe	powershell.exe
PID 1568 wrote to memory of 560	1568	041e966e088ae931009805da96e4997d.exe	powershell.exe
PID 1568 wrote to memory of 560	1568	041e966e088ae931009805da96e4997d.exe	powershell.exe
PID 1568 wrote to memory of 528	1568	041e966e088ae931009805da96e4997d.exe	schtasks.exe
PID 1568 wrote to memory of 528	1568	041e966e088ae931009805da96e4997d.exe	schtasks.exe
PID 1568 wrote to memory of 528	1568	041e966e088ae931009805da96e4997d.exe	schtasks.exe
PID 1568 wrote to memory of 528	1568	041e966e088ae931009805da96e4997d.exe	schtasks.exe
PID 1568 wrote to memory of 668	1568	041e966e088ae931009805da96e4997d.exe	041e966e088ae931009805da96e4997d.exe
PID 1568 wrote to memory of 668	1568	041e966e088ae931009805da96e4997d.exe	041e966e088ae931009805da96e4997d.exe
PID 1568 wrote to memory of 668	1568	041e966e088ae931009805da96e4997d.exe	041e966e088ae931009805da96e4997d.exe
PID 1568 wrote to memory of 668	1568	041e966e088ae931009805da96e4997d.exe	041e966e088ae931009805da96e4997d.exe
PID 1568 wrote to memory of 668	1568	041e966e088ae931009805da96e4997d.exe	041e966e088ae931009805da96e4997d.exe
PID 1568 wrote to memory of 668	1568	041e966e088ae931009805da96e4997d.exe	041e966e088ae931009805da96e4997d.exe
PID 1568 wrote to memory of 668	1568	041e966e088ae931009805da96e4997d.exe	041e966e088ae931009805da96e4997d.exe
PID 1568 wrote to memory of 668	1568	041e966e088ae931009805da96e4997d.exe	041e966e088ae931009805da96e4997d.exe
PID 1568 wrote to memory of 668	1568	041e966e088ae931009805da96e4997d.exe	041e966e088ae931009805da96e4997d.exe

C:\Users\Admin\AppData\Local\Temp\041e966e088ae931009805da96e4997d.exe
"C:\Users\Admin\AppData\Local\Temp\041e966e088ae931009805da96e4997d.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1568

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\btVAOWX.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:560

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\btVAOWX" /XML "C:\Users\Admin\AppData\Local\Temp\tmp7D99.tmp"
2⤵
- Creates scheduled task(s)
PID:528

C:\Users\Admin\AppData\Local\Temp\041e966e088ae931009805da96e4997d.exe
"C:\Users\Admin\AppData\Local\Temp\041e966e088ae931009805da96e4997d.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:668

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp7D99.tmp
MD5
ef648da3e7d41915105c31a6fc0c0b96

SHA1
c329c242fa2d2461224ca40e6680eab9b672c097

SHA256
982c83afb9dcfaa732c7d584b6921f8278af98246051624b3fee276379043aef

SHA512
44bee9d324ad2c2adf26afb3d6701e3f7e9c9551ba6d78ce0baa6bafb918e773b4038d07cf5331b31c922795d9ce40521f51c81e91c23eea2b1c20bbbf1d353d

Download Submit
memory/560-69-0x00000000024E0000-0x000000000312A000-memory.dmp

Filesize
12.3MB

Download
memory/560-68-0x00000000024E0000-0x000000000312A000-memory.dmp

Filesize
12.3MB

Download
memory/560-67-0x00000000024E0000-0x000000000312A000-memory.dmp

Filesize
12.3MB

Download
memory/668-63-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/668-61-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/668-62-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/668-64-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/668-65-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/668-66-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/668-71-0x0000000004660000-0x0000000004661000-memory.dmp

Filesize
4KB

Download
memory/1568-58-0x0000000001FF0000-0x000000000202C000-memory.dmp

Filesize
240KB

Download
memory/1568-54-0x00000000009B0000-0x0000000000A52000-memory.dmp

Filesize
648KB

Download
memory/1568-57-0x0000000000360000-0x000000000036C000-memory.dmp

Filesize
48KB

Download
memory/1568-56-0x0000000004CC0000-0x0000000004CC1000-memory.dmp

Filesize
4KB

Download
memory/1568-55-0x0000000075D11000-0x0000000075D13000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads