asyncrat | fa74335c09c138eab6256c1fbb176aee9a8334aac65cff3bf9b602d9dc9dd554

General

Target

Microsofd.ps1
Size

441KB
MD5

9e3b4a2ed171ea1c888d569c7d98b944
SHA1

9f4b88c179ab1485f94bc13551d33aca4d80e18a
SHA256

fa74335c09c138eab6256c1fbb176aee9a8334aac65cff3bf9b602d9dc9dd554
SHA512

eac8f04457080f2ed89df83a76b3855a3a7864a0c3f85f59f4c2b871660b319028a934936e09c7269b829582dfc396b16031de359fffa911bb73b7fd2e48f028

Score

10^/10

asyncrat {{{{____coinnnnnnbase___}}}}}rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

{{{{____COINNNNNNBASE___}}}}}

C2

python.blogsyte.com:6606

Mutex

AsyncMutex_6SI8OkPnk

Attributes

anti_vm
false
bsod
false
delay
3
install
false
install_folder
%AppData%
pastebin_config
null

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
rat asyncrat

Async RAT payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/1252-136-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat
behavioral2/memory/1252-144-0x0000000005860000-0x0000000005880000-memory.dmp	asyncrat

Suspicious use of SetThreadContext 1 IoCs

Processes:

powershell.exe

description pid process target process

PID 2440 set thread context of 1252 2440 powershell.exe aspnet_compiler.exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

powershell.exe

pid process

2440 powershell.exe
2440 powershell.exe
2440 powershell.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

aspnet_compiler.exe

pid process

1252 aspnet_compiler.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

powershell.exeaspnet_compiler.exe

description pid process

Token: SeDebugPrivilege 2440 powershell.exe
Token: SeDebugPrivilege 1252 aspnet_compiler.exe

description	pid	process	target process
PID 2440 set thread context of 1252	2440	powershell.exe	aspnet_compiler.exe

pid	process
2440	powershell.exe
2440	powershell.exe
2440	powershell.exe

pid	process
1252	aspnet_compiler.exe

description	pid	process
Token: SeDebugPrivilege	2440	powershell.exe
Token: SeDebugPrivilege	1252	aspnet_compiler.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

powershell.exe

description	pid	process	target process
PID 2440 wrote to memory of 1252	2440	powershell.exe	aspnet_compiler.exe
PID 2440 wrote to memory of 1252	2440	powershell.exe	aspnet_compiler.exe
PID 2440 wrote to memory of 1252	2440	powershell.exe	aspnet_compiler.exe
PID 2440 wrote to memory of 1252	2440	powershell.exe	aspnet_compiler.exe
PID 2440 wrote to memory of 1252	2440	powershell.exe	aspnet_compiler.exe
PID 2440 wrote to memory of 1252	2440	powershell.exe	aspnet_compiler.exe
PID 2440 wrote to memory of 1252	2440	powershell.exe	aspnet_compiler.exe
PID 2440 wrote to memory of 1252	2440	powershell.exe	aspnet_compiler.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\Microsofd.ps1
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2440

C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
2⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:1252

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1252-142-0x0000000005880000-0x00000000058E6000-memory.dmp

Filesize
408KB

Download
memory/1252-136-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1252-138-0x000000007327E000-0x000000007327F000-memory.dmp

Filesize
4KB

Download
memory/1252-146-0x0000000006840000-0x00000000068D2000-memory.dmp

Filesize
584KB

Download
memory/1252-139-0x0000000004F50000-0x0000000004F51000-memory.dmp

Filesize
4KB

Download
memory/1252-145-0x0000000006730000-0x000000000674E000-memory.dmp

Filesize
120KB

Download
memory/1252-144-0x0000000005860000-0x0000000005880000-memory.dmp

Filesize
128KB

Download
memory/1252-140-0x0000000005770000-0x000000000580C000-memory.dmp

Filesize
624KB

Download
memory/1252-143-0x0000000006590000-0x0000000006606000-memory.dmp

Filesize
472KB

Download
memory/1252-141-0x0000000005D10000-0x000000000620E000-memory.dmp

Filesize
5.0MB

Download
memory/2440-134-0x0000024CB4850000-0x0000024CB4876000-memory.dmp

Filesize
152KB

Download
memory/2440-126-0x0000024CB3323000-0x0000024CB3325000-memory.dmp

Filesize
8KB

Download
memory/2440-118-0x0000024CB32A0000-0x0000024CB32C2000-memory.dmp

Filesize
136KB

Download
memory/2440-124-0x00007FF98D7B3000-0x00007FF98D7B4000-memory.dmp

Filesize
4KB

Download
memory/2440-135-0x0000024CB3326000-0x0000024CB3328000-memory.dmp

Filesize
8KB

Download
memory/2440-122-0x0000024CB3690000-0x0000024CB3706000-memory.dmp

Filesize
472KB

Download
memory/2440-125-0x0000024CB3320000-0x0000024CB3322000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing