asyncrat | 34694c57b7447b59d6bc6a2dba635fa320a4d4b1e550a36840fe1f2208b76d87

General

Target

34694c57b7447b59d6bc6a2dba635fa320a4d4b1e550a36840fe1f2208b76d87.exe
Size

671KB
MD5

3c39836dedf6779a0207819c72238fa5
SHA1

07433edf63057fff1e96ddbf5249aa2c50f69dbd
SHA256

34694c57b7447b59d6bc6a2dba635fa320a4d4b1e550a36840fe1f2208b76d87
SHA512

f8a6810abf551f01aae3a8d7c2e6a3421aac3f0312301a5e12a28bfe9490ae064f5c8dd846113cf755a3d9b8f22b80f92b27ec6e4590b04a1629662f472a7086

Score

10^/10

asyncrat 1 persistence rat spyware stealer

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

1

C2

212.193.30.54:8755

Mutex

gyQ12!.,=FD7trew

Attributes

anti_vm
false
bsod
false
delay
3
install
false
install_folder
%AppData%
pastebin_config
null

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
rat asyncrat

Async RAT payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1968-123-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

34694c57b7447b59d6bc6a2dba635fa320a4d4b1e550a36840fe1f2208b76d87.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Windows\CurrentVersion\Run\Dslfiip = "\"C:\\Users\\Admin\\AppData\\Roaming\\Cltjej\\Dslfiip.exe\""	34694c57b7447b59d6bc6a2dba635fa320a4d4b1e550a36840fe1f2208b76d87.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

34694c57b7447b59d6bc6a2dba635fa320a4d4b1e550a36840fe1f2208b76d87.exe

description	pid	process	target process
PID 1492 set thread context of 1968	1492	34694c57b7447b59d6bc6a2dba635fa320a4d4b1e550a36840fe1f2208b76d87.exe	MSBuild.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

34694c57b7447b59d6bc6a2dba635fa320a4d4b1e550a36840fe1f2208b76d87.exe

pid	process
1492	34694c57b7447b59d6bc6a2dba635fa320a4d4b1e550a36840fe1f2208b76d87.exe
1492	34694c57b7447b59d6bc6a2dba635fa320a4d4b1e550a36840fe1f2208b76d87.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

34694c57b7447b59d6bc6a2dba635fa320a4d4b1e550a36840fe1f2208b76d87.exe

description pid process

Token: SeDebugPrivilege 1492 34694c57b7447b59d6bc6a2dba635fa320a4d4b1e550a36840fe1f2208b76d87.exe

description	pid	process
Token: SeDebugPrivilege	1492	34694c57b7447b59d6bc6a2dba635fa320a4d4b1e550a36840fe1f2208b76d87.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

34694c57b7447b59d6bc6a2dba635fa320a4d4b1e550a36840fe1f2208b76d87.exe

description	pid	process	target process
PID 1492 wrote to memory of 1968	1492	34694c57b7447b59d6bc6a2dba635fa320a4d4b1e550a36840fe1f2208b76d87.exe	MSBuild.exe
PID 1492 wrote to memory of 1968	1492	34694c57b7447b59d6bc6a2dba635fa320a4d4b1e550a36840fe1f2208b76d87.exe	MSBuild.exe
PID 1492 wrote to memory of 1968	1492	34694c57b7447b59d6bc6a2dba635fa320a4d4b1e550a36840fe1f2208b76d87.exe	MSBuild.exe
PID 1492 wrote to memory of 1968	1492	34694c57b7447b59d6bc6a2dba635fa320a4d4b1e550a36840fe1f2208b76d87.exe	MSBuild.exe
PID 1492 wrote to memory of 1968	1492	34694c57b7447b59d6bc6a2dba635fa320a4d4b1e550a36840fe1f2208b76d87.exe	MSBuild.exe
PID 1492 wrote to memory of 1968	1492	34694c57b7447b59d6bc6a2dba635fa320a4d4b1e550a36840fe1f2208b76d87.exe	MSBuild.exe
PID 1492 wrote to memory of 1968	1492	34694c57b7447b59d6bc6a2dba635fa320a4d4b1e550a36840fe1f2208b76d87.exe	MSBuild.exe
PID 1492 wrote to memory of 1968	1492	34694c57b7447b59d6bc6a2dba635fa320a4d4b1e550a36840fe1f2208b76d87.exe	MSBuild.exe

C:\Users\Admin\AppData\Local\Temp\34694c57b7447b59d6bc6a2dba635fa320a4d4b1e550a36840fe1f2208b76d87.exe
"C:\Users\Admin\AppData\Local\Temp\34694c57b7447b59d6bc6a2dba635fa320a4d4b1e550a36840fe1f2208b76d87.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1492

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
2⤵
PID:1968

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1492-114-0x0000000000CE0000-0x0000000000D8E000-memory.dmp

Filesize
696KB

Download
memory/1492-115-0x000000007354E000-0x000000007354F000-memory.dmp

Filesize
4KB

Download
memory/1492-116-0x0000000005D00000-0x00000000061FE000-memory.dmp

Filesize
5.0MB

Download
memory/1492-117-0x0000000005740000-0x00000000057DE000-memory.dmp

Filesize
632KB

Download
memory/1492-118-0x0000000005800000-0x0000000005850000-memory.dmp

Filesize
320KB

Download
memory/1492-119-0x00000000058F0000-0x0000000005982000-memory.dmp

Filesize
584KB

Download
memory/1492-120-0x0000000005690000-0x000000000569A000-memory.dmp

Filesize
40KB

Download
memory/1492-121-0x00000000056C0000-0x00000000056C1000-memory.dmp

Filesize
4KB

Download
memory/1492-122-0x0000000005B80000-0x0000000005BCC000-memory.dmp

Filesize
304KB

Download
memory/1968-123-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1968-124-0x000000007354E000-0x000000007354F000-memory.dmp

Filesize
4KB

Download
memory/1968-125-0x00000000056E0000-0x00000000056E1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads