asyncrat | c757edff2fdc8e5d4afc3c82e69b03fdf6da3512934fab0021e8dfbf9298fd49

General

Target

34694c57b7447b59d6bc6a2dba635fa320a4d4b1e550a36840fe1f2208b76d87.exe
Size

671KB
MD5

3c39836dedf6779a0207819c72238fa5
SHA1

07433edf63057fff1e96ddbf5249aa2c50f69dbd
SHA256

34694c57b7447b59d6bc6a2dba635fa320a4d4b1e550a36840fe1f2208b76d87
SHA512

f8a6810abf551f01aae3a8d7c2e6a3421aac3f0312301a5e12a28bfe9490ae064f5c8dd846113cf755a3d9b8f22b80f92b27ec6e4590b04a1629662f472a7086

Score

10^/10

asyncrat 1 persistence rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

1

C2

212.193.30.54:8755

Mutex

gyQ12!.,=FD7trew

Attributes

anti_vm
false
bsod
false
delay
3
install
false
install_folder
%AppData%
pastebin_config
null

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
rat asyncrat

Async RAT payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/1364-137-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

34694c57b7447b59d6bc6a2dba635fa320a4d4b1e550a36840fe1f2208b76d87.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Dslfiip = "\"C:\\Users\\Admin\\AppData\\Roaming\\Cltjej\\Dslfiip.exe\""	34694c57b7447b59d6bc6a2dba635fa320a4d4b1e550a36840fe1f2208b76d87.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

34694c57b7447b59d6bc6a2dba635fa320a4d4b1e550a36840fe1f2208b76d87.exe

description	pid	process	target process
PID 1792 set thread context of 1364	1792	34694c57b7447b59d6bc6a2dba635fa320a4d4b1e550a36840fe1f2208b76d87.exe	MSBuild.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

34694c57b7447b59d6bc6a2dba635fa320a4d4b1e550a36840fe1f2208b76d87.exe

pid	process
1792	34694c57b7447b59d6bc6a2dba635fa320a4d4b1e550a36840fe1f2208b76d87.exe
1792	34694c57b7447b59d6bc6a2dba635fa320a4d4b1e550a36840fe1f2208b76d87.exe
1792	34694c57b7447b59d6bc6a2dba635fa320a4d4b1e550a36840fe1f2208b76d87.exe
1792	34694c57b7447b59d6bc6a2dba635fa320a4d4b1e550a36840fe1f2208b76d87.exe
1792	34694c57b7447b59d6bc6a2dba635fa320a4d4b1e550a36840fe1f2208b76d87.exe
1792	34694c57b7447b59d6bc6a2dba635fa320a4d4b1e550a36840fe1f2208b76d87.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

34694c57b7447b59d6bc6a2dba635fa320a4d4b1e550a36840fe1f2208b76d87.exe

description pid process

Token: SeDebugPrivilege 1792 34694c57b7447b59d6bc6a2dba635fa320a4d4b1e550a36840fe1f2208b76d87.exe

description	pid	process
Token: SeDebugPrivilege	1792	34694c57b7447b59d6bc6a2dba635fa320a4d4b1e550a36840fe1f2208b76d87.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

34694c57b7447b59d6bc6a2dba635fa320a4d4b1e550a36840fe1f2208b76d87.exe

description	pid	process	target process
PID 1792 wrote to memory of 2576	1792	34694c57b7447b59d6bc6a2dba635fa320a4d4b1e550a36840fe1f2208b76d87.exe	MSBuild.exe
PID 1792 wrote to memory of 2576	1792	34694c57b7447b59d6bc6a2dba635fa320a4d4b1e550a36840fe1f2208b76d87.exe	MSBuild.exe
PID 1792 wrote to memory of 2576	1792	34694c57b7447b59d6bc6a2dba635fa320a4d4b1e550a36840fe1f2208b76d87.exe	MSBuild.exe
PID 1792 wrote to memory of 1364	1792	34694c57b7447b59d6bc6a2dba635fa320a4d4b1e550a36840fe1f2208b76d87.exe	MSBuild.exe
PID 1792 wrote to memory of 1364	1792	34694c57b7447b59d6bc6a2dba635fa320a4d4b1e550a36840fe1f2208b76d87.exe	MSBuild.exe
PID 1792 wrote to memory of 1364	1792	34694c57b7447b59d6bc6a2dba635fa320a4d4b1e550a36840fe1f2208b76d87.exe	MSBuild.exe
PID 1792 wrote to memory of 1364	1792	34694c57b7447b59d6bc6a2dba635fa320a4d4b1e550a36840fe1f2208b76d87.exe	MSBuild.exe
PID 1792 wrote to memory of 1364	1792	34694c57b7447b59d6bc6a2dba635fa320a4d4b1e550a36840fe1f2208b76d87.exe	MSBuild.exe
PID 1792 wrote to memory of 1364	1792	34694c57b7447b59d6bc6a2dba635fa320a4d4b1e550a36840fe1f2208b76d87.exe	MSBuild.exe
PID 1792 wrote to memory of 1364	1792	34694c57b7447b59d6bc6a2dba635fa320a4d4b1e550a36840fe1f2208b76d87.exe	MSBuild.exe
PID 1792 wrote to memory of 1364	1792	34694c57b7447b59d6bc6a2dba635fa320a4d4b1e550a36840fe1f2208b76d87.exe	MSBuild.exe

C:\Users\Admin\AppData\Local\Temp\34694c57b7447b59d6bc6a2dba635fa320a4d4b1e550a36840fe1f2208b76d87.exe
"C:\Users\Admin\AppData\Local\Temp\34694c57b7447b59d6bc6a2dba635fa320a4d4b1e550a36840fe1f2208b76d87.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1792

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
2⤵
PID:2576

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
2⤵
PID:1364

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1364-137-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1364-138-0x000000007479E000-0x000000007479F000-memory.dmp

Filesize
4KB

Download
memory/1792-130-0x000000007479E000-0x000000007479F000-memory.dmp

Filesize
4KB

Download
memory/1792-131-0x0000000000960000-0x0000000000A0E000-memory.dmp

Filesize
696KB

Download
memory/1792-132-0x00000000058C0000-0x0000000005E64000-memory.dmp

Filesize
5.6MB

Download
memory/1792-133-0x0000000001130000-0x0000000001180000-memory.dmp

Filesize
320KB

Download
memory/1792-134-0x0000000001220000-0x00000000012B2000-memory.dmp

Filesize
584KB

Download
memory/1792-135-0x0000000000E90000-0x0000000000E9A000-memory.dmp

Filesize
40KB

Download
memory/1792-136-0x00000000053A0000-0x00000000053A1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads