asyncrat | 813277c84fe11b699a6924cd692024d7efd86fff596841e950523ad10d529dc4

General

Target

813277c84fe11b699a6924cd692024d7efd86fff596841e950523ad10d529dc4.exe
Size

218KB
MD5

b84e980a2ddc7fe338f990caeb01a132
SHA1

e84a77f956e9cc4d9bee3063ca7ad2d2bd0f859a
SHA256

813277c84fe11b699a6924cd692024d7efd86fff596841e950523ad10d529dc4
SHA512

7d80551fff887bee3d6af0e3990bb916a0eb58ed1f6a5c1b2f3b8723429a0d06b8019078e9f3948a3d3ab7bef5accfc440958c896da6eb28ddf4b174a4570274

Score

10^/10

asyncrat rat

Malware Config

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
rat asyncrat

Async RAT payload 3 IoCs

rat

resource	yara_rule
behavioral2/files/0x0006000000021e52-131.dat	asyncrat
behavioral2/files/0x0006000000021e52-132.dat	asyncrat
behavioral2/memory/4468-133-0x0000000000E90000-0x0000000000EBC000-memory.dmp	asyncrat

Executes dropped EXE 1 IoCs

pid	Process
4468	tmp.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\Control Panel\International\Geo\Nation	813277c84fe11b699a6924cd692024d7efd86fff596841e950523ad10d529dc4.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows Registry Updater.exe.lnk	813277c84fe11b699a6924cd692024d7efd86fff596841e950523ad10d529dc4.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
3104	813277c84fe11b699a6924cd692024d7efd86fff596841e950523ad10d529dc4.exe
3104	813277c84fe11b699a6924cd692024d7efd86fff596841e950523ad10d529dc4.exe
4468	tmp.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3104	813277c84fe11b699a6924cd692024d7efd86fff596841e950523ad10d529dc4.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	3104	813277c84fe11b699a6924cd692024d7efd86fff596841e950523ad10d529dc4.exe
Token: 33	3104	813277c84fe11b699a6924cd692024d7efd86fff596841e950523ad10d529dc4.exe
Token: SeIncBasePriorityPrivilege	3104	813277c84fe11b699a6924cd692024d7efd86fff596841e950523ad10d529dc4.exe
Token: SeDebugPrivilege	4468	tmp.exe
Token: SeDebugPrivilege	4468	tmp.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3104 wrote to memory of 2144	3104	813277c84fe11b699a6924cd692024d7efd86fff596841e950523ad10d529dc4.exe	76
PID 3104 wrote to memory of 2144	3104	813277c84fe11b699a6924cd692024d7efd86fff596841e950523ad10d529dc4.exe	76
PID 3104 wrote to memory of 2144	3104	813277c84fe11b699a6924cd692024d7efd86fff596841e950523ad10d529dc4.exe	76
PID 3104 wrote to memory of 4524	3104	813277c84fe11b699a6924cd692024d7efd86fff596841e950523ad10d529dc4.exe	78
PID 3104 wrote to memory of 4524	3104	813277c84fe11b699a6924cd692024d7efd86fff596841e950523ad10d529dc4.exe	78
PID 3104 wrote to memory of 4524	3104	813277c84fe11b699a6924cd692024d7efd86fff596841e950523ad10d529dc4.exe	78
PID 3104 wrote to memory of 4468	3104	813277c84fe11b699a6924cd692024d7efd86fff596841e950523ad10d529dc4.exe	80
PID 3104 wrote to memory of 4468	3104	813277c84fe11b699a6924cd692024d7efd86fff596841e950523ad10d529dc4.exe	80

C:\Users\Admin\AppData\Local\Temp\813277c84fe11b699a6924cd692024d7efd86fff596841e950523ad10d529dc4.exe
"C:\Users\Admin\AppData\Local\Temp\813277c84fe11b699a6924cd692024d7efd86fff596841e950523ad10d529dc4.exe"
1⤵
- Checks computer location settings
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3104
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c echo [zoneTransfer]ZoneID = 2 > %appdata%\Windows Registry Updater\Windows Registry Updater.exe:Zone.Identifier
  2⤵
  PID:2144
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ren "%appdata%\Windows Registry Updater\Windows Registry Updater.exe.jpg" Windows Registry Updater.exe
  2⤵
  PID:4524
- C:\Users\Admin\AppData\Local\Temp\tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmp.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4468

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp.exe

Filesize
146KB

MD5
b62d18051855ba3768ed2228a9daa267

SHA1
1d7b42775a0eac738f7bc94ec110de8ff7d081ba

SHA256
60dc56fe6f65414b3f1f6831a4ba86990328bcc4097155d85632a2a2ff25eb94

SHA512
00c427c21e5294875e62a1aaaf5dfb4fd55846ce070a3b87ae0fa0defa07256b6649536b4f80c32b4e8e495bb18e91741a9f1aad27b7fbd7f0856c1a0bcc1a52

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp.exe

Filesize
146KB

MD5
b62d18051855ba3768ed2228a9daa267

SHA1
1d7b42775a0eac738f7bc94ec110de8ff7d081ba

SHA256
60dc56fe6f65414b3f1f6831a4ba86990328bcc4097155d85632a2a2ff25eb94

SHA512
00c427c21e5294875e62a1aaaf5dfb4fd55846ce070a3b87ae0fa0defa07256b6649536b4f80c32b4e8e495bb18e91741a9f1aad27b7fbd7f0856c1a0bcc1a52

Download Submit
memory/3104-124-0x0000000000FB0000-0x0000000000FE4000-memory.dmp

Filesize
208KB

Download
memory/3104-125-0x0000000005FB0000-0x0000000006554000-memory.dmp

Filesize
5.6MB

Download
memory/3104-126-0x0000000005A00000-0x0000000005A92000-memory.dmp

Filesize
584KB

Download
memory/3104-127-0x0000000005AA0000-0x0000000005B3C000-memory.dmp

Filesize
624KB

Download
memory/4468-133-0x0000000000E90000-0x0000000000EBC000-memory.dmp

Filesize
176KB

Download
memory/4468-134-0x00007FF8F8520000-0x00007FF8F8FE1000-memory.dmp

Filesize
10.8MB

Download
memory/4468-135-0x000000001BBD0000-0x000000001BBD2000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing