asyncrat | fb657035d6a3fcee85cb88e47418bda8c453ac623aad138fc2aea94a258e6607

Analysis

max time kernel
177s
max time network
198s
platform
windows7_x64
resource
win7-20220414-en
submitted
02-05-2022 11:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fb657035d6a3fcee85cb88e47418bda8c453ac623aad138fc2aea94a258e6607.exe
Size

390KB
MD5

2777f662fe6d094fb8726aae2a6b39a6
SHA1

a643a95a7f45a612f45c4d398630b8b641b49bb7
SHA256

fb657035d6a3fcee85cb88e47418bda8c453ac623aad138fc2aea94a258e6607
SHA512

d2974a64b8a780f099f5bc67d03a7d90a8824f01b12be7f3c1803c7b68772c2b1622b3864578d2fa4e636a1154ff22f1a1f821a2330bca5daa99591e962ab23e

Score

10^/10

asyncrat revengerat default nyancatrevenge rat trojan

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

Default

travazap.duckdns.org:4040

Mutex

AsyncMutex_6SI8OkPnk

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Extracted

Family

revengerat

Botnet

NyanCatRevenge

travazap2.duckdns.org:2021

Mutex

3ddc53446da

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
rat asyncrat
RevengeRAT
Remote-access trojan with a wide range of capabilities.
trojan revengerat

Async RAT payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1128-75-0x0000000000360000-0x0000000000372000-memory.dmp	asyncrat

Executes dropped EXE 2 IoCs

Processes:

Microsoft Network Realtime Inspection Service.EXEMicrosoft Windows Search Protocol Host.EXE

pid process

1128 Microsoft Network Realtime Inspection Service.EXE
1988 Microsoft Windows Search Protocol Host.EXE

pid	process
1128	Microsoft Network Realtime Inspection Service.EXE
1988	Microsoft Windows Search Protocol Host.EXE

Drops startup file 4 IoCs

Processes:

Microsoft Network Realtime Inspection Service.EXEMicrosoft Windows Search Protocol Host.EXE

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Network Realtime Inspection Service.EXE	Microsoft Network Realtime Inspection Service.EXE
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Network Realtime Inspection Service.EXE	Microsoft Network Realtime Inspection Service.EXE
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Windows Search Protocol Host.EXE	Microsoft Windows Search Protocol Host.EXE
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Windows Search Protocol Host.EXE	Microsoft Windows Search Protocol Host.EXE

Loads dropped DLL 8 IoCs

Processes:

fb657035d6a3fcee85cb88e47418bda8c453ac623aad138fc2aea94a258e6607.exe

pid	process
1944	fb657035d6a3fcee85cb88e47418bda8c453ac623aad138fc2aea94a258e6607.exe
1944	fb657035d6a3fcee85cb88e47418bda8c453ac623aad138fc2aea94a258e6607.exe
1944	fb657035d6a3fcee85cb88e47418bda8c453ac623aad138fc2aea94a258e6607.exe
1944	fb657035d6a3fcee85cb88e47418bda8c453ac623aad138fc2aea94a258e6607.exe
1944	fb657035d6a3fcee85cb88e47418bda8c453ac623aad138fc2aea94a258e6607.exe
1944	fb657035d6a3fcee85cb88e47418bda8c453ac623aad138fc2aea94a258e6607.exe
1944	fb657035d6a3fcee85cb88e47418bda8c453ac623aad138fc2aea94a258e6607.exe
1944	fb657035d6a3fcee85cb88e47418bda8c453ac623aad138fc2aea94a258e6607.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exe

pid process

652 schtasks.exe
1524 schtasks.exe

pid	process
652	schtasks.exe
1524	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

Microsoft Windows Search Protocol Host.EXEMicrosoft Network Realtime Inspection Service.EXE

pid	process
1988	Microsoft Windows Search Protocol Host.EXE
1128	Microsoft Network Realtime Inspection Service.EXE
1988	Microsoft Windows Search Protocol Host.EXE
1128	Microsoft Network Realtime Inspection Service.EXE
1128	Microsoft Network Realtime Inspection Service.EXE
1128	Microsoft Network Realtime Inspection Service.EXE
1988	Microsoft Windows Search Protocol Host.EXE
1988	Microsoft Windows Search Protocol Host.EXE
1128	Microsoft Network Realtime Inspection Service.EXE
1988	Microsoft Windows Search Protocol Host.EXE
1988	Microsoft Windows Search Protocol Host.EXE
1128	Microsoft Network Realtime Inspection Service.EXE
1128	Microsoft Network Realtime Inspection Service.EXE
1988	Microsoft Windows Search Protocol Host.EXE
1128	Microsoft Network Realtime Inspection Service.EXE
1988	Microsoft Windows Search Protocol Host.EXE
1988	Microsoft Windows Search Protocol Host.EXE
1988	Microsoft Windows Search Protocol Host.EXE
1988	Microsoft Windows Search Protocol Host.EXE
1988	Microsoft Windows Search Protocol Host.EXE
1988	Microsoft Windows Search Protocol Host.EXE
1988	Microsoft Windows Search Protocol Host.EXE
1128	Microsoft Network Realtime Inspection Service.EXE
1128	Microsoft Network Realtime Inspection Service.EXE
1988	Microsoft Windows Search Protocol Host.EXE
1988	Microsoft Windows Search Protocol Host.EXE
1128	Microsoft Network Realtime Inspection Service.EXE
1128	Microsoft Network Realtime Inspection Service.EXE
1988	Microsoft Windows Search Protocol Host.EXE
1988	Microsoft Windows Search Protocol Host.EXE
1128	Microsoft Network Realtime Inspection Service.EXE
1128	Microsoft Network Realtime Inspection Service.EXE
1988	Microsoft Windows Search Protocol Host.EXE
1988	Microsoft Windows Search Protocol Host.EXE
1128	Microsoft Network Realtime Inspection Service.EXE
1128	Microsoft Network Realtime Inspection Service.EXE
1988	Microsoft Windows Search Protocol Host.EXE
1988	Microsoft Windows Search Protocol Host.EXE
1128	Microsoft Network Realtime Inspection Service.EXE
1128	Microsoft Network Realtime Inspection Service.EXE
1988	Microsoft Windows Search Protocol Host.EXE
1988	Microsoft Windows Search Protocol Host.EXE
1128	Microsoft Network Realtime Inspection Service.EXE
1128	Microsoft Network Realtime Inspection Service.EXE
1988	Microsoft Windows Search Protocol Host.EXE
1988	Microsoft Windows Search Protocol Host.EXE
1128	Microsoft Network Realtime Inspection Service.EXE
1128	Microsoft Network Realtime Inspection Service.EXE
1988	Microsoft Windows Search Protocol Host.EXE
1988	Microsoft Windows Search Protocol Host.EXE
1128	Microsoft Network Realtime Inspection Service.EXE
1128	Microsoft Network Realtime Inspection Service.EXE
1988	Microsoft Windows Search Protocol Host.EXE
1988	Microsoft Windows Search Protocol Host.EXE
1128	Microsoft Network Realtime Inspection Service.EXE
1128	Microsoft Network Realtime Inspection Service.EXE
1988	Microsoft Windows Search Protocol Host.EXE
1988	Microsoft Windows Search Protocol Host.EXE
1128	Microsoft Network Realtime Inspection Service.EXE
1128	Microsoft Network Realtime Inspection Service.EXE
1988	Microsoft Windows Search Protocol Host.EXE
1988	Microsoft Windows Search Protocol Host.EXE
1128	Microsoft Network Realtime Inspection Service.EXE
1128	Microsoft Network Realtime Inspection Service.EXE

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

Microsoft Network Realtime Inspection Service.EXEMicrosoft Windows Search Protocol Host.EXE

description	pid	process
Token: SeDebugPrivilege	1128	Microsoft Network Realtime Inspection Service.EXE
Token: SeDebugPrivilege	1988	Microsoft Windows Search Protocol Host.EXE
Token: 33	1128	Microsoft Network Realtime Inspection Service.EXE
Token: SeIncBasePriorityPrivilege	1128	Microsoft Network Realtime Inspection Service.EXE
Token: 33	1988	Microsoft Windows Search Protocol Host.EXE
Token: SeIncBasePriorityPrivilege	1988	Microsoft Windows Search Protocol Host.EXE

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

fb657035d6a3fcee85cb88e47418bda8c453ac623aad138fc2aea94a258e6607.exeMicrosoft Network Realtime Inspection Service.EXEMicrosoft Windows Search Protocol Host.EXE

description	pid	process	target process
PID 1944 wrote to memory of 1128	1944	fb657035d6a3fcee85cb88e47418bda8c453ac623aad138fc2aea94a258e6607.exe	Microsoft Network Realtime Inspection Service.EXE
PID 1944 wrote to memory of 1128	1944	fb657035d6a3fcee85cb88e47418bda8c453ac623aad138fc2aea94a258e6607.exe	Microsoft Network Realtime Inspection Service.EXE
PID 1944 wrote to memory of 1128	1944	fb657035d6a3fcee85cb88e47418bda8c453ac623aad138fc2aea94a258e6607.exe	Microsoft Network Realtime Inspection Service.EXE
PID 1944 wrote to memory of 1128	1944	fb657035d6a3fcee85cb88e47418bda8c453ac623aad138fc2aea94a258e6607.exe	Microsoft Network Realtime Inspection Service.EXE
PID 1944 wrote to memory of 1988	1944	fb657035d6a3fcee85cb88e47418bda8c453ac623aad138fc2aea94a258e6607.exe	Microsoft Windows Search Protocol Host.EXE
PID 1944 wrote to memory of 1988	1944	fb657035d6a3fcee85cb88e47418bda8c453ac623aad138fc2aea94a258e6607.exe	Microsoft Windows Search Protocol Host.EXE
PID 1944 wrote to memory of 1988	1944	fb657035d6a3fcee85cb88e47418bda8c453ac623aad138fc2aea94a258e6607.exe	Microsoft Windows Search Protocol Host.EXE
PID 1944 wrote to memory of 1988	1944	fb657035d6a3fcee85cb88e47418bda8c453ac623aad138fc2aea94a258e6607.exe	Microsoft Windows Search Protocol Host.EXE
PID 1128 wrote to memory of 652	1128	Microsoft Network Realtime Inspection Service.EXE	schtasks.exe
PID 1128 wrote to memory of 652	1128	Microsoft Network Realtime Inspection Service.EXE	schtasks.exe
PID 1128 wrote to memory of 652	1128	Microsoft Network Realtime Inspection Service.EXE	schtasks.exe
PID 1128 wrote to memory of 652	1128	Microsoft Network Realtime Inspection Service.EXE	schtasks.exe
PID 1988 wrote to memory of 1524	1988	Microsoft Windows Search Protocol Host.EXE	schtasks.exe
PID 1988 wrote to memory of 1524	1988	Microsoft Windows Search Protocol Host.EXE	schtasks.exe
PID 1988 wrote to memory of 1524	1988	Microsoft Windows Search Protocol Host.EXE	schtasks.exe
PID 1988 wrote to memory of 1524	1988	Microsoft Windows Search Protocol Host.EXE	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\fb657035d6a3fcee85cb88e47418bda8c453ac623aad138fc2aea94a258e6607.exe
"C:\Users\Admin\AppData\Local\Temp\fb657035d6a3fcee85cb88e47418bda8c453ac623aad138fc2aea94a258e6607.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1944

C:\Users\Admin\AppData\Local\Temp\Microsoft Network Realtime Inspection Service.EXE
"C:\Users\Admin\AppData\Local\Temp\Microsoft Network Realtime Inspection Service.EXE"
2⤵
- Executes dropped EXE
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1128

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /create /sc minute /mo 1 /tn "penis" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup/Microsoft Network Realtime Inspection Service.EXE"
3⤵
- Creates scheduled task(s)
PID:652

C:\Users\Admin\AppData\Local\Temp\Microsoft Windows Search Protocol Host.EXE
"C:\Users\Admin\AppData\Local\Temp\Microsoft Windows Search Protocol Host.EXE"
2⤵
- Executes dropped EXE
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1988

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /create /sc minute /mo 1 /tn "penis" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup/Microsoft Windows Search Protocol Host.EXE"
3⤵
- Creates scheduled task(s)
PID:1524

C:\Windows\system32\taskeng.exe
taskeng.exe {4359FE7F-A897-4AD0-A12A-AA8DDB372709} S-1-5-21-2277218442-1199762539-2004043321-1000:AUVQQRRF\Admin:Interactive:[1]
1⤵
PID:520

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Microsoft Network Realtime Inspection Service.EXE
Filesize
116KB

MD5
0b0822d827fa93d7f24853236b179d2a

SHA1
caabce7347a0f3671e7fc8445e72e9f4c6c69d09

SHA256
22f55646c51222195bb4f082bf75dd53526e49dbb25413e20809e8190f35b231

SHA512
0b74b3c46a1ae982282a22f1974f52f5d615f2650a294d2662fe05cf9ff8949f7f422426772517b1b51e14a347e46dba3d4d8581f03e6cf043c29efe0f0561e7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft Network Realtime Inspection Service.exe
Filesize
116KB

MD5
0b0822d827fa93d7f24853236b179d2a

SHA1
caabce7347a0f3671e7fc8445e72e9f4c6c69d09

SHA256
22f55646c51222195bb4f082bf75dd53526e49dbb25413e20809e8190f35b231

SHA512
0b74b3c46a1ae982282a22f1974f52f5d615f2650a294d2662fe05cf9ff8949f7f422426772517b1b51e14a347e46dba3d4d8581f03e6cf043c29efe0f0561e7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft Windows Search Protocol Host.EXE
Filesize
74KB

MD5
93d98128d44836c7b02c072ad97909b5

SHA1
2ff18c31d28022b6f4bab69e82a130c03fbdc32c

SHA256
3b72fd533bb38633959f0ca2f60774a60b302b3d3455709608b087e30307b773

SHA512
963fa94059e9937195225574d7917937a2313705b7dd9625e9f1045379ba65e0525d27a8835073e608782db16d0c99072513e13978e9c943922fee3298dae0ca

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft Windows Search Protocol Host.exe
Filesize
74KB

MD5
93d98128d44836c7b02c072ad97909b5

SHA1
2ff18c31d28022b6f4bab69e82a130c03fbdc32c

SHA256
3b72fd533bb38633959f0ca2f60774a60b302b3d3455709608b087e30307b773

SHA512
963fa94059e9937195225574d7917937a2313705b7dd9625e9f1045379ba65e0525d27a8835073e608782db16d0c99072513e13978e9c943922fee3298dae0ca

Download Submit
\Users\Admin\AppData\Local\Temp\Microsoft Network Realtime Inspection Service.exe
Filesize
116KB

MD5
0b0822d827fa93d7f24853236b179d2a

SHA1
caabce7347a0f3671e7fc8445e72e9f4c6c69d09

SHA256
22f55646c51222195bb4f082bf75dd53526e49dbb25413e20809e8190f35b231

SHA512
0b74b3c46a1ae982282a22f1974f52f5d615f2650a294d2662fe05cf9ff8949f7f422426772517b1b51e14a347e46dba3d4d8581f03e6cf043c29efe0f0561e7

Download Submit
\Users\Admin\AppData\Local\Temp\Microsoft Network Realtime Inspection Service.exe
Filesize
116KB

MD5
0b0822d827fa93d7f24853236b179d2a

SHA1
caabce7347a0f3671e7fc8445e72e9f4c6c69d09

SHA256
22f55646c51222195bb4f082bf75dd53526e49dbb25413e20809e8190f35b231

SHA512
0b74b3c46a1ae982282a22f1974f52f5d615f2650a294d2662fe05cf9ff8949f7f422426772517b1b51e14a347e46dba3d4d8581f03e6cf043c29efe0f0561e7

Download Submit
\Users\Admin\AppData\Local\Temp\Microsoft Network Realtime Inspection Service.exe
Filesize
116KB

MD5
0b0822d827fa93d7f24853236b179d2a

SHA1
caabce7347a0f3671e7fc8445e72e9f4c6c69d09

SHA256
22f55646c51222195bb4f082bf75dd53526e49dbb25413e20809e8190f35b231

SHA512
0b74b3c46a1ae982282a22f1974f52f5d615f2650a294d2662fe05cf9ff8949f7f422426772517b1b51e14a347e46dba3d4d8581f03e6cf043c29efe0f0561e7

Download Submit
\Users\Admin\AppData\Local\Temp\Microsoft Network Realtime Inspection Service.exe
Filesize
116KB

MD5
0b0822d827fa93d7f24853236b179d2a

SHA1
caabce7347a0f3671e7fc8445e72e9f4c6c69d09

SHA256
22f55646c51222195bb4f082bf75dd53526e49dbb25413e20809e8190f35b231

SHA512
0b74b3c46a1ae982282a22f1974f52f5d615f2650a294d2662fe05cf9ff8949f7f422426772517b1b51e14a347e46dba3d4d8581f03e6cf043c29efe0f0561e7

Download Submit
\Users\Admin\AppData\Local\Temp\Microsoft Windows Search Protocol Host.exe
Filesize
74KB

MD5
93d98128d44836c7b02c072ad97909b5

SHA1
2ff18c31d28022b6f4bab69e82a130c03fbdc32c

SHA256
3b72fd533bb38633959f0ca2f60774a60b302b3d3455709608b087e30307b773

SHA512
963fa94059e9937195225574d7917937a2313705b7dd9625e9f1045379ba65e0525d27a8835073e608782db16d0c99072513e13978e9c943922fee3298dae0ca

Download Submit
\Users\Admin\AppData\Local\Temp\Microsoft Windows Search Protocol Host.exe
Filesize
74KB

MD5
93d98128d44836c7b02c072ad97909b5

SHA1
2ff18c31d28022b6f4bab69e82a130c03fbdc32c

SHA256
3b72fd533bb38633959f0ca2f60774a60b302b3d3455709608b087e30307b773

SHA512
963fa94059e9937195225574d7917937a2313705b7dd9625e9f1045379ba65e0525d27a8835073e608782db16d0c99072513e13978e9c943922fee3298dae0ca

Download Submit
\Users\Admin\AppData\Local\Temp\Microsoft Windows Search Protocol Host.exe
Filesize
74KB

MD5
93d98128d44836c7b02c072ad97909b5

SHA1
2ff18c31d28022b6f4bab69e82a130c03fbdc32c

SHA256
3b72fd533bb38633959f0ca2f60774a60b302b3d3455709608b087e30307b773

SHA512
963fa94059e9937195225574d7917937a2313705b7dd9625e9f1045379ba65e0525d27a8835073e608782db16d0c99072513e13978e9c943922fee3298dae0ca

Download Submit
\Users\Admin\AppData\Local\Temp\Microsoft Windows Search Protocol Host.exe
Filesize
74KB

MD5
93d98128d44836c7b02c072ad97909b5

SHA1
2ff18c31d28022b6f4bab69e82a130c03fbdc32c

SHA256
3b72fd533bb38633959f0ca2f60774a60b302b3d3455709608b087e30307b773

SHA512
963fa94059e9937195225574d7917937a2313705b7dd9625e9f1045379ba65e0525d27a8835073e608782db16d0c99072513e13978e9c943922fee3298dae0ca

Download Submit
memory/652-73-0x0000000000000000-mapping.dmp

Download
memory/1128-59-0x0000000000000000-mapping.dmp

Download
memory/1128-70-0x0000000000930000-0x0000000000944000-memory.dmp

Filesize
80KB

Download
memory/1128-75-0x0000000000360000-0x0000000000372000-memory.dmp

Filesize
72KB

Download
memory/1128-77-0x0000000000445000-0x0000000000456000-memory.dmp

Filesize
68KB

Download
memory/1524-74-0x0000000000000000-mapping.dmp

Download
memory/1944-54-0x00000000765C1000-0x00000000765C3000-memory.dmp

Filesize
8KB

Download
memory/1988-66-0x0000000000000000-mapping.dmp

Download
memory/1988-69-0x0000000000DA0000-0x0000000000DB4000-memory.dmp

Filesize
80KB

Download
memory/1988-76-0x0000000000980000-0x000000000098A000-memory.dmp

Filesize
40KB

Download
memory/1988-78-0x00000000047E5000-0x00000000047F6000-memory.dmp

Filesize
68KB

Download