asyncrat | a276dff534de2b72c38b63a7ef277fb0d5744b8bf7dce88a98631b4d6dc8813a

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
11/05/2022, 12:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
latam5.ps1
Size 419KB
Sample220511-pp2emsbbck
SHA256 a276dff534de2b72c38b63a7ef277fb0d5744b8bf7dce88a98631b4d6dc8813a
MD5 89bcb51ba7ebc4102c67b7046d2c642e
SHA1 ec28c9df00a683bc6df238e0dc978f7b6b45e3e9
SHA512 c3160824470b15778d4619ab5e90d3da6c96f936c8db509b5f9137ccdd885adb3971c83a2addd5fb19e8d05f9e1600630bf97ea3a0ee6d40120dc4042544a48b
MD5 SHA1 SHA512

Score

10^/10

asyncrat (___@_@___)rat suricata

Malware Config

Extracted

Family

asyncrat

Version

| Edit 3LOSH RAT

Botnet

(___@_@___)

warzonecdt.duckdns.org:7707
warzonecdt.duckdns.org:4404
warzonecdt.duckdns.org:5505
warzonecdt.duckdns.org:3303
warzonecdt.duckdns.org:2222
cdtpitbull.hopto.org:7707
cdtpitbull.hopto.org:4404
cdtpitbull.hopto.org:5505
cdtpitbull.hopto.org:3303
cdtpitbull.hopto.org:2222
chromedata.accesscam.org:7707
chromedata.accesscam.org:4404
chromedata.accesscam.org:5505
chromedata.accesscam.org:3303
chromedata.accesscam.org:2222
datacontrol.ddns.net:7707
datacontrol.ddns.net:4404
datacontrol.ddns.net:5505
datacontrol.ddns.net:3303
datacontrol.ddns.net:2222

Mutex

AsyncMutex_6SI8OkPnk

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
rat asyncrat
suricata: ET MALWARE Generic AsyncRAT Style SSL Cert
suricata: ET MALWARE Generic AsyncRAT Style SSL Cert
suricata

Async RAT payload 2 IoCs

rat

resource	yara_rule
behavioral2/memory/1740-145-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat
behavioral2/memory/1740-146-0x000000000040DC5E-mapping.dmp	asyncrat

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2688 set thread context of 4272	2688	powershell.exe	84
PID 2688 set thread context of 1740	2688	powershell.exe	90

Suspicious behavior: EnumeratesProcesses 23 IoCs

pid	Process
2688	powershell.exe
2688	powershell.exe
2688	powershell.exe
2688	powershell.exe
4272	aspnet_regbrowsers.exe
4272	aspnet_regbrowsers.exe
4272	aspnet_regbrowsers.exe
4272	aspnet_regbrowsers.exe
4272	aspnet_regbrowsers.exe
4272	aspnet_regbrowsers.exe
4272	aspnet_regbrowsers.exe
4272	aspnet_regbrowsers.exe
4272	aspnet_regbrowsers.exe
4272	aspnet_regbrowsers.exe
4272	aspnet_regbrowsers.exe
4272	aspnet_regbrowsers.exe
4272	aspnet_regbrowsers.exe
4272	aspnet_regbrowsers.exe
4272	aspnet_regbrowsers.exe
4272	aspnet_regbrowsers.exe
4272	aspnet_regbrowsers.exe
4272	aspnet_regbrowsers.exe
4272	aspnet_regbrowsers.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2688	powershell.exe
Token: SeDebugPrivilege	4272	aspnet_regbrowsers.exe
Token: SeDebugPrivilege	1740	aspnet_compiler.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2688 wrote to memory of 4272	2688	powershell.exe	84
PID 2688 wrote to memory of 4272	2688	powershell.exe	84
PID 2688 wrote to memory of 4272	2688	powershell.exe	84
PID 2688 wrote to memory of 4272	2688	powershell.exe	84
PID 2688 wrote to memory of 4272	2688	powershell.exe	84
PID 2688 wrote to memory of 4272	2688	powershell.exe	84
PID 2688 wrote to memory of 4272	2688	powershell.exe	84
PID 2688 wrote to memory of 4272	2688	powershell.exe	84
PID 2688 wrote to memory of 2244	2688	powershell.exe	85
PID 2688 wrote to memory of 2244	2688	powershell.exe	85
PID 2244 wrote to memory of 4356	2244	csc.exe	86
PID 2244 wrote to memory of 4356	2244	csc.exe	86
PID 2688 wrote to memory of 1740	2688	powershell.exe	90
PID 2688 wrote to memory of 1740	2688	powershell.exe	90
PID 2688 wrote to memory of 1740	2688	powershell.exe	90
PID 2688 wrote to memory of 1740	2688	powershell.exe	90
PID 2688 wrote to memory of 1740	2688	powershell.exe	90
PID 2688 wrote to memory of 1740	2688	powershell.exe	90
PID 2688 wrote to memory of 1740	2688	powershell.exe	90
PID 2688 wrote to memory of 1740	2688	powershell.exe	90

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\latam5.ps1
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2688
- C:\Windows\Microsoft.NEt\Framework\v4.0.30319\aspnet_regbrowsers.exe
  "C:\Windows\Microsoft.NEt\Framework\v4.0.30319\aspnet_regbrowsers.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4272
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\c3lgv41y\c3lgv41y.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2244
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESBEC1.tmp" "c:\Users\Admin\AppData\Local\Temp\c3lgv41y\CSCDFCF9C998AD542CEA21D607D112A9DB.TMP"
    3⤵
    PID:4356
- C:\Windows\Microsoft.NEt\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NEt\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1740

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

RESBEC1.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESBEC1.tmp
Size 1KB
SHA256 d2704f065edbc8a043197d64efd343af29f0c34b008771fa0b1bb392740e8131
MD5 eb3c61132d1690590ab6c4f9267c99af
SHA1 040be16132a83169d0e13697a97141bbf247e71e
SHA512 d8133d1c761ab7c43decf0db53019e3c2cb0dce53626e52b7b2090479cbde6f805b8de8b05e75919bf371ca6b37dfa2f92956e37b932dba73e29c723c1eab803
MD5 SHA1 SHA512

Submit Download

c3lgv41y.dll

Path C:\Users\Admin\AppData\Local\Temp\c3lgv41y\c3lgv41y.dll
Size 3KB
SHA256 791e20617c9c4f995845975ad889987f4a806fd64e5d1e74eb54fb7a1745c7aa
MD5 024a19436d060b5f23abadd130beda78
SHA1 96b6d1e8bed39d55bbcfc03989bdf835d4879e64
SHA512 5f42e50f9e7d93be39a291ca3ce4eb9b48ad6c31e707c9d9a43a1304d0dbba32981a7e884d2a6cfdbd5c0dfdc4fd2f11c15e7a141ddc736f2ded847e2c530704
MD5 SHA1 SHA512

Submit Download

CSCDFCF9C998AD542CEA21D607D112A9DB.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\c3lgv41y\CSCDFCF9C998AD542CEA21D607D112A9DB.TMP
Size 652B
SHA256 9b0cc1139db8e3c64bf2ccc27bdddc11333ae242cfdc641512e621e63a9e3156
MD5 b8bce75307cee45fc2b8a39ab77b084f
SHA1 e65084d1588f602b0a1dc80e337d86db70f0db67
SHA512 ca6ec4ecbcaa1e46e58729bfe3b6d84182d61f6e1ba139903c260e71636bb5ff250932a1091fd3be8910e225fbc2e068cd356dd20f9e85c5546819bd19217328
MD5 SHA1 SHA512

Submit Download

c3lgv41y.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\c3lgv41y\c3lgv41y.0.cs
Size 203B
SHA256 5473b5550a65171ee7d5977d673c97e41e9ec16fad10ec5ab8aa3b7c798577a6
MD5 171a88ab4fad87acfd2e5032eb0c6113
SHA1 754de0e7656c558d335710fc41cbf196d39c1a19
SHA512 87ef6ac53a00d21f2df4d81ec5956861a4b539b10f5855345aa068c0d9d971f3329477e485471eb40b9eeea59f01fd3c42c4ab2f25e71d825cbf3586be0206b8
MD5 SHA1 SHA512

Submit Download

c3lgv41y.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\c3lgv41y\c3lgv41y.cmdline
Size 369B
SHA256 fdde6594e64f896c13f7d3580b6ca6d2db7e5090926f547e930ac8f01b3a0dcf
MD5 57a77c264df48333313e4a2f1ca30383
SHA1 b912a8ce3ba2199bb2b75361b9f39ca1804d4a03
SHA512 e0367f69675475e11a3750a846ce1cfb33dae797825f8ec9e526464b062cf73481e051c17488a02019ed6912187ec8ea8b0f2ac34be616d00fb7bc0698830ffc
MD5 SHA1 SHA512

Submit Download

memory/1740-145-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/1740-147-0x0000000006060000-0x00000000060C6000-memory.dmp

Download

memory/2688-130-0x0000026177330000-0x0000026177352000-memory.dmp

Download

memory/2688-131-0x00007FFE7FFD0000-0x00007FFE80A91000-memory.dmp

Download

memory/4272-132-0x0000000000400000-0x000000000040A000-memory.dmp

Download

memory/4272-142-0x0000000005000000-0x0000000005092000-memory.dmp

Download

memory/4272-143-0x00000000050A0000-0x000000000513C000-memory.dmp

Download

memory/4272-144-0x0000000004FB0000-0x0000000004FBA000-memory.dmp

Download

memory/4272-141-0x0000000005510000-0x0000000005AB4000-memory.dmp

Download

memory/4272-148-0x0000000004F60000-0x0000000005504000-memory.dmp

Download

memory/4272-149-0x0000000000DB0000-0x0000000000DB4000-memory.dmp

Download

memory/4272-150-0x0000000000DB4000-0x0000000000DB7000-memory.dmp

Download