asyncrat | 7867c54c88c7ff0ae6687c0f6ab6c903e1b42ac9aaa17744c85da6f9a824d5f9

General

Target

Summer_richiesta_di_preventivo_070820.exe
Size

248KB
MD5

5cc4ae3ea66ca80fa701b8e1ff5b8793
SHA1

148d80f999f069a5fd027eabfc9eae7d08f8e39b
SHA256

427254247932e569d3f40be5ce149266b0a87ed13756ab558818dae5dcabb44a
SHA512

18416940b4983137e22cc52a473cd73217307981b0ce7705180e5cd5c3e60ba8b17d2fddf1f0547668c6b1c385e6e01ad6bfc1fd4836dd41e2941b21bd2a7706

Score

10^/10

asyncrat god's mercy rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

GOD'S MERCY

Mutex

AsyncMutex_6SI8OkPnk

Attributes

delay
3
install
false
install_folder
%AppData%
pastebin_config
https://pastebin.com/raw/reQxa5Ah

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
rat asyncrat

Async RAT payload 6 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1800-64-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat
behavioral1/memory/1800-65-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat
behavioral1/memory/1800-67-0x000000000040C76E-mapping.dmp	asyncrat
behavioral1/memory/1800-66-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat
behavioral1/memory/1800-69-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat
behavioral1/memory/1800-71-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Suspicious use of SetThreadContext 1 IoCs

Processes:

Summer_richiesta_di_preventivo_070820.exe

description pid process target process

PID 1092 set thread context of 1800 1092 Summer_richiesta_di_preventivo_070820.exe MSBuild.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

2032 schtasks.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

Summer_richiesta_di_preventivo_070820.exe

pid process

1092 Summer_richiesta_di_preventivo_070820.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Summer_richiesta_di_preventivo_070820.exeMSBuild.exe

description pid process

Token: SeDebugPrivilege 1092 Summer_richiesta_di_preventivo_070820.exe
Token: SeDebugPrivilege 1800 MSBuild.exe

description	pid	process	target process
PID 1092 set thread context of 1800	1092	Summer_richiesta_di_preventivo_070820.exe	MSBuild.exe

pid	process
2032	schtasks.exe

pid	process
1092	Summer_richiesta_di_preventivo_070820.exe

description	pid	process
Token: SeDebugPrivilege	1092	Summer_richiesta_di_preventivo_070820.exe
Token: SeDebugPrivilege	1800	MSBuild.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

Summer_richiesta_di_preventivo_070820.exe

description	pid	process	target process
PID 1092 wrote to memory of 2032	1092	Summer_richiesta_di_preventivo_070820.exe	schtasks.exe
PID 1092 wrote to memory of 2032	1092	Summer_richiesta_di_preventivo_070820.exe	schtasks.exe
PID 1092 wrote to memory of 2032	1092	Summer_richiesta_di_preventivo_070820.exe	schtasks.exe
PID 1092 wrote to memory of 2032	1092	Summer_richiesta_di_preventivo_070820.exe	schtasks.exe
PID 1092 wrote to memory of 1800	1092	Summer_richiesta_di_preventivo_070820.exe	MSBuild.exe
PID 1092 wrote to memory of 1800	1092	Summer_richiesta_di_preventivo_070820.exe	MSBuild.exe
PID 1092 wrote to memory of 1800	1092	Summer_richiesta_di_preventivo_070820.exe	MSBuild.exe
PID 1092 wrote to memory of 1800	1092	Summer_richiesta_di_preventivo_070820.exe	MSBuild.exe
PID 1092 wrote to memory of 1800	1092	Summer_richiesta_di_preventivo_070820.exe	MSBuild.exe
PID 1092 wrote to memory of 1800	1092	Summer_richiesta_di_preventivo_070820.exe	MSBuild.exe
PID 1092 wrote to memory of 1800	1092	Summer_richiesta_di_preventivo_070820.exe	MSBuild.exe
PID 1092 wrote to memory of 1800	1092	Summer_richiesta_di_preventivo_070820.exe	MSBuild.exe
PID 1092 wrote to memory of 1800	1092	Summer_richiesta_di_preventivo_070820.exe	MSBuild.exe

C:\Users\Admin\AppData\Local\Temp\Summer_richiesta_di_preventivo_070820.exe
"C:\Users\Admin\AppData\Local\Temp\Summer_richiesta_di_preventivo_070820.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1092

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TJDZgUtGKUBaeo" /XML "C:\Users\Admin\AppData\Local\Temp\tmp3E8.tmp"
2⤵
- Creates scheduled task(s)
PID:2032

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1800

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1

T1102

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp3E8.tmp
Filesize
1KB

MD5
0a62c3f832879e5b11380a314f46a3d3

SHA1
a6382e94a411aefd6e574255d400ea3e33d3d6cb

SHA256
642e578ddad716e4b1d6d83460e8692f52b46f630d43d945c1387cfbd378d1dd

SHA512
5b6d661af5ff67931dbb1cb3f1fa0753f4d893cf347f170fa35b1b38ad8c8280771dbe5b9e5cd5726e55f02e05eb7293da54414ecb753f4aab26ff0d222c3971

Download Submit
memory/1092-57-0x0000000000C10000-0x0000000000C3A000-memory.dmp

Filesize
168KB

Download
memory/1092-55-0x0000000076571000-0x0000000076573000-memory.dmp

Filesize
8KB

Download
memory/1092-54-0x00000000011B0000-0x00000000011F2000-memory.dmp

Filesize
264KB

Download
memory/1092-58-0x0000000000730000-0x0000000000742000-memory.dmp

Filesize
72KB

Download
memory/1092-56-0x0000000000360000-0x000000000036A000-memory.dmp

Filesize
40KB

Download
memory/1800-67-0x000000000040C76E-mapping.dmp

Download
memory/1800-61-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1800-62-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1800-64-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1800-65-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1800-66-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1800-69-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1800-71-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2032-59-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads