asyncrat | a25384a50bece6cefbc853d787d65ab8688bca6d30da116fe16e6b1a3f6095eb

General

Target

PO_45_13.scr
Size

479KB
MD5

50c3085963b5fdc5a9c00d10d1b4f960
SHA1

6529e11136560ad369d1b443a6e60f4e1f85c71e
SHA256

2c8c5c5e5990da4a2af218cfece6afda3f4830be6605b9767adbfbde2e5cd276
SHA512

36318d8dd2f4cd844fd8e1c47356d98c2af9df85646009b8d1cce97de834740f703a1770ed8770261c42cfe52eda5f52a43a7379f577754c1ea2ec723afbe837

Score

10^/10

asyncrat default persistence rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

Default

C2

206.123.129.103:5456

Mutex

AsyncMutex_6SI8OkPnk

Attributes

delay
3
install
false
install_file
windows.exe
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
rat asyncrat

Async RAT payload 4 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/4776-130-0x00000000003C0000-0x000000000043E000-memory.dmp	asyncrat
C:\Users\Admin\Music\Googles.exe	asyncrat
C:\Users\Admin\Music\Googles.exe	asyncrat
behavioral2/memory/4984-144-0x0000000000400000-0x0000000000428000-memory.dmp	asyncrat

Executes dropped EXE 2 IoCs

Processes:

Googles.exeInstallUtil.exe

pid process

308 Googles.exe
4984 InstallUtil.exe

pid	process
308	Googles.exe
4984	InstallUtil.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

PO_45_13.scr

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation	PO_45_13.scr

Loads dropped DLL 2 IoCs

Processes:

PO_45_13.scrGoogles.exe

pid process

4776 PO_45_13.scr
308 Googles.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

reg.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Windows\CurrentVersion\Run	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Googles = "C:\\Windows\\system32\\pcalua.exe -a C:\\Users\\Admin\\Music\\Googles.exe"	reg.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

Googles.exe

description pid process target process

PID 308 set thread context of 4984 308 Googles.exe InstallUtil.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	pid	process	target process
PID 308 set thread context of 4984	308	Googles.exe	InstallUtil.exe

Suspicious behavior: EnumeratesProcesses 25 IoCs

Processes:

PO_45_13.scrGoogles.exe

pid	process
4776	PO_45_13.scr
4776	PO_45_13.scr
4776	PO_45_13.scr
4776	PO_45_13.scr
4776	PO_45_13.scr
4776	PO_45_13.scr
4776	PO_45_13.scr
4776	PO_45_13.scr
4776	PO_45_13.scr
4776	PO_45_13.scr
4776	PO_45_13.scr
4776	PO_45_13.scr
4776	PO_45_13.scr
4776	PO_45_13.scr
4776	PO_45_13.scr
4776	PO_45_13.scr
4776	PO_45_13.scr
4776	PO_45_13.scr
4776	PO_45_13.scr
4776	PO_45_13.scr
4776	PO_45_13.scr
4776	PO_45_13.scr
308	Googles.exe
308	Googles.exe
308	Googles.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

PO_45_13.scrGoogles.exe

description pid process

Token: SeDebugPrivilege 4776 PO_45_13.scr
Token: SeDebugPrivilege 308 Googles.exe

description	pid	process
Token: SeDebugPrivilege	4776	PO_45_13.scr
Token: SeDebugPrivilege	308	Googles.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

PO_45_13.scrcmd.exeGoogles.exe

description	pid	process	target process
PID 4776 wrote to memory of 2180	4776	PO_45_13.scr	cmd.exe
PID 4776 wrote to memory of 2180	4776	PO_45_13.scr	cmd.exe
PID 4776 wrote to memory of 2180	4776	PO_45_13.scr	cmd.exe
PID 2180 wrote to memory of 4988	2180	cmd.exe	reg.exe
PID 2180 wrote to memory of 4988	2180	cmd.exe	reg.exe
PID 2180 wrote to memory of 4988	2180	cmd.exe	reg.exe
PID 4776 wrote to memory of 308	4776	PO_45_13.scr	Googles.exe
PID 4776 wrote to memory of 308	4776	PO_45_13.scr	Googles.exe
PID 4776 wrote to memory of 308	4776	PO_45_13.scr	Googles.exe
PID 308 wrote to memory of 4984	308	Googles.exe	InstallUtil.exe
PID 308 wrote to memory of 4984	308	Googles.exe	InstallUtil.exe
PID 308 wrote to memory of 4984	308	Googles.exe	InstallUtil.exe
PID 308 wrote to memory of 4984	308	Googles.exe	InstallUtil.exe
PID 308 wrote to memory of 4984	308	Googles.exe	InstallUtil.exe
PID 308 wrote to memory of 4984	308	Googles.exe	InstallUtil.exe
PID 308 wrote to memory of 4984	308	Googles.exe	InstallUtil.exe
PID 308 wrote to memory of 4984	308	Googles.exe	InstallUtil.exe

C:\Users\Admin\AppData\Local\Temp\PO_45_13.scr
"C:\Users\Admin\AppData\Local\Temp\PO_45_13.scr" /S
1⤵
- Checks computer location settings
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4776

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /c REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v Googles /t REG_SZ /d C:\Windows\system32\pcalua.exe" -a C:\Users\Admin\Music\Googles.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:2180

C:\Windows\SysWOW64\reg.exe
REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v Googles /t REG_SZ /d C:\Windows\system32\pcalua.exe" -a C:\Users\Admin\Music\Googles.exe"
3⤵
- Adds Run key to start application
PID:4988

C:\Users\Admin\Music\Googles.exe
"C:\Users\Admin\Music\Googles.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:308

C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe
"C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe"
3⤵
- Executes dropped EXE
PID:4984

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\305ca9ce-05a7-4081-bcf5-b3110c43e68e\l.dll
Filesize
94KB

MD5
14ff402962ad21b78ae0b4c43cd1f194

SHA1
f8a510eb26666e875a5bdd1cadad40602763ad72

SHA256
fb9646cb956945bdc503e69645f6b5316d3826b780d3c36738d6b944e884d15b

SHA512
daa7a08bf3709119a944bce28f6ebdd24e54a22b18cd9f86a87873e958df121a3881dcdd5e162f6b4e543238c7aef20f657c9830df01d4c79290f7c9a4fcc54b

Download Submit
C:\Users\Admin\AppData\Local\Temp\305ca9ce-05a7-4081-bcf5-b3110c43e68e\l.dll
Filesize
94KB

MD5
14ff402962ad21b78ae0b4c43cd1f194

SHA1
f8a510eb26666e875a5bdd1cadad40602763ad72

SHA256
fb9646cb956945bdc503e69645f6b5316d3826b780d3c36738d6b944e884d15b

SHA512
daa7a08bf3709119a944bce28f6ebdd24e54a22b18cd9f86a87873e958df121a3881dcdd5e162f6b4e543238c7aef20f657c9830df01d4c79290f7c9a4fcc54b

Download Submit
C:\Users\Admin\AppData\Local\Temp\305ca9ce-05a7-4081-bcf5-b3110c43e68e\l.dll
Filesize
94KB

MD5
14ff402962ad21b78ae0b4c43cd1f194

SHA1
f8a510eb26666e875a5bdd1cadad40602763ad72

SHA256
fb9646cb956945bdc503e69645f6b5316d3826b780d3c36738d6b944e884d15b

SHA512
daa7a08bf3709119a944bce28f6ebdd24e54a22b18cd9f86a87873e958df121a3881dcdd5e162f6b4e543238c7aef20f657c9830df01d4c79290f7c9a4fcc54b

Download Submit
C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe
Filesize
41KB

MD5
5d4073b2eb6d217c19f2b22f21bf8d57

SHA1
f0209900fbf08d004b886a0b3ba33ea2b0bf9da8

SHA256
ac1a3f21fcc88f9cee7bf51581eafba24cc76c924f0821deb2afdf1080ddf3d3

SHA512
9ac94880684933ba3407cdc135abc3047543436567af14cd9269c4adc5a6535db7b867d6de0d6238a21b94e69f9890dbb5739155871a624520623a7e56872159

Download Submit
C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe
Filesize
41KB

MD5
5d4073b2eb6d217c19f2b22f21bf8d57

SHA1
f0209900fbf08d004b886a0b3ba33ea2b0bf9da8

SHA256
ac1a3f21fcc88f9cee7bf51581eafba24cc76c924f0821deb2afdf1080ddf3d3

SHA512
9ac94880684933ba3407cdc135abc3047543436567af14cd9269c4adc5a6535db7b867d6de0d6238a21b94e69f9890dbb5739155871a624520623a7e56872159

Download Submit
C:\Users\Admin\Music\Googles.exe
Filesize
479KB

MD5
50c3085963b5fdc5a9c00d10d1b4f960

SHA1
6529e11136560ad369d1b443a6e60f4e1f85c71e

SHA256
2c8c5c5e5990da4a2af218cfece6afda3f4830be6605b9767adbfbde2e5cd276

SHA512
36318d8dd2f4cd844fd8e1c47356d98c2af9df85646009b8d1cce97de834740f703a1770ed8770261c42cfe52eda5f52a43a7379f577754c1ea2ec723afbe837

Download Submit
C:\Users\Admin\Music\Googles.exe
Filesize
479KB

MD5
50c3085963b5fdc5a9c00d10d1b4f960

SHA1
6529e11136560ad369d1b443a6e60f4e1f85c71e

SHA256
2c8c5c5e5990da4a2af218cfece6afda3f4830be6605b9767adbfbde2e5cd276

SHA512
36318d8dd2f4cd844fd8e1c47356d98c2af9df85646009b8d1cce97de834740f703a1770ed8770261c42cfe52eda5f52a43a7379f577754c1ea2ec723afbe837

Download Submit
memory/308-142-0x0000000072EB0000-0x0000000072F39000-memory.dmp

Filesize
548KB

Download
memory/308-137-0x0000000000000000-mapping.dmp

Download
memory/2180-135-0x0000000000000000-mapping.dmp

Download
memory/4776-134-0x0000000005810000-0x00000000058A2000-memory.dmp

Filesize
584KB

Download
memory/4776-130-0x00000000003C0000-0x000000000043E000-memory.dmp

Filesize
504KB

Download
memory/4776-133-0x0000000005CE0000-0x0000000006284000-memory.dmp

Filesize
5.6MB

Download
memory/4776-132-0x0000000072EB0000-0x0000000072F39000-memory.dmp

Filesize
548KB

Download
memory/4984-143-0x0000000000000000-mapping.dmp

Download
memory/4984-144-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4988-136-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads