asyncrat | 8b81793a9208e59123733d44c31e992e32ebdd5d4700d05c14c4982395b44486

General

Target

MAJDALANI INOX SA Pedido.exe
Size

185KB
MD5

4abe1482b72bc41218cfa12516674b21
SHA1

f3f228fe5c3bd9a903cfe891ea46ecfbe69de784
SHA256

ba1c5f36a287271ae64d7fb5e803ced708a75ac3398448f8c3000cf9f2897f86
SHA512

256da1cb7be9e593325b23056c9fd10b6c274eb4e5d673186b97a92347b2b36c4c38e324c5e8d489e638b943a114e7f16cbfb7352b44eb6fdfc5cb037a081a2c

Score

10^/10

asyncrat god's mercy persistence rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

GOD'S MERCY

Mutex

AsyncMutex_6SI8OkPnk

Attributes

delay
3
install
false
install_folder
%AppData%
pastebin_config
https://pastebin.com/raw/reQxa5Ah

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
rat asyncrat

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

MAJDALANI INOX SA Pedido.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe,\"C:\\Users\\Admin\\AppData\\Local\\Temp\\MAJDALANI INOX SA Pedido.exe\""	MAJDALANI INOX SA Pedido.exe

Async RAT payload 7 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/2040-56-0x0000000000360000-0x000000000038C000-memory.dmp	asyncrat
behavioral1/memory/2012-60-0x0000000000400000-0x0000000000428000-memory.dmp	asyncrat
behavioral1/memory/2012-62-0x0000000000400000-0x0000000000428000-memory.dmp	asyncrat
behavioral1/memory/2012-63-0x0000000000400000-0x0000000000428000-memory.dmp	asyncrat
behavioral1/memory/2012-64-0x000000000040C76E-mapping.dmp	asyncrat
behavioral1/memory/2012-66-0x0000000000400000-0x0000000000428000-memory.dmp	asyncrat
behavioral1/memory/2012-68-0x0000000000400000-0x0000000000428000-memory.dmp	asyncrat

Drops startup file 2 IoCs

Processes:

MAJDALANI INOX SA Pedido.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MAJDALANI INOX SA Pedido.exe	MAJDALANI INOX SA Pedido.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MAJDALANI INOX SA Pedido.exe	MAJDALANI INOX SA Pedido.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

MAJDALANI INOX SA Pedido.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Windows\CurrentVersion\Run\MAJDALANI INOX SA Pedido.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MAJDALANI INOX SA Pedido.exe"	MAJDALANI INOX SA Pedido.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Suspicious use of SetThreadContext 1 IoCs

Processes:

MAJDALANI INOX SA Pedido.exe

description pid process target process

PID 2040 set thread context of 2012 2040 MAJDALANI INOX SA Pedido.exe installutil.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

installutil.exe

description pid process

Token: SeDebugPrivilege 2012 installutil.exe

description	pid	process	target process
PID 2040 set thread context of 2012	2040	MAJDALANI INOX SA Pedido.exe	installutil.exe

description	pid	process
Token: SeDebugPrivilege	2012	installutil.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

MAJDALANI INOX SA Pedido.exe

description	pid	process	target process
PID 2040 wrote to memory of 2012	2040	MAJDALANI INOX SA Pedido.exe	installutil.exe
PID 2040 wrote to memory of 2012	2040	MAJDALANI INOX SA Pedido.exe	installutil.exe
PID 2040 wrote to memory of 2012	2040	MAJDALANI INOX SA Pedido.exe	installutil.exe
PID 2040 wrote to memory of 2012	2040	MAJDALANI INOX SA Pedido.exe	installutil.exe
PID 2040 wrote to memory of 2012	2040	MAJDALANI INOX SA Pedido.exe	installutil.exe
PID 2040 wrote to memory of 2012	2040	MAJDALANI INOX SA Pedido.exe	installutil.exe
PID 2040 wrote to memory of 2012	2040	MAJDALANI INOX SA Pedido.exe	installutil.exe
PID 2040 wrote to memory of 2012	2040	MAJDALANI INOX SA Pedido.exe	installutil.exe
PID 2040 wrote to memory of 2012	2040	MAJDALANI INOX SA Pedido.exe	installutil.exe
PID 2040 wrote to memory of 2012	2040	MAJDALANI INOX SA Pedido.exe	installutil.exe
PID 2040 wrote to memory of 2012	2040	MAJDALANI INOX SA Pedido.exe	installutil.exe
PID 2040 wrote to memory of 2012	2040	MAJDALANI INOX SA Pedido.exe	installutil.exe

C:\Users\Admin\AppData\Local\Temp\MAJDALANI INOX SA Pedido.exe
"C:\Users\Admin\AppData\Local\Temp\MAJDALANI INOX SA Pedido.exe"
1⤵
- Modifies WinLogon for persistence
- Drops startup file
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2040

C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2012

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

1

T1004

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1

T1102

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2012-57-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2012-58-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2012-60-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2012-62-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2012-63-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2012-64-0x000000000040C76E-mapping.dmp

Download
memory/2012-66-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2012-68-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2040-54-0x0000000000910000-0x0000000000942000-memory.dmp

Filesize
200KB

Download
memory/2040-55-0x0000000076261000-0x0000000076263000-memory.dmp

Filesize
8KB

Download
memory/2040-56-0x0000000000360000-0x000000000038C000-memory.dmp

Filesize
176KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads