asyncrat | 5af88b2d9a192241b2b0e52aed733bdeb190a4af07eacc6940520f7441c04953

General

Target

MAJDALANI INOX S.A Pedido 050820.exe
Size

211KB
MD5

d5fde7482c0a5271e68c211f9e75e7b6
SHA1

c0f734e5c0dcf8fc8527dc4c96bd7bdeb96a245b
SHA256

af9b543c27aeb1cb25c7ced83b727b29ab7dc4a91e28b5693d52f810aedab2f6
SHA512

ab65a13b031632be848f1676dc6459223c8be4caa34b39343fe1f1eb37c65612359b3bd2ca174df5dae519a68b75463be95b2ea8f27bb340b943c13042872d38

Score

10^/10

asyncrat god's mercy persistence rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

GOD'S MERCY

Mutex

AsyncMutex_6SI8OkPnk

Attributes

delay
3
install
false
install_folder
%AppData%
pastebin_config
https://pastebin.com/raw/reQxa5Ah

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
rat asyncrat

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

MAJDALANI INOX S.A Pedido 050820.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe,\"C:\\Users\\Admin\\AppData\\Local\\Temp\\MAJDALANI INOX S.A Pedido 050820.exe\""	MAJDALANI INOX S.A Pedido 050820.exe

Async RAT payload 7 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/652-56-0x00000000005C0000-0x00000000005EE000-memory.dmp	asyncrat
behavioral1/memory/836-60-0x0000000000400000-0x000000000042A000-memory.dmp	asyncrat
behavioral1/memory/836-62-0x0000000000400000-0x000000000042A000-memory.dmp	asyncrat
behavioral1/memory/836-63-0x0000000000400000-0x000000000042A000-memory.dmp	asyncrat
behavioral1/memory/836-64-0x000000000040C76E-mapping.dmp	asyncrat
behavioral1/memory/836-66-0x0000000000400000-0x000000000042A000-memory.dmp	asyncrat
behavioral1/memory/836-68-0x0000000000400000-0x000000000042A000-memory.dmp	asyncrat

Drops startup file 2 IoCs

Processes:

MAJDALANI INOX S.A Pedido 050820.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MAJDALANI INOX S.A Pedido 050820.exe	MAJDALANI INOX S.A Pedido 050820.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MAJDALANI INOX S.A Pedido 050820.exe	MAJDALANI INOX S.A Pedido 050820.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

MAJDALANI INOX S.A Pedido 050820.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows\CurrentVersion\Run\MAJDALANI INOX S.A Pedido 050820.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MAJDALANI INOX S.A Pedido 050820.exe"	MAJDALANI INOX S.A Pedido 050820.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Suspicious use of SetThreadContext 1 IoCs

Processes:

MAJDALANI INOX S.A Pedido 050820.exe

description pid process target process

PID 652 set thread context of 836 652 MAJDALANI INOX S.A Pedido 050820.exe installutil.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

MAJDALANI INOX S.A Pedido 050820.exe

pid process

652 MAJDALANI INOX S.A Pedido 050820.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

MAJDALANI INOX S.A Pedido 050820.exeinstallutil.exe

description pid process

Token: SeDebugPrivilege 652 MAJDALANI INOX S.A Pedido 050820.exe
Token: SeDebugPrivilege 836 installutil.exe

description	pid	process	target process
PID 652 set thread context of 836	652	MAJDALANI INOX S.A Pedido 050820.exe	installutil.exe

pid	process
652	MAJDALANI INOX S.A Pedido 050820.exe

description	pid	process
Token: SeDebugPrivilege	652	MAJDALANI INOX S.A Pedido 050820.exe
Token: SeDebugPrivilege	836	installutil.exe

Suspicious use of WriteProcessMemory 19 IoCs

Processes:

MAJDALANI INOX S.A Pedido 050820.exe

description	pid	process	target process
PID 652 wrote to memory of 852	652	MAJDALANI INOX S.A Pedido 050820.exe	installutil.exe
PID 652 wrote to memory of 852	652	MAJDALANI INOX S.A Pedido 050820.exe	installutil.exe
PID 652 wrote to memory of 852	652	MAJDALANI INOX S.A Pedido 050820.exe	installutil.exe
PID 652 wrote to memory of 852	652	MAJDALANI INOX S.A Pedido 050820.exe	installutil.exe
PID 652 wrote to memory of 852	652	MAJDALANI INOX S.A Pedido 050820.exe	installutil.exe
PID 652 wrote to memory of 852	652	MAJDALANI INOX S.A Pedido 050820.exe	installutil.exe
PID 652 wrote to memory of 852	652	MAJDALANI INOX S.A Pedido 050820.exe	installutil.exe
PID 652 wrote to memory of 836	652	MAJDALANI INOX S.A Pedido 050820.exe	installutil.exe
PID 652 wrote to memory of 836	652	MAJDALANI INOX S.A Pedido 050820.exe	installutil.exe
PID 652 wrote to memory of 836	652	MAJDALANI INOX S.A Pedido 050820.exe	installutil.exe
PID 652 wrote to memory of 836	652	MAJDALANI INOX S.A Pedido 050820.exe	installutil.exe
PID 652 wrote to memory of 836	652	MAJDALANI INOX S.A Pedido 050820.exe	installutil.exe
PID 652 wrote to memory of 836	652	MAJDALANI INOX S.A Pedido 050820.exe	installutil.exe
PID 652 wrote to memory of 836	652	MAJDALANI INOX S.A Pedido 050820.exe	installutil.exe
PID 652 wrote to memory of 836	652	MAJDALANI INOX S.A Pedido 050820.exe	installutil.exe
PID 652 wrote to memory of 836	652	MAJDALANI INOX S.A Pedido 050820.exe	installutil.exe
PID 652 wrote to memory of 836	652	MAJDALANI INOX S.A Pedido 050820.exe	installutil.exe
PID 652 wrote to memory of 836	652	MAJDALANI INOX S.A Pedido 050820.exe	installutil.exe
PID 652 wrote to memory of 836	652	MAJDALANI INOX S.A Pedido 050820.exe	installutil.exe

C:\Users\Admin\AppData\Local\Temp\MAJDALANI INOX S.A Pedido 050820.exe
"C:\Users\Admin\AppData\Local\Temp\MAJDALANI INOX S.A Pedido 050820.exe"
1⤵
- Modifies WinLogon for persistence
- Drops startup file
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:652

C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
2⤵
PID:852

C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:836

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

1

T1004

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1

T1102

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/652-54-0x0000000000980000-0x00000000009BA000-memory.dmp

Filesize
232KB

Download
memory/652-55-0x00000000765F1000-0x00000000765F3000-memory.dmp

Filesize
8KB

Download
memory/652-56-0x00000000005C0000-0x00000000005EE000-memory.dmp

Filesize
184KB

Download
memory/836-57-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/836-58-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/836-60-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/836-62-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/836-63-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/836-64-0x000000000040C76E-mapping.dmp

Download
memory/836-66-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/836-68-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads