asyncrat | f41360c7779e6656ec89fdfa40ae58b619d80dd27286802a9e902ab9dde19152

General

Target

triage_dropped_file.exe
Size

172KB
MD5

982f97ccf89f9d50dbc5d152c7139a50
SHA1

0ba6c448dd8566a1196e642ef1d834d55bf6e3e6
SHA256

f41360c7779e6656ec89fdfa40ae58b619d80dd27286802a9e902ab9dde19152
SHA512

c51127261b13e135e183c779c2bc10b5f43a2e27ccfd902829abc215beddd2070cf3739ac810201ae4eaf98dc9afab9b5e6923e97b1ca7bd0c7e661706c08fd1

Score

10^/10

asyncrat default persistence rat suricata

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

Default

C2

127.0.0.1:6606

127.0.0.1:7707

127.0.0.1:8808

127.0.0.1:1111

62.197.136.167:6606

62.197.136.167:7707

62.197.136.167:8808

62.197.136.167:1111

Mutex

AsyncMutex_6SI8OkPnk

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
rat asyncrat
suricata: ET MALWARE Generic AsyncRAT Style SSL Cert
suricata: ET MALWARE Generic AsyncRAT Style SSL Cert
suricata
suricata: ET MALWARE Observed Malicious SSL Cert (AsyncRAT Server)
suricata: ET MALWARE Observed Malicious SSL Cert (AsyncRAT Server)
suricata

Async RAT payload 6 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/684-70-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat
behavioral1/memory/684-71-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat
behavioral1/memory/684-72-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat
behavioral1/memory/684-73-0x000000000040C75E-mapping.dmp	asyncrat
behavioral1/memory/684-75-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat
behavioral1/memory/684-77-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

triage_dropped_file.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows\CurrentVersion\Run\Aeigqqh = "\"C:\\Users\\Admin\\AppData\\Roaming\\Tupbtqbro\\Aeigqqh.exe\""	triage_dropped_file.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

triage_dropped_file.exe

description pid process target process

PID 1948 set thread context of 684 1948 triage_dropped_file.exe InstallUtil.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

powershell.exepowershell.exetriage_dropped_file.exe

pid process

1292 powershell.exe
556 powershell.exe
1948 triage_dropped_file.exe
1948 triage_dropped_file.exe

description	pid	process	target process
PID 1948 set thread context of 684	1948	triage_dropped_file.exe	InstallUtil.exe

pid	process
1292	powershell.exe
556	powershell.exe
1948	triage_dropped_file.exe
1948	triage_dropped_file.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

powershell.exetriage_dropped_file.exepowershell.exeInstallUtil.exe

description	pid	process
Token: SeDebugPrivilege	1292	powershell.exe
Token: SeDebugPrivilege	1948	triage_dropped_file.exe
Token: SeDebugPrivilege	556	powershell.exe
Token: SeDebugPrivilege	684	InstallUtil.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

triage_dropped_file.exe

description	pid	process	target process
PID 1948 wrote to memory of 1292	1948	triage_dropped_file.exe	powershell.exe
PID 1948 wrote to memory of 1292	1948	triage_dropped_file.exe	powershell.exe
PID 1948 wrote to memory of 1292	1948	triage_dropped_file.exe	powershell.exe
PID 1948 wrote to memory of 1292	1948	triage_dropped_file.exe	powershell.exe
PID 1948 wrote to memory of 556	1948	triage_dropped_file.exe	powershell.exe
PID 1948 wrote to memory of 556	1948	triage_dropped_file.exe	powershell.exe
PID 1948 wrote to memory of 556	1948	triage_dropped_file.exe	powershell.exe
PID 1948 wrote to memory of 556	1948	triage_dropped_file.exe	powershell.exe
PID 1948 wrote to memory of 684	1948	triage_dropped_file.exe	InstallUtil.exe
PID 1948 wrote to memory of 684	1948	triage_dropped_file.exe	InstallUtil.exe
PID 1948 wrote to memory of 684	1948	triage_dropped_file.exe	InstallUtil.exe
PID 1948 wrote to memory of 684	1948	triage_dropped_file.exe	InstallUtil.exe
PID 1948 wrote to memory of 684	1948	triage_dropped_file.exe	InstallUtil.exe
PID 1948 wrote to memory of 684	1948	triage_dropped_file.exe	InstallUtil.exe
PID 1948 wrote to memory of 684	1948	triage_dropped_file.exe	InstallUtil.exe
PID 1948 wrote to memory of 684	1948	triage_dropped_file.exe	InstallUtil.exe
PID 1948 wrote to memory of 684	1948	triage_dropped_file.exe	InstallUtil.exe
PID 1948 wrote to memory of 684	1948	triage_dropped_file.exe	InstallUtil.exe
PID 1948 wrote to memory of 684	1948	triage_dropped_file.exe	InstallUtil.exe
PID 1948 wrote to memory of 684	1948	triage_dropped_file.exe	InstallUtil.exe

C:\Users\Admin\AppData\Local\Temp\triage_dropped_file.exe
"C:\Users\Admin\AppData\Local\Temp\triage_dropped_file.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1948

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1292

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMQAxAA==
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:556

C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:684

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Filesize
7KB

MD5
3ca7deac1abd289038fec04109706e5d

SHA1
e30ea8f67103098e8d1764ef85c7811c18f60fab

SHA256
ab8fb25b548aff26acde040f93f5e41980f50e2ef0b34fea1e5dfe8683623c99

SHA512
833e5aa6611b1e05ba4953ac8e7b1b030c990e8cef901dc80796c87bd5c0677836dbb1d0b088dd324b70e80f9ba147396a46c6fde309e1c06608573599795f1f

Download Submit
memory/556-62-0x0000000000000000-mapping.dmp

Download
memory/556-66-0x000000006F920000-0x000000006FECB000-memory.dmp

Filesize
5.7MB

Download
memory/556-65-0x000000006F920000-0x000000006FECB000-memory.dmp

Filesize
5.7MB

Download
memory/684-68-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/684-71-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/684-77-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/684-75-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/684-73-0x000000000040C75E-mapping.dmp

Download
memory/684-72-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/684-70-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/684-67-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1292-56-0x0000000000000000-mapping.dmp

Download
memory/1292-58-0x000000006F920000-0x000000006FECB000-memory.dmp

Filesize
5.7MB

Download
memory/1292-59-0x000000006F920000-0x000000006FECB000-memory.dmp

Filesize
5.7MB

Download
memory/1948-54-0x0000000000B40000-0x0000000000B70000-memory.dmp

Filesize
192KB

Download
memory/1948-55-0x00000000754A1000-0x00000000754A3000-memory.dmp

Filesize
8KB

Download
memory/1948-60-0x0000000005CE0000-0x0000000005DA4000-memory.dmp

Filesize
784KB

Download
memory/1948-61-0x00000000054C0000-0x000000000550C000-memory.dmp

Filesize
304KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads