asyncrat | f41360c7779e6656ec89fdfa40ae58b619d80dd27286802a9e902ab9dde19152

General

Target

triage_dropped_file.exe
Size

172KB
MD5

982f97ccf89f9d50dbc5d152c7139a50
SHA1

0ba6c448dd8566a1196e642ef1d834d55bf6e3e6
SHA256

f41360c7779e6656ec89fdfa40ae58b619d80dd27286802a9e902ab9dde19152
SHA512

c51127261b13e135e183c779c2bc10b5f43a2e27ccfd902829abc215beddd2070cf3739ac810201ae4eaf98dc9afab9b5e6923e97b1ca7bd0c7e661706c08fd1

Score

10^/10

asyncrat default persistence rat suricata

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

Default

C2

127.0.0.1:6606

127.0.0.1:7707

127.0.0.1:8808

127.0.0.1:1111

62.197.136.167:6606

62.197.136.167:7707

62.197.136.167:8808

62.197.136.167:1111

Mutex

AsyncMutex_6SI8OkPnk

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
rat asyncrat
suricata: ET MALWARE Generic AsyncRAT Style SSL Cert
suricata: ET MALWARE Generic AsyncRAT Style SSL Cert
suricata
suricata: ET MALWARE Observed Malicious SSL Cert (AsyncRAT Server)
suricata: ET MALWARE Observed Malicious SSL Cert (AsyncRAT Server)
suricata

Async RAT payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/4832-148-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

triage_dropped_file.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation	triage_dropped_file.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

triage_dropped_file.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Aeigqqh = "\"C:\\Users\\Admin\\AppData\\Roaming\\Tupbtqbro\\Aeigqqh.exe\""	triage_dropped_file.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

triage_dropped_file.exe

description pid process target process

PID 2132 set thread context of 4832 2132 triage_dropped_file.exe InstallUtil.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

powershell.exepowershell.exetriage_dropped_file.exe

pid process

4804 powershell.exe
4804 powershell.exe
636 powershell.exe
636 powershell.exe
2132 triage_dropped_file.exe
2132 triage_dropped_file.exe

description	pid	process	target process
PID 2132 set thread context of 4832	2132	triage_dropped_file.exe	InstallUtil.exe

pid	process
4804	powershell.exe
4804	powershell.exe
636	powershell.exe
636	powershell.exe
2132	triage_dropped_file.exe
2132	triage_dropped_file.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

powershell.exetriage_dropped_file.exepowershell.exeInstallUtil.exe

description	pid	process
Token: SeDebugPrivilege	4804	powershell.exe
Token: SeDebugPrivilege	2132	triage_dropped_file.exe
Token: SeDebugPrivilege	636	powershell.exe
Token: SeDebugPrivilege	4832	InstallUtil.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

triage_dropped_file.exe

description	pid	process	target process
PID 2132 wrote to memory of 4804	2132	triage_dropped_file.exe	powershell.exe
PID 2132 wrote to memory of 4804	2132	triage_dropped_file.exe	powershell.exe
PID 2132 wrote to memory of 4804	2132	triage_dropped_file.exe	powershell.exe
PID 2132 wrote to memory of 636	2132	triage_dropped_file.exe	powershell.exe
PID 2132 wrote to memory of 636	2132	triage_dropped_file.exe	powershell.exe
PID 2132 wrote to memory of 636	2132	triage_dropped_file.exe	powershell.exe
PID 2132 wrote to memory of 4832	2132	triage_dropped_file.exe	InstallUtil.exe
PID 2132 wrote to memory of 4832	2132	triage_dropped_file.exe	InstallUtil.exe
PID 2132 wrote to memory of 4832	2132	triage_dropped_file.exe	InstallUtil.exe
PID 2132 wrote to memory of 4832	2132	triage_dropped_file.exe	InstallUtil.exe
PID 2132 wrote to memory of 4832	2132	triage_dropped_file.exe	InstallUtil.exe
PID 2132 wrote to memory of 4832	2132	triage_dropped_file.exe	InstallUtil.exe
PID 2132 wrote to memory of 4832	2132	triage_dropped_file.exe	InstallUtil.exe
PID 2132 wrote to memory of 4832	2132	triage_dropped_file.exe	InstallUtil.exe

C:\Users\Admin\AppData\Local\Temp\triage_dropped_file.exe
"C:\Users\Admin\AppData\Local\Temp\triage_dropped_file.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2132

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4804

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMQAxAA==
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:636

C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:4832

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Filesize
53KB

MD5
3337d66209faa998d52d781d0ff2d804

SHA1
6594b85a70f998f79f43cdf1ca56137997534156

SHA256
9b946b062865f68b9f0f43a011d33d7ea0926a3c8f78fb20d9cab6144314e1bd

SHA512
8bbd14bd73111f7b55712f5d1e1b727e41db8e6e0c1243ee6809ff32b509e52dec7af34c064151fb5beccd59dda434a3f83abe987c561a25abfbb4cbcf9c7f1f

Download Submit
memory/636-145-0x0000000000000000-mapping.dmp

Download
memory/2132-131-0x0000000005400000-0x00000000059A4000-memory.dmp

Filesize
5.6MB

Download
memory/2132-132-0x0000000004EF0000-0x0000000004F82000-memory.dmp

Filesize
584KB

Download
memory/2132-133-0x0000000004E80000-0x0000000004E8A000-memory.dmp

Filesize
40KB

Download
memory/2132-130-0x00000000004C0000-0x00000000004F0000-memory.dmp

Filesize
192KB

Download
memory/4804-135-0x0000000004B40000-0x0000000004B76000-memory.dmp

Filesize
216KB

Download
memory/4804-143-0x0000000007B70000-0x00000000081EA000-memory.dmp

Filesize
6.5MB

Download
memory/4804-138-0x00000000051B0000-0x0000000005216000-memory.dmp

Filesize
408KB

Download
memory/4804-139-0x0000000005220000-0x0000000005286000-memory.dmp

Filesize
408KB

Download
memory/4804-140-0x0000000006180000-0x000000000619E000-memory.dmp

Filesize
120KB

Download
memory/4804-141-0x00000000066E0000-0x0000000006724000-memory.dmp

Filesize
272KB

Download
memory/4804-142-0x0000000007470000-0x00000000074E6000-memory.dmp

Filesize
472KB

Download
memory/4804-137-0x0000000005010000-0x0000000005032000-memory.dmp

Filesize
136KB

Download
memory/4804-144-0x0000000007510000-0x000000000752A000-memory.dmp

Filesize
104KB

Download
memory/4804-136-0x0000000005340000-0x0000000005968000-memory.dmp

Filesize
6.2MB

Download
memory/4804-134-0x0000000000000000-mapping.dmp

Download
memory/4832-147-0x0000000000000000-mapping.dmp

Download
memory/4832-148-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/4832-149-0x00000000055E0000-0x000000000567C000-memory.dmp

Filesize
624KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads