asyncrat | f41360c7779e6656ec89fdfa40ae58b619d80dd27286802a9e902ab9dde19152

General

Target

triage_dropped_file.exe
Size

172KB
MD5

982f97ccf89f9d50dbc5d152c7139a50
SHA1

0ba6c448dd8566a1196e642ef1d834d55bf6e3e6
SHA256

f41360c7779e6656ec89fdfa40ae58b619d80dd27286802a9e902ab9dde19152
SHA512

c51127261b13e135e183c779c2bc10b5f43a2e27ccfd902829abc215beddd2070cf3739ac810201ae4eaf98dc9afab9b5e6923e97b1ca7bd0c7e661706c08fd1

Score

10^/10

asyncrat default persistence rat suricata

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

Default

C2

127.0.0.1:6606

127.0.0.1:7707

127.0.0.1:8808

127.0.0.1:1111

62.197.136.167:6606

62.197.136.167:7707

62.197.136.167:8808

62.197.136.167:1111

Mutex

AsyncMutex_6SI8OkPnk

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
rat asyncrat
suricata: ET MALWARE Generic AsyncRAT Style SSL Cert
suricata: ET MALWARE Generic AsyncRAT Style SSL Cert
suricata
suricata: ET MALWARE Observed Malicious SSL Cert (AsyncRAT Server)
suricata: ET MALWARE Observed Malicious SSL Cert (AsyncRAT Server)
suricata

Async RAT payload 6 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1924-70-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat
behavioral1/memory/1924-71-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat
behavioral1/memory/1924-72-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat
behavioral1/memory/1924-73-0x000000000040C75E-mapping.dmp	asyncrat
behavioral1/memory/1924-75-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat
behavioral1/memory/1924-77-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

triage_dropped_file.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Windows\CurrentVersion\Run\Aeigqqh = "\"C:\\Users\\Admin\\AppData\\Roaming\\Tupbtqbro\\Aeigqqh.exe\""	triage_dropped_file.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

triage_dropped_file.exe

description pid process target process

PID 784 set thread context of 1924 784 triage_dropped_file.exe InstallUtil.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

powershell.exepowershell.exetriage_dropped_file.exe

pid process

2000 powershell.exe
1020 powershell.exe
784 triage_dropped_file.exe
784 triage_dropped_file.exe

description	pid	process	target process
PID 784 set thread context of 1924	784	triage_dropped_file.exe	InstallUtil.exe

pid	process
2000	powershell.exe
1020	powershell.exe
784	triage_dropped_file.exe
784	triage_dropped_file.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

powershell.exetriage_dropped_file.exepowershell.exeInstallUtil.exe

description	pid	process
Token: SeDebugPrivilege	2000	powershell.exe
Token: SeDebugPrivilege	784	triage_dropped_file.exe
Token: SeDebugPrivilege	1020	powershell.exe
Token: SeDebugPrivilege	1924	InstallUtil.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

triage_dropped_file.exe

description	pid	process	target process
PID 784 wrote to memory of 2000	784	triage_dropped_file.exe	powershell.exe
PID 784 wrote to memory of 2000	784	triage_dropped_file.exe	powershell.exe
PID 784 wrote to memory of 2000	784	triage_dropped_file.exe	powershell.exe
PID 784 wrote to memory of 2000	784	triage_dropped_file.exe	powershell.exe
PID 784 wrote to memory of 1020	784	triage_dropped_file.exe	powershell.exe
PID 784 wrote to memory of 1020	784	triage_dropped_file.exe	powershell.exe
PID 784 wrote to memory of 1020	784	triage_dropped_file.exe	powershell.exe
PID 784 wrote to memory of 1020	784	triage_dropped_file.exe	powershell.exe
PID 784 wrote to memory of 1924	784	triage_dropped_file.exe	InstallUtil.exe
PID 784 wrote to memory of 1924	784	triage_dropped_file.exe	InstallUtil.exe
PID 784 wrote to memory of 1924	784	triage_dropped_file.exe	InstallUtil.exe
PID 784 wrote to memory of 1924	784	triage_dropped_file.exe	InstallUtil.exe
PID 784 wrote to memory of 1924	784	triage_dropped_file.exe	InstallUtil.exe
PID 784 wrote to memory of 1924	784	triage_dropped_file.exe	InstallUtil.exe
PID 784 wrote to memory of 1924	784	triage_dropped_file.exe	InstallUtil.exe
PID 784 wrote to memory of 1924	784	triage_dropped_file.exe	InstallUtil.exe
PID 784 wrote to memory of 1924	784	triage_dropped_file.exe	InstallUtil.exe
PID 784 wrote to memory of 1924	784	triage_dropped_file.exe	InstallUtil.exe
PID 784 wrote to memory of 1924	784	triage_dropped_file.exe	InstallUtil.exe
PID 784 wrote to memory of 1924	784	triage_dropped_file.exe	InstallUtil.exe

C:\Users\Admin\AppData\Local\Temp\triage_dropped_file.exe
"C:\Users\Admin\AppData\Local\Temp\triage_dropped_file.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:784

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2000

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMQAxAA==
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1020

C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1924

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Filesize
7KB

MD5
cc6c939395a88e77c73a22c3d8496b89

SHA1
5b6574bb4cee5bcaa1423055943ccda3bf628ad1

SHA256
4f9ab8f3c9cbe703208c5aea20fbc8a47a58f63cee013b535b81eb07fbbb7537

SHA512
f45e5bf7b5932624c05f07fdcd6eac0226b70bcaebe3a78d9c026646850d1a279b690505bada5ba34fa16ed8fcc96084d9e41949173fcfb6a5183b3f5855e287

Download Submit
memory/784-55-0x0000000076391000-0x0000000076393000-memory.dmp

Filesize
8KB

Download
memory/784-54-0x0000000000120000-0x0000000000150000-memory.dmp

Filesize
192KB

Download
memory/784-60-0x0000000005870000-0x0000000005934000-memory.dmp

Filesize
784KB

Download
memory/784-61-0x0000000005290000-0x00000000052DC000-memory.dmp

Filesize
304KB

Download
memory/1020-66-0x000000006FC80000-0x000000007022B000-memory.dmp

Filesize
5.7MB

Download
memory/1020-65-0x000000006FC80000-0x000000007022B000-memory.dmp

Filesize
5.7MB

Download
memory/1020-62-0x0000000000000000-mapping.dmp

Download
memory/1924-68-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1924-67-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1924-70-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1924-71-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1924-72-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1924-73-0x000000000040C75E-mapping.dmp

Download
memory/1924-75-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1924-77-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2000-59-0x000000006FC80000-0x000000007022B000-memory.dmp

Filesize
5.7MB

Download
memory/2000-58-0x000000006FC80000-0x000000007022B000-memory.dmp

Filesize
5.7MB

Download
memory/2000-56-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads