asyncrat | e2bc473866d9e54637bd26ad66b848f4813e4432732eca093930ae78698d746c

General

Target

e2bc473866d9e54637bd26ad66b848f4813e4432732eca093930ae78698d746c.exe
Size

804KB
MD5

ed99523b0359e4fa801d9f9431f55dd3
SHA1

e4e1f7aa9127bc3c2b98bf1d2f9dfb669fd65002
SHA256

e2bc473866d9e54637bd26ad66b848f4813e4432732eca093930ae78698d746c
SHA512

d32025ace988866d86bf6df6f7a29a5d5afd7896b627182438c86a1b880c1f4511c56547a30de7c76eb7cd365aefd7cd992603d33c4ffb366b2629bd26405eb9

Score

10^/10

asyncrat snowbot persistence rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

Snowbot

C2

127.0.0.1:6606

127.0.0.1:7707

127.0.0.1:8808

127.0.0.1:8888

193.239.147.169:6606

193.239.147.169:7707

193.239.147.169:8808

193.239.147.169:8888

Mutex

AsyncMutex_6SI8OkPnk

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
rat asyncrat

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

e2bc473866d9e54637bd26ad66b848f4813e4432732eca093930ae78698d746c.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe,\"C:\\Users\\Admin\\AppData\\Local\\Temp\\e2bc473866d9e54637bd26ad66b848f4813e4432732eca093930ae78698d746c.exe\""	e2bc473866d9e54637bd26ad66b848f4813e4432732eca093930ae78698d746c.exe

Async RAT payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/4436-134-0x0000000000400000-0x0000000000414000-memory.dmp	asyncrat

Drops startup file 2 IoCs

Processes:

e2bc473866d9e54637bd26ad66b848f4813e4432732eca093930ae78698d746c.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\e2bc473866d9e54637bd26ad66b848f4813e4432732eca093930ae78698d746c.exe	e2bc473866d9e54637bd26ad66b848f4813e4432732eca093930ae78698d746c.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\e2bc473866d9e54637bd26ad66b848f4813e4432732eca093930ae78698d746c.exe	e2bc473866d9e54637bd26ad66b848f4813e4432732eca093930ae78698d746c.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

e2bc473866d9e54637bd26ad66b848f4813e4432732eca093930ae78698d746c.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\<Unknown> = "C:\\Users\\Admin\\AppData\\Local\\Temp\\e2bc473866d9e54637bd26ad66b848f4813e4432732eca093930ae78698d746c.exe"	e2bc473866d9e54637bd26ad66b848f4813e4432732eca093930ae78698d746c.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\e2bc473866d9e54637bd26ad66b848f4813e4432732eca093930ae78698d746c.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\e2bc473866d9e54637bd26ad66b848f4813e4432732eca093930ae78698d746c.exe"	e2bc473866d9e54637bd26ad66b848f4813e4432732eca093930ae78698d746c.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

e2bc473866d9e54637bd26ad66b848f4813e4432732eca093930ae78698d746c.exe

description	pid	process	target process
PID 4420 set thread context of 4436	4420	e2bc473866d9e54637bd26ad66b848f4813e4432732eca093930ae78698d746c.exe	e2bc473866d9e54637bd26ad66b848f4813e4432732eca093930ae78698d746c.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

e2bc473866d9e54637bd26ad66b848f4813e4432732eca093930ae78698d746c.exe

description	pid	process	target process
PID 4420 wrote to memory of 4436	4420	e2bc473866d9e54637bd26ad66b848f4813e4432732eca093930ae78698d746c.exe	e2bc473866d9e54637bd26ad66b848f4813e4432732eca093930ae78698d746c.exe
PID 4420 wrote to memory of 4436	4420	e2bc473866d9e54637bd26ad66b848f4813e4432732eca093930ae78698d746c.exe	e2bc473866d9e54637bd26ad66b848f4813e4432732eca093930ae78698d746c.exe
PID 4420 wrote to memory of 4436	4420	e2bc473866d9e54637bd26ad66b848f4813e4432732eca093930ae78698d746c.exe	e2bc473866d9e54637bd26ad66b848f4813e4432732eca093930ae78698d746c.exe
PID 4420 wrote to memory of 4436	4420	e2bc473866d9e54637bd26ad66b848f4813e4432732eca093930ae78698d746c.exe	e2bc473866d9e54637bd26ad66b848f4813e4432732eca093930ae78698d746c.exe
PID 4420 wrote to memory of 4436	4420	e2bc473866d9e54637bd26ad66b848f4813e4432732eca093930ae78698d746c.exe	e2bc473866d9e54637bd26ad66b848f4813e4432732eca093930ae78698d746c.exe
PID 4420 wrote to memory of 4436	4420	e2bc473866d9e54637bd26ad66b848f4813e4432732eca093930ae78698d746c.exe	e2bc473866d9e54637bd26ad66b848f4813e4432732eca093930ae78698d746c.exe
PID 4420 wrote to memory of 4436	4420	e2bc473866d9e54637bd26ad66b848f4813e4432732eca093930ae78698d746c.exe	e2bc473866d9e54637bd26ad66b848f4813e4432732eca093930ae78698d746c.exe
PID 4420 wrote to memory of 4436	4420	e2bc473866d9e54637bd26ad66b848f4813e4432732eca093930ae78698d746c.exe	e2bc473866d9e54637bd26ad66b848f4813e4432732eca093930ae78698d746c.exe

C:\Users\Admin\AppData\Local\Temp\e2bc473866d9e54637bd26ad66b848f4813e4432732eca093930ae78698d746c.exe
"C:\Users\Admin\AppData\Local\Temp\e2bc473866d9e54637bd26ad66b848f4813e4432732eca093930ae78698d746c.exe"
1⤵
- Modifies WinLogon for persistence
- Drops startup file
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4420

C:\Users\Admin\AppData\Local\Temp\e2bc473866d9e54637bd26ad66b848f4813e4432732eca093930ae78698d746c.exe
"C:\Users\Admin\AppData\Local\Temp\e2bc473866d9e54637bd26ad66b848f4813e4432732eca093930ae78698d746c.exe"
2⤵
PID:4436

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

1

T1004

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\e2bc473866d9e54637bd26ad66b848f4813e4432732eca093930ae78698d746c.exe.log
Filesize
1KB

MD5
b4b6445e0b144333803128317e91c24b

SHA1
cc8ee21189b6396f62b2f3ebc4456e025caac476

SHA256
ee031f554dd6219bba513f02a0242017e1bb282e9466b4bc2d971ff55af8a769

SHA512
acb3950ac91e233de5fb3297d5a0eed0663c43b35e5e8e433b88dfd8d21fabbadab37572bec2c08efa051c69b3a881ce3eb5c29a4950b88065f6e92dd9970047

Download Submit
memory/4420-130-0x00000000004E0000-0x00000000005AE000-memory.dmp

Filesize
824KB

Download
memory/4420-131-0x0000000004F10000-0x0000000004FAC000-memory.dmp

Filesize
624KB

Download
memory/4420-132-0x0000000005950000-0x0000000005EF4000-memory.dmp

Filesize
5.6MB

Download
memory/4436-133-0x0000000000000000-mapping.dmp

Download
memory/4436-134-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads