asyncrat | bed77ad87299dad74adb4da37fb2b8f6e082ce15aa5eab42e560453060c3375b

General

Target

1660-55-0x0000000000380000-0x0000000000392000-memory.exe
Size

72KB
MD5

9200c5f208c0740d4dcf96b1674d383e
SHA1

e26e185b70b71f2b320ba466f1e0a775d961ef61
SHA256

bed77ad87299dad74adb4da37fb2b8f6e082ce15aa5eab42e560453060c3375b
SHA512

276d12bbf5847ea59766ca1a92a856e441cb7e7dcd0eeaa4ec2db5f596daaf9e1d89d6047a7dafcc7aa4efa48bc05af4ae1aba4b7f024ec8732d3a650029a396

Score

10^/10

asyncrat default rat suricata

Malware Config

Extracted

Family

asyncrat

Version

0.5.6D

Botnet

Default

C2

milla.publicvm.com:6606

milla.publicvm.com:7707

milla.publicvm.com:8808

Mutex

ncwfisdaribhhybik

Attributes

delay
10
install
true
install_file
syastem.exe
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
rat asyncrat
suricata: ET MALWARE Generic AsyncRAT Style SSL Cert
suricata: ET MALWARE Generic AsyncRAT Style SSL Cert
suricata
suricata: ET MALWARE Observed Malicious SSL Cert (AsyncRAT Server)
suricata: ET MALWARE Observed Malicious SSL Cert (AsyncRAT Server)
suricata

Async RAT payload 4 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1600-54-0x0000000000360000-0x0000000000372000-memory.dmp	asyncrat
C:\Users\Admin\AppData\Roaming\syastem.exe	asyncrat
C:\Users\Admin\AppData\Roaming\syastem.exe	asyncrat
behavioral1/memory/276-63-0x0000000000D50000-0x0000000000D62000-memory.dmp	asyncrat

Executes dropped EXE 1 IoCs

Processes:

syastem.exe

pid process

276 syastem.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1072 schtasks.exe
Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

1972 timeout.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

1660-55-0x0000000000380000-0x0000000000392000-memory.exe

pid process

1600 1660-55-0x0000000000380000-0x0000000000392000-memory.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

1660-55-0x0000000000380000-0x0000000000392000-memory.exesyastem.exe

description pid process

Token: SeDebugPrivilege 1600 1660-55-0x0000000000380000-0x0000000000392000-memory.exe
Token: SeDebugPrivilege 276 syastem.exe

pid	process
276	syastem.exe

pid	process
1072	schtasks.exe

pid	process
1972	timeout.exe

pid	process
1600	1660-55-0x0000000000380000-0x0000000000392000-memory.exe

description	pid	process
Token: SeDebugPrivilege	1600	1660-55-0x0000000000380000-0x0000000000392000-memory.exe
Token: SeDebugPrivilege	276	syastem.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

1660-55-0x0000000000380000-0x0000000000392000-memory.execmd.execmd.exe

description	pid	process	target process
PID 1600 wrote to memory of 1692	1600	1660-55-0x0000000000380000-0x0000000000392000-memory.exe	cmd.exe
PID 1600 wrote to memory of 1692	1600	1660-55-0x0000000000380000-0x0000000000392000-memory.exe	cmd.exe
PID 1600 wrote to memory of 1692	1600	1660-55-0x0000000000380000-0x0000000000392000-memory.exe	cmd.exe
PID 1600 wrote to memory of 2016	1600	1660-55-0x0000000000380000-0x0000000000392000-memory.exe	cmd.exe
PID 1600 wrote to memory of 2016	1600	1660-55-0x0000000000380000-0x0000000000392000-memory.exe	cmd.exe
PID 1600 wrote to memory of 2016	1600	1660-55-0x0000000000380000-0x0000000000392000-memory.exe	cmd.exe
PID 1692 wrote to memory of 1072	1692	cmd.exe	schtasks.exe
PID 1692 wrote to memory of 1072	1692	cmd.exe	schtasks.exe
PID 1692 wrote to memory of 1072	1692	cmd.exe	schtasks.exe
PID 2016 wrote to memory of 1972	2016	cmd.exe	timeout.exe
PID 2016 wrote to memory of 1972	2016	cmd.exe	timeout.exe
PID 2016 wrote to memory of 1972	2016	cmd.exe	timeout.exe
PID 2016 wrote to memory of 276	2016	cmd.exe	syastem.exe
PID 2016 wrote to memory of 276	2016	cmd.exe	syastem.exe
PID 2016 wrote to memory of 276	2016	cmd.exe	syastem.exe

C:\Users\Admin\AppData\Local\Temp\1660-55-0x0000000000380000-0x0000000000392000-memory.exe
"C:\Users\Admin\AppData\Local\Temp\1660-55-0x0000000000380000-0x0000000000392000-memory.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1600

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /ru system /rl highest /tn 1660-55-0x0000000000380000-0x0000000000392000-memory /tr '"C:\Users\Admin\AppData\Roaming\syastem.exe"' & exit
2⤵
- Suspicious use of WriteProcessMemory
PID:1692

C:\Windows\system32\schtasks.exe
schtasks /create /f /sc onlogon /ru system /rl highest /tn 1660-55-0x0000000000380000-0x0000000000392000-memory /tr '"C:\Users\Admin\AppData\Roaming\syastem.exe"'
3⤵
- Creates scheduled task(s)
PID:1072

C:\Windows\system32\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp40D8.tmp.bat""
2⤵
- Suspicious use of WriteProcessMemory
PID:2016

C:\Windows\system32\timeout.exe
timeout 3
3⤵
- Delays execution with timeout.exe
PID:1972

C:\Users\Admin\AppData\Roaming\syastem.exe
"C:\Users\Admin\AppData\Roaming\syastem.exe"
3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:276

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp40D8.tmp.bat
Filesize
151B

MD5
4a89ac65e9df17347f3f7eba56bea1ea

SHA1
3bd06181d5c6b6a49ad23fe12204c6bd6c425af0

SHA256
6cf38837224761fc40dea69092475e061c0ef7f9db15abf8cc9f48e110cf56bf

SHA512
748c4142891029acb598b616a3875bdcc141bf8d395d9ff5b33c7461bcdb21ed683a09d9137bd9a42f8742cb64d9d2d67d9e2d590d190067610af33b8c08fcd6

Download Submit
C:\Users\Admin\AppData\Roaming\syastem.exe
Filesize
72KB

MD5
9200c5f208c0740d4dcf96b1674d383e

SHA1
e26e185b70b71f2b320ba466f1e0a775d961ef61

SHA256
bed77ad87299dad74adb4da37fb2b8f6e082ce15aa5eab42e560453060c3375b

SHA512
276d12bbf5847ea59766ca1a92a856e441cb7e7dcd0eeaa4ec2db5f596daaf9e1d89d6047a7dafcc7aa4efa48bc05af4ae1aba4b7f024ec8732d3a650029a396

Download Submit
C:\Users\Admin\AppData\Roaming\syastem.exe
Filesize
72KB

MD5
9200c5f208c0740d4dcf96b1674d383e

SHA1
e26e185b70b71f2b320ba466f1e0a775d961ef61

SHA256
bed77ad87299dad74adb4da37fb2b8f6e082ce15aa5eab42e560453060c3375b

SHA512
276d12bbf5847ea59766ca1a92a856e441cb7e7dcd0eeaa4ec2db5f596daaf9e1d89d6047a7dafcc7aa4efa48bc05af4ae1aba4b7f024ec8732d3a650029a396

Download Submit
memory/276-60-0x0000000000000000-mapping.dmp

Download
memory/276-63-0x0000000000D50000-0x0000000000D62000-memory.dmp

Filesize
72KB

Download
memory/1072-58-0x0000000000000000-mapping.dmp

Download
memory/1600-54-0x0000000000360000-0x0000000000372000-memory.dmp

Filesize
72KB

Download
memory/1692-55-0x0000000000000000-mapping.dmp

Download
memory/1972-59-0x0000000000000000-mapping.dmp

Download
memory/2016-56-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads