asyncrat | 041a4f5c60d5186913c46f9e0b246354f0944b03eb7d61325a60ae338faebbc8

General

Target

041a4f5c60d5186913c46f9e0b246354f0944b03eb7d61325a60ae338faebbc8.exe
Size

97KB
MD5

9f16a651f918972eee7be4f19d40bb91
SHA1

dd56518e934d22f2e49a12cacc1b0bd7c1ac60a6
SHA256

041a4f5c60d5186913c46f9e0b246354f0944b03eb7d61325a60ae338faebbc8
SHA512

02eef0bd8d9fbdf0fa0ae2e510fa4069d9f6592926397dd540be66c97c6826ec736e4cdf52e153a313260f4c074cd3404083bcfe98d80ce0054af39b557b52b3

Score

10^/10

asyncrat persistence rat

Malware Config

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
rat asyncrat

Async RAT payload 5 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1764-54-0x0000000000D10000-0x0000000000D2E000-memory.dmp	asyncrat
\Users\Admin\AppData\Roaming\Вкк.exe	asyncrat
C:\Users\Admin\AppData\Roaming\Вкк.exe	asyncrat
C:\Users\Admin\AppData\Roaming\Вкк.exe	asyncrat
behavioral1/memory/1720-60-0x0000000000AD0000-0x0000000000AEE000-memory.dmp	asyncrat

Executes dropped EXE 1 IoCs

Processes:

Вкк.exe

pid process

1720 Вкк.exe
Loads dropped DLL 1 IoCs

Processes:

041a4f5c60d5186913c46f9e0b246354f0944b03eb7d61325a60ae338faebbc8.exe

pid process

1764 041a4f5c60d5186913c46f9e0b246354f0944b03eb7d61325a60ae338faebbc8.exe

pid	process
1720	Вкк.exe

pid	process
1764	041a4f5c60d5186913c46f9e0b246354f0944b03eb7d61325a60ae338faebbc8.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

041a4f5c60d5186913c46f9e0b246354f0944b03eb7d61325a60ae338faebbc8.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows\CurrentVersion\Run\Вкк.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Вкк.exe"	041a4f5c60d5186913c46f9e0b246354f0944b03eb7d61325a60ae338faebbc8.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

041a4f5c60d5186913c46f9e0b246354f0944b03eb7d61325a60ae338faebbc8.exe

pid process

1764 041a4f5c60d5186913c46f9e0b246354f0944b03eb7d61325a60ae338faebbc8.exe

pid	process
1764	041a4f5c60d5186913c46f9e0b246354f0944b03eb7d61325a60ae338faebbc8.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

041a4f5c60d5186913c46f9e0b246354f0944b03eb7d61325a60ae338faebbc8.exeВкк.exe

description	pid	process
Token: SeDebugPrivilege	1764	041a4f5c60d5186913c46f9e0b246354f0944b03eb7d61325a60ae338faebbc8.exe
Token: SeDebugPrivilege	1720	Вкк.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

041a4f5c60d5186913c46f9e0b246354f0944b03eb7d61325a60ae338faebbc8.exe

description	pid	process	target process
PID 1764 wrote to memory of 1720	1764	041a4f5c60d5186913c46f9e0b246354f0944b03eb7d61325a60ae338faebbc8.exe	Вкк.exe
PID 1764 wrote to memory of 1720	1764	041a4f5c60d5186913c46f9e0b246354f0944b03eb7d61325a60ae338faebbc8.exe	Вкк.exe
PID 1764 wrote to memory of 1720	1764	041a4f5c60d5186913c46f9e0b246354f0944b03eb7d61325a60ae338faebbc8.exe	Вкк.exe
PID 1764 wrote to memory of 1720	1764	041a4f5c60d5186913c46f9e0b246354f0944b03eb7d61325a60ae338faebbc8.exe	Вкк.exe

C:\Users\Admin\AppData\Local\Temp\041a4f5c60d5186913c46f9e0b246354f0944b03eb7d61325a60ae338faebbc8.exe
"C:\Users\Admin\AppData\Local\Temp\041a4f5c60d5186913c46f9e0b246354f0944b03eb7d61325a60ae338faebbc8.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1764

C:\Users\Admin\AppData\Roaming\Вкк.exe
"C:\Users\Admin\AppData\Roaming\Вкк.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1720

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Вкк.exe
Filesize
97KB

MD5
9f16a651f918972eee7be4f19d40bb91

SHA1
dd56518e934d22f2e49a12cacc1b0bd7c1ac60a6

SHA256
041a4f5c60d5186913c46f9e0b246354f0944b03eb7d61325a60ae338faebbc8

SHA512
02eef0bd8d9fbdf0fa0ae2e510fa4069d9f6592926397dd540be66c97c6826ec736e4cdf52e153a313260f4c074cd3404083bcfe98d80ce0054af39b557b52b3

Download Submit
C:\Users\Admin\AppData\Roaming\Вкк.exe
Filesize
97KB

MD5
9f16a651f918972eee7be4f19d40bb91

SHA1
dd56518e934d22f2e49a12cacc1b0bd7c1ac60a6

SHA256
041a4f5c60d5186913c46f9e0b246354f0944b03eb7d61325a60ae338faebbc8

SHA512
02eef0bd8d9fbdf0fa0ae2e510fa4069d9f6592926397dd540be66c97c6826ec736e4cdf52e153a313260f4c074cd3404083bcfe98d80ce0054af39b557b52b3

Download Submit
\Users\Admin\AppData\Roaming\Вкк.exe
Filesize
97KB

MD5
9f16a651f918972eee7be4f19d40bb91

SHA1
dd56518e934d22f2e49a12cacc1b0bd7c1ac60a6

SHA256
041a4f5c60d5186913c46f9e0b246354f0944b03eb7d61325a60ae338faebbc8

SHA512
02eef0bd8d9fbdf0fa0ae2e510fa4069d9f6592926397dd540be66c97c6826ec736e4cdf52e153a313260f4c074cd3404083bcfe98d80ce0054af39b557b52b3

Download Submit
memory/1720-57-0x0000000000000000-mapping.dmp

Download
memory/1720-60-0x0000000000AD0000-0x0000000000AEE000-memory.dmp

Filesize
120KB

Download
memory/1764-54-0x0000000000D10000-0x0000000000D2E000-memory.dmp

Filesize
120KB

Download
memory/1764-55-0x0000000075361000-0x0000000075363000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads