asyncrat | 93df1c272022c2a5bc8bcb8247ffc932837ea4de9f6044da8953a3a1078ab018

General

Target

93df1c272022c2a5bc8bcb8247ffc932837ea4de9f6044da8953a3a1078ab018.exe
Size

486KB
MD5

273f2c55c1982fc3ec6450639609f38a
SHA1

02db2875babca34c81f4979134cba8422c7ef262
SHA256

93df1c272022c2a5bc8bcb8247ffc932837ea4de9f6044da8953a3a1078ab018
SHA512

a65de5f5bf0f47c399108f6b59405327be7a1037a2b6597a5eef4b13c3483347885a86a6662770bd34a8aea61445ac29cab93e330739453922dcbacf7b743e38

Score

10^/10

asyncrat default rat suricata

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

Default

C2

vivald21.hopto.org:9954

63.141.237.188:9954

Mutex

AsyncMutex_6SI8OkPnk

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
rat asyncrat
suricata: ET MALWARE Generic AsyncRAT Style SSL Cert
suricata: ET MALWARE Generic AsyncRAT Style SSL Cert
suricata
suricata: ET MALWARE Observed Malicious SSL Cert (AsyncRAT Server)
suricata: ET MALWARE Observed Malicious SSL Cert (AsyncRAT Server)
suricata

Async RAT payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/3568-141-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

93df1c272022c2a5bc8bcb8247ffc932837ea4de9f6044da8953a3a1078ab018.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation	93df1c272022c2a5bc8bcb8247ffc932837ea4de9f6044da8953a3a1078ab018.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

93df1c272022c2a5bc8bcb8247ffc932837ea4de9f6044da8953a3a1078ab018.exe

description	pid	process	target process
PID 4776 set thread context of 3568	4776	93df1c272022c2a5bc8bcb8247ffc932837ea4de9f6044da8953a3a1078ab018.exe	93df1c272022c2a5bc8bcb8247ffc932837ea4de9f6044da8953a3a1078ab018.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

4648 schtasks.exe

pid	process
4648	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

93df1c272022c2a5bc8bcb8247ffc932837ea4de9f6044da8953a3a1078ab018.exepowershell.exe

pid	process
4776	93df1c272022c2a5bc8bcb8247ffc932837ea4de9f6044da8953a3a1078ab018.exe
4776	93df1c272022c2a5bc8bcb8247ffc932837ea4de9f6044da8953a3a1078ab018.exe
4776	93df1c272022c2a5bc8bcb8247ffc932837ea4de9f6044da8953a3a1078ab018.exe
4776	93df1c272022c2a5bc8bcb8247ffc932837ea4de9f6044da8953a3a1078ab018.exe
4776	93df1c272022c2a5bc8bcb8247ffc932837ea4de9f6044da8953a3a1078ab018.exe
4776	93df1c272022c2a5bc8bcb8247ffc932837ea4de9f6044da8953a3a1078ab018.exe
4776	93df1c272022c2a5bc8bcb8247ffc932837ea4de9f6044da8953a3a1078ab018.exe
4776	93df1c272022c2a5bc8bcb8247ffc932837ea4de9f6044da8953a3a1078ab018.exe
3064	powershell.exe
3064	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

93df1c272022c2a5bc8bcb8247ffc932837ea4de9f6044da8953a3a1078ab018.exepowershell.exe93df1c272022c2a5bc8bcb8247ffc932837ea4de9f6044da8953a3a1078ab018.exe

description	pid	process
Token: SeDebugPrivilege	4776	93df1c272022c2a5bc8bcb8247ffc932837ea4de9f6044da8953a3a1078ab018.exe
Token: SeDebugPrivilege	3064	powershell.exe
Token: SeDebugPrivilege	3568	93df1c272022c2a5bc8bcb8247ffc932837ea4de9f6044da8953a3a1078ab018.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

93df1c272022c2a5bc8bcb8247ffc932837ea4de9f6044da8953a3a1078ab018.exe

description	pid	process	target process
PID 4776 wrote to memory of 3064	4776	93df1c272022c2a5bc8bcb8247ffc932837ea4de9f6044da8953a3a1078ab018.exe	powershell.exe
PID 4776 wrote to memory of 3064	4776	93df1c272022c2a5bc8bcb8247ffc932837ea4de9f6044da8953a3a1078ab018.exe	powershell.exe
PID 4776 wrote to memory of 3064	4776	93df1c272022c2a5bc8bcb8247ffc932837ea4de9f6044da8953a3a1078ab018.exe	powershell.exe
PID 4776 wrote to memory of 4648	4776	93df1c272022c2a5bc8bcb8247ffc932837ea4de9f6044da8953a3a1078ab018.exe	schtasks.exe
PID 4776 wrote to memory of 4648	4776	93df1c272022c2a5bc8bcb8247ffc932837ea4de9f6044da8953a3a1078ab018.exe	schtasks.exe
PID 4776 wrote to memory of 4648	4776	93df1c272022c2a5bc8bcb8247ffc932837ea4de9f6044da8953a3a1078ab018.exe	schtasks.exe
PID 4776 wrote to memory of 3568	4776	93df1c272022c2a5bc8bcb8247ffc932837ea4de9f6044da8953a3a1078ab018.exe	93df1c272022c2a5bc8bcb8247ffc932837ea4de9f6044da8953a3a1078ab018.exe
PID 4776 wrote to memory of 3568	4776	93df1c272022c2a5bc8bcb8247ffc932837ea4de9f6044da8953a3a1078ab018.exe	93df1c272022c2a5bc8bcb8247ffc932837ea4de9f6044da8953a3a1078ab018.exe
PID 4776 wrote to memory of 3568	4776	93df1c272022c2a5bc8bcb8247ffc932837ea4de9f6044da8953a3a1078ab018.exe	93df1c272022c2a5bc8bcb8247ffc932837ea4de9f6044da8953a3a1078ab018.exe
PID 4776 wrote to memory of 3568	4776	93df1c272022c2a5bc8bcb8247ffc932837ea4de9f6044da8953a3a1078ab018.exe	93df1c272022c2a5bc8bcb8247ffc932837ea4de9f6044da8953a3a1078ab018.exe
PID 4776 wrote to memory of 3568	4776	93df1c272022c2a5bc8bcb8247ffc932837ea4de9f6044da8953a3a1078ab018.exe	93df1c272022c2a5bc8bcb8247ffc932837ea4de9f6044da8953a3a1078ab018.exe
PID 4776 wrote to memory of 3568	4776	93df1c272022c2a5bc8bcb8247ffc932837ea4de9f6044da8953a3a1078ab018.exe	93df1c272022c2a5bc8bcb8247ffc932837ea4de9f6044da8953a3a1078ab018.exe
PID 4776 wrote to memory of 3568	4776	93df1c272022c2a5bc8bcb8247ffc932837ea4de9f6044da8953a3a1078ab018.exe	93df1c272022c2a5bc8bcb8247ffc932837ea4de9f6044da8953a3a1078ab018.exe
PID 4776 wrote to memory of 3568	4776	93df1c272022c2a5bc8bcb8247ffc932837ea4de9f6044da8953a3a1078ab018.exe	93df1c272022c2a5bc8bcb8247ffc932837ea4de9f6044da8953a3a1078ab018.exe

C:\Users\Admin\AppData\Local\Temp\93df1c272022c2a5bc8bcb8247ffc932837ea4de9f6044da8953a3a1078ab018.exe
"C:\Users\Admin\AppData\Local\Temp\93df1c272022c2a5bc8bcb8247ffc932837ea4de9f6044da8953a3a1078ab018.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4776

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\mqJGmcQXQtGbX.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3064

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\mqJGmcQXQtGbX" /XML "C:\Users\Admin\AppData\Local\Temp\tmp8FCC.tmp"
2⤵
- Creates scheduled task(s)
PID:4648

C:\Users\Admin\AppData\Local\Temp\93df1c272022c2a5bc8bcb8247ffc932837ea4de9f6044da8953a3a1078ab018.exe
"C:\Users\Admin\AppData\Local\Temp\93df1c272022c2a5bc8bcb8247ffc932837ea4de9f6044da8953a3a1078ab018.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3568

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp8FCC.tmp
Filesize
1KB

MD5
449f9067ee886e7d9365d183bca5d1cc

SHA1
3dd1068d5beec55ac2d78309d02d1c53ad3292ae

SHA256
04219ea7b9a62b3fb10a882d910b9b9520e3c8f6a6a10cde4309bd961bf16cac

SHA512
0ff56629141045f04db103a542342eae3f0a2817cdd0c4c2bf20008b205b0d9fd8f5cce8a45c70460077c17a3e3de3d31b64f7cd84017d1264f60e0f19fdf1a1

Download Submit
memory/3064-142-0x0000000004D20000-0x0000000005348000-memory.dmp

Filesize
6.2MB

Download
memory/3064-150-0x0000000006EB0000-0x0000000006ECA000-memory.dmp

Filesize
104KB

Download
memory/3064-143-0x0000000004BF0000-0x0000000004C12000-memory.dmp

Filesize
136KB

Download
memory/3064-155-0x00000000071D0000-0x00000000071D8000-memory.dmp

Filesize
32KB

Download
memory/3064-144-0x0000000004C90000-0x0000000004CF6000-memory.dmp

Filesize
408KB

Download
memory/3064-136-0x0000000000000000-mapping.dmp

Download
memory/3064-154-0x00000000071F0000-0x000000000720A000-memory.dmp

Filesize
104KB

Download
memory/3064-145-0x0000000005BA0000-0x0000000005BBE000-memory.dmp

Filesize
120KB

Download
memory/3064-153-0x00000000070E0000-0x00000000070EE000-memory.dmp

Filesize
56KB

Download
memory/3064-152-0x0000000007130000-0x00000000071C6000-memory.dmp

Filesize
600KB

Download
memory/3064-151-0x0000000006F20000-0x0000000006F2A000-memory.dmp

Filesize
40KB

Download
memory/3064-149-0x0000000007500000-0x0000000007B7A000-memory.dmp

Filesize
6.5MB

Download
memory/3064-148-0x0000000006D20000-0x0000000006D3E000-memory.dmp

Filesize
120KB

Download
memory/3064-147-0x0000000070D80000-0x0000000070DCC000-memory.dmp

Filesize
304KB

Download
memory/3064-139-0x00000000022A0000-0x00000000022D6000-memory.dmp

Filesize
216KB

Download
memory/3064-146-0x0000000006D60000-0x0000000006D92000-memory.dmp

Filesize
200KB

Download
memory/3568-141-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/3568-140-0x0000000000000000-mapping.dmp

Download
memory/4648-137-0x0000000000000000-mapping.dmp

Download
memory/4776-135-0x0000000001260000-0x00000000012C6000-memory.dmp

Filesize
408KB

Download
memory/4776-133-0x00000000054B0000-0x00000000054BA000-memory.dmp

Filesize
40KB

Download
memory/4776-130-0x00000000009E0000-0x0000000000A60000-memory.dmp

Filesize
512KB

Download
memory/4776-132-0x00000000052C0000-0x0000000005352000-memory.dmp

Filesize
584KB

Download
memory/4776-131-0x00000000057C0000-0x0000000005D64000-memory.dmp

Filesize
5.6MB

Download
memory/4776-134-0x0000000009330000-0x00000000093CC000-memory.dmp

Filesize
624KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads