asyncrat | a5f6b5b6909b3b40d933857cc42d284b743ce9a69ca2baaa5e75dcc4e1c15a19

Analysis

max time kernel
146s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
24/08/2022, 10:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
LIBRA Elektronik GmbH.PDF.exe
Size 1.9MB
Sample220824-mkcvdacbcp
SHA256 a5f6b5b6909b3b40d933857cc42d284b743ce9a69ca2baaa5e75dcc4e1c15a19
MD5 d4544d70916ea92b45a2071d8b350ab1
SHA1 3fae8c21379443b7ac961b9055b57eb7c9ce992a
SHA512 2cd7d720178491209df97bb735ef0c2279ac2ff302f857a39298cb370351924328344cdb811d3b3a815d2b3a0464c63881b8485622de4bf23ba36e1084f3ea52
SSDEEP 24576:ytSn+o+PCKhc4MtzhZYRIJMELSx6siPFeJogx6SMfaLE:X+JfcxBhiRIufiNWpwSMCLE
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

asyncrat rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.6

37.0.14.196:6606
37.0.14.196:7707
37.0.14.196:8808
37.0.14.196:2050

Mutex

zosipyowgjjotojfi

Attributes

delay
5
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral2/memory/2844-138-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat

Loads dropped DLL 2 IoCs

pid	Process
2296	LIBRA Elektronik GmbH.PDF.exe
2296	LIBRA Elektronik GmbH.PDF.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2296 set thread context of 2844	2296	LIBRA Elektronik GmbH.PDF.exe	86

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	RegAsm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	RegAsm.exe

Suspicious behavior: EnumeratesProcesses 25 IoCs

pid	Process
2844	RegAsm.exe
2844	RegAsm.exe
2844	RegAsm.exe
2844	RegAsm.exe
2844	RegAsm.exe
2844	RegAsm.exe
2844	RegAsm.exe
2844	RegAsm.exe
2844	RegAsm.exe
2844	RegAsm.exe
2844	RegAsm.exe
2844	RegAsm.exe
2844	RegAsm.exe
2844	RegAsm.exe
2844	RegAsm.exe
2844	RegAsm.exe
2844	RegAsm.exe
2844	RegAsm.exe
2844	RegAsm.exe
2844	RegAsm.exe
2844	RegAsm.exe
2844	RegAsm.exe
2844	RegAsm.exe
2844	RegAsm.exe
2844	RegAsm.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2296	LIBRA Elektronik GmbH.PDF.exe
Token: SeDebugPrivilege	2844	RegAsm.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2296 wrote to memory of 2844	2296	LIBRA Elektronik GmbH.PDF.exe	86
PID 2296 wrote to memory of 2844	2296	LIBRA Elektronik GmbH.PDF.exe	86
PID 2296 wrote to memory of 2844	2296	LIBRA Elektronik GmbH.PDF.exe	86
PID 2296 wrote to memory of 2844	2296	LIBRA Elektronik GmbH.PDF.exe	86
PID 2296 wrote to memory of 2844	2296	LIBRA Elektronik GmbH.PDF.exe	86
PID 2296 wrote to memory of 2844	2296	LIBRA Elektronik GmbH.PDF.exe	86
PID 2296 wrote to memory of 2844	2296	LIBRA Elektronik GmbH.PDF.exe	86
PID 2296 wrote to memory of 2844	2296	LIBRA Elektronik GmbH.PDF.exe	86

C:\Users\Admin\AppData\Local\Temp\LIBRA Elektronik GmbH.PDF.exe
"C:\Users\Admin\AppData\Local\Temp\LIBRA Elektronik GmbH.PDF.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2296
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2844

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:3972

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

InternalApplicationIdentit.dll

Path C:\Users\Admin\AppData\Roaming\InternalApplicationIdentit.dll
Size 670KB
SHA256 4e1e636d7daf18d321aba24c57564b901affc12ddfe458622f93dc63740f1487
MD5 c9652b395870659636dc088900ff4a1f
SHA1 8e13f8c8d79a2a895522ce849f330e48cf60b047
SHA512 2cc0d8eba90b80fac73a5bd375506a016ab731e110a1d07ad2fdce071b9d32c36769d8253fb217fa2a6e4da425e47e3d54c517b67880c11c2cfec3488320b53d
SSDEEP 3072:iX8BJ2FoQu5PqBjAJtxeHYYwiex8lZRx:iX8BJfQOyBjAnxe
MD5 SHA1 SHA512 SSDEEP

Submit Download

InternalApplicationIdentit.dll

Path C:\Users\Admin\AppData\Roaming\InternalApplicationIdentit.dll
Size 670KB
SHA256 4e1e636d7daf18d321aba24c57564b901affc12ddfe458622f93dc63740f1487
MD5 c9652b395870659636dc088900ff4a1f
SHA1 8e13f8c8d79a2a895522ce849f330e48cf60b047
SHA512 2cc0d8eba90b80fac73a5bd375506a016ab731e110a1d07ad2fdce071b9d32c36769d8253fb217fa2a6e4da425e47e3d54c517b67880c11c2cfec3488320b53d
SSDEEP 3072:iX8BJ2FoQu5PqBjAJtxeHYYwiex8lZRx:iX8BJfQOyBjAnxe
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2296-132-0x0000000000950000-0x0000000000B48000-memory.dmp

Download

memory/2296-135-0x0000000006190000-0x000000000623E000-memory.dmp

Download

memory/2296-136-0x00000000064D0000-0x000000000656C000-memory.dmp

Download

memory/2844-138-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/2844-139-0x0000000005290000-0x00000000052F6000-memory.dmp

Download

memory/2844-140-0x0000000005FA0000-0x0000000006544000-memory.dmp

Download