asyncrat | af51aadc7d93eea0355ed2605959052333a0e124753ff5df78d16bcbf5031fbe

General

Target

ScanCopy378493rh1.scr.exe
Size

1.0MB
MD5

c5da839b1c6505b50f9d18588bc29dcc
SHA1

808bcb8114f6188448b06ef581965e6ee09d4562
SHA256

af51aadc7d93eea0355ed2605959052333a0e124753ff5df78d16bcbf5031fbe
SHA512

03cc401161ae408e0b585aee60db9caec298a9f69cd5b1323417dc49771cceb7df3711886542ca7add6ff62091c83b0ae127c26ea2f4112ca6f84edff4e7952d
SSDEEP

12288:7SDJuxq0TA5FCxv2eP0Kla6EMAXmnSBY5eUk4MVYolDfyWEYjms8hV:7S9RK4i0p9r2iYDcmy3qs8hV

Score

10^/10

asyncrat ijefunds rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.7A

Botnet

Ijefunds

C2

79.134.225.20:8808

Mutex

mmkawdairhcehilxluo

Attributes

delay
1
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
rat asyncrat

Async RAT payload 6 IoCs

rat

resource	yara_rule
behavioral1/memory/916-67-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat
behavioral1/memory/916-68-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat
behavioral1/memory/916-70-0x000000000040C62E-mapping.dmp	asyncrat
behavioral1/memory/916-69-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat
behavioral1/memory/916-72-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat
behavioral1/memory/916-74-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 544 set thread context of 916	544	ScanCopy378493rh1.scr.exe	30

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1308	schtasks.exe

Suspicious behavior: EnumeratesProcesses 27 IoCs

pid	Process
544	ScanCopy378493rh1.scr.exe
544	ScanCopy378493rh1.scr.exe
544	ScanCopy378493rh1.scr.exe
544	ScanCopy378493rh1.scr.exe
544	ScanCopy378493rh1.scr.exe
544	ScanCopy378493rh1.scr.exe
544	ScanCopy378493rh1.scr.exe
544	ScanCopy378493rh1.scr.exe
544	ScanCopy378493rh1.scr.exe
544	ScanCopy378493rh1.scr.exe
544	ScanCopy378493rh1.scr.exe
544	ScanCopy378493rh1.scr.exe
544	ScanCopy378493rh1.scr.exe
544	ScanCopy378493rh1.scr.exe
544	ScanCopy378493rh1.scr.exe
544	ScanCopy378493rh1.scr.exe
544	ScanCopy378493rh1.scr.exe
544	ScanCopy378493rh1.scr.exe
544	ScanCopy378493rh1.scr.exe
544	ScanCopy378493rh1.scr.exe
544	ScanCopy378493rh1.scr.exe
544	ScanCopy378493rh1.scr.exe
544	ScanCopy378493rh1.scr.exe
544	ScanCopy378493rh1.scr.exe
544	ScanCopy378493rh1.scr.exe
544	ScanCopy378493rh1.scr.exe
940	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	544	ScanCopy378493rh1.scr.exe
Token: SeDebugPrivilege	940	powershell.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 544 wrote to memory of 940	544	ScanCopy378493rh1.scr.exe	26
PID 544 wrote to memory of 940	544	ScanCopy378493rh1.scr.exe	26
PID 544 wrote to memory of 940	544	ScanCopy378493rh1.scr.exe	26
PID 544 wrote to memory of 940	544	ScanCopy378493rh1.scr.exe	26
PID 544 wrote to memory of 1308	544	ScanCopy378493rh1.scr.exe	28
PID 544 wrote to memory of 1308	544	ScanCopy378493rh1.scr.exe	28
PID 544 wrote to memory of 1308	544	ScanCopy378493rh1.scr.exe	28
PID 544 wrote to memory of 1308	544	ScanCopy378493rh1.scr.exe	28
PID 544 wrote to memory of 916	544	ScanCopy378493rh1.scr.exe	30
PID 544 wrote to memory of 916	544	ScanCopy378493rh1.scr.exe	30
PID 544 wrote to memory of 916	544	ScanCopy378493rh1.scr.exe	30
PID 544 wrote to memory of 916	544	ScanCopy378493rh1.scr.exe	30
PID 544 wrote to memory of 916	544	ScanCopy378493rh1.scr.exe	30
PID 544 wrote to memory of 916	544	ScanCopy378493rh1.scr.exe	30
PID 544 wrote to memory of 916	544	ScanCopy378493rh1.scr.exe	30
PID 544 wrote to memory of 916	544	ScanCopy378493rh1.scr.exe	30
PID 544 wrote to memory of 916	544	ScanCopy378493rh1.scr.exe	30

C:\Users\Admin\AppData\Local\Temp\ScanCopy378493rh1.scr.exe
"C:\Users\Admin\AppData\Local\Temp\ScanCopy378493rh1.scr.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:544
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\rahWQrxsGOiUO.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:940
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\rahWQrxsGOiUO" /XML "C:\Users\Admin\AppData\Local\Temp\tmp4931.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:1308
- C:\Users\Admin\AppData\Local\Temp\ScanCopy378493rh1.scr.exe
  "C:\Users\Admin\AppData\Local\Temp\ScanCopy378493rh1.scr.exe"
  2⤵
  PID:916

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp4931.tmp

Filesize
1KB

MD5
b847d398f04a752619273c77bb047897

SHA1
1d487b760266f9f1d1bf60e9b301c314a56686a0

SHA256
39d5b698f17feab1ee5fc3f46acfc17129c00f0fbb34125033d1db701baa835c

SHA512
949dd54b91c8054d0cdea96250f41f648487af05ec9769d66ac0815b411d18993c6db38a3889dd1ccb474cd430a4b5646e25cabb212cee674b4e36cee18707e1

Download Submit
memory/544-63-0x0000000001150000-0x0000000001162000-memory.dmp

Filesize
72KB

Download
memory/544-55-0x0000000075A91000-0x0000000075A93000-memory.dmp

Filesize
8KB

Download
memory/544-57-0x00000000004A0000-0x00000000004AC000-memory.dmp

Filesize
48KB

Download
memory/544-58-0x0000000005D30000-0x0000000005D9E000-memory.dmp

Filesize
440KB

Download
memory/544-56-0x00000000002C0000-0x00000000002DA000-memory.dmp

Filesize
104KB

Download
memory/544-54-0x0000000001170000-0x0000000001276000-memory.dmp

Filesize
1.0MB

Download
memory/916-69-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/916-67-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/916-65-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/916-68-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/916-64-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/916-72-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/916-74-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/940-75-0x000000006E7E0000-0x000000006ED8B000-memory.dmp

Filesize
5.7MB

Download
memory/940-77-0x000000006E7E0000-0x000000006ED8B000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads