asyncrat | faa922cd0bf4fe5e36e76eb63712ea0034ffb9fa67a30414bd2e16d257de34f4

General

Target

TRANSFERENCIA DE PAGO A CUENTA BANCARIA.exe
Size

1.8MB
MD5

a72cedec68ccbac443a12c424969a7ae
SHA1

1038d83be7e5186384c5b8d6855670e3e8fb2bd7
SHA256

faa922cd0bf4fe5e36e76eb63712ea0034ffb9fa67a30414bd2e16d257de34f4
SHA512

5deb388207c0f74cddc115e9ac1fef926bf4c41ed22f34fc8b42adda958e065891dc0daea4012608974a05329b7708784bff45b7c59daa186b672bea151f98ef
SSDEEP

49152:rr8glBAq6FzNKUD0HXYdFeYDYuAHIztL:X8WBoYHXYvnsEL

Score

10^/10

asyncrat default persistence rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

Default

C2

wertpkgc.duckdns.org:8091

Mutex

AsyncMutex_6SI8OkPnk

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
rat asyncrat

Async RAT payload 6 IoCs

rat

resource	yara_rule
behavioral1/memory/888-67-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat
behavioral1/memory/888-66-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat
behavioral1/memory/888-68-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat
behavioral1/memory/888-69-0x000000000040C73E-mapping.dmp	asyncrat
behavioral1/memory/888-73-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat
behavioral1/memory/888-71-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\Htesa = "\"C:\\Users\\Admin\\AppData\\Roaming\\Eazzz\\Htesa.exe\""	TRANSFERENCIA DE PAGO A CUENTA BANCARIA.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 536 set thread context of 888	536	TRANSFERENCIA DE PAGO A CUENTA BANCARIA.exe	30

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1988	powershell.exe
536	TRANSFERENCIA DE PAGO A CUENTA BANCARIA.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1988	powershell.exe
Token: SeDebugPrivilege	536	TRANSFERENCIA DE PAGO A CUENTA BANCARIA.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 536 wrote to memory of 1988	536	TRANSFERENCIA DE PAGO A CUENTA BANCARIA.exe	27
PID 536 wrote to memory of 1988	536	TRANSFERENCIA DE PAGO A CUENTA BANCARIA.exe	27
PID 536 wrote to memory of 1988	536	TRANSFERENCIA DE PAGO A CUENTA BANCARIA.exe	27
PID 536 wrote to memory of 1988	536	TRANSFERENCIA DE PAGO A CUENTA BANCARIA.exe	27
PID 536 wrote to memory of 1600	536	TRANSFERENCIA DE PAGO A CUENTA BANCARIA.exe	29
PID 536 wrote to memory of 1600	536	TRANSFERENCIA DE PAGO A CUENTA BANCARIA.exe	29
PID 536 wrote to memory of 1600	536	TRANSFERENCIA DE PAGO A CUENTA BANCARIA.exe	29
PID 536 wrote to memory of 1600	536	TRANSFERENCIA DE PAGO A CUENTA BANCARIA.exe	29
PID 536 wrote to memory of 1600	536	TRANSFERENCIA DE PAGO A CUENTA BANCARIA.exe	29
PID 536 wrote to memory of 1600	536	TRANSFERENCIA DE PAGO A CUENTA BANCARIA.exe	29
PID 536 wrote to memory of 1600	536	TRANSFERENCIA DE PAGO A CUENTA BANCARIA.exe	29
PID 536 wrote to memory of 888	536	TRANSFERENCIA DE PAGO A CUENTA BANCARIA.exe	30
PID 536 wrote to memory of 888	536	TRANSFERENCIA DE PAGO A CUENTA BANCARIA.exe	30
PID 536 wrote to memory of 888	536	TRANSFERENCIA DE PAGO A CUENTA BANCARIA.exe	30
PID 536 wrote to memory of 888	536	TRANSFERENCIA DE PAGO A CUENTA BANCARIA.exe	30
PID 536 wrote to memory of 888	536	TRANSFERENCIA DE PAGO A CUENTA BANCARIA.exe	30
PID 536 wrote to memory of 888	536	TRANSFERENCIA DE PAGO A CUENTA BANCARIA.exe	30
PID 536 wrote to memory of 888	536	TRANSFERENCIA DE PAGO A CUENTA BANCARIA.exe	30
PID 536 wrote to memory of 888	536	TRANSFERENCIA DE PAGO A CUENTA BANCARIA.exe	30
PID 536 wrote to memory of 888	536	TRANSFERENCIA DE PAGO A CUENTA BANCARIA.exe	30
PID 536 wrote to memory of 888	536	TRANSFERENCIA DE PAGO A CUENTA BANCARIA.exe	30
PID 536 wrote to memory of 888	536	TRANSFERENCIA DE PAGO A CUENTA BANCARIA.exe	30
PID 536 wrote to memory of 888	536	TRANSFERENCIA DE PAGO A CUENTA BANCARIA.exe	30

C:\Users\Admin\AppData\Local\Temp\TRANSFERENCIA DE PAGO A CUENTA BANCARIA.exe
"C:\Users\Admin\AppData\Local\Temp\TRANSFERENCIA DE PAGO A CUENTA BANCARIA.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:536
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMgAwAA==
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1988
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
  2⤵
  PID:1600
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
  2⤵
  PID:888

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/536-54-0x0000000000B20000-0x0000000000CE8000-memory.dmp

Filesize
1.8MB

Download
memory/536-55-0x0000000004380000-0x000000000442E000-memory.dmp

Filesize
696KB

Download
memory/536-56-0x0000000076831000-0x0000000076833000-memory.dmp

Filesize
8KB

Download
memory/536-57-0x0000000002190000-0x0000000002222000-memory.dmp

Filesize
584KB

Download
memory/888-68-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/888-63-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/888-64-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/888-67-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/888-66-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/888-73-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/888-71-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1988-60-0x0000000070070000-0x000000007061B000-memory.dmp

Filesize
5.7MB

Download
memory/1988-61-0x0000000070070000-0x000000007061B000-memory.dmp

Filesize
5.7MB

Download
memory/1988-62-0x0000000070070000-0x000000007061B000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing