asyncrat | 2894d07aa782dcb0bc5c542447e2aba9d86c0c98fff54a91d19f1444abf95b6f

General

Target

Kleinschmidt GmbH Invoices - Payment Receipt.exe
Size

796KB
MD5

3d2af31c95b477dc90f42b825ad7c126
SHA1

9064ca55686edead9351d49c911c184caa236ae7
SHA256

1fec1e11e26b8d1de831b50ff0163dfca3a751e3bb28ea372b54a7c9cc19cff6
SHA512

8da1a7c125eee396cbc7e5a386503ce60c6ef2f187e0d158ab7491e60b90913df452fce94190821c1b41c819963879869756f6cbfe35c44e60efe71dafe1805d
SSDEEP

6144:Gk4I1/j6U/sWc918LevX14oT61JDC2ya7/yo5tNLCFC7z/7tkW/x2RDXY3/+75f0:0UuscX8LqFY1JD/moblCAz5V/qYPe

Score

10^/10

asyncrat default rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

Default

C2

127.0.0.1:6305

209.127.186.218:6305

Mutex

AsyncMutex_6SI8OkPnk

Attributes

delay
3
install
false
install_file
MicroSoft-win.exe
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral2/memory/4996-150-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	Kleinschmidt GmbH Invoices - Payment Receipt.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2188 set thread context of 4996	2188	Kleinschmidt GmbH Invoices - Payment Receipt.exe	105

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
3392	schtasks.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
2188	Kleinschmidt GmbH Invoices - Payment Receipt.exe
2188	Kleinschmidt GmbH Invoices - Payment Receipt.exe
2188	Kleinschmidt GmbH Invoices - Payment Receipt.exe
2188	Kleinschmidt GmbH Invoices - Payment Receipt.exe
2188	Kleinschmidt GmbH Invoices - Payment Receipt.exe
2188	Kleinschmidt GmbH Invoices - Payment Receipt.exe
308	powershell.exe
4756	powershell.exe
2188	Kleinschmidt GmbH Invoices - Payment Receipt.exe
4756	powershell.exe
308	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2188	Kleinschmidt GmbH Invoices - Payment Receipt.exe
Token: SeDebugPrivilege	308	powershell.exe
Token: SeDebugPrivilege	4756	powershell.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 2188 wrote to memory of 4756	2188	Kleinschmidt GmbH Invoices - Payment Receipt.exe	99
PID 2188 wrote to memory of 4756	2188	Kleinschmidt GmbH Invoices - Payment Receipt.exe	99
PID 2188 wrote to memory of 4756	2188	Kleinschmidt GmbH Invoices - Payment Receipt.exe	99
PID 2188 wrote to memory of 308	2188	Kleinschmidt GmbH Invoices - Payment Receipt.exe	101
PID 2188 wrote to memory of 308	2188	Kleinschmidt GmbH Invoices - Payment Receipt.exe	101
PID 2188 wrote to memory of 308	2188	Kleinschmidt GmbH Invoices - Payment Receipt.exe	101
PID 2188 wrote to memory of 3392	2188	Kleinschmidt GmbH Invoices - Payment Receipt.exe	103
PID 2188 wrote to memory of 3392	2188	Kleinschmidt GmbH Invoices - Payment Receipt.exe	103
PID 2188 wrote to memory of 3392	2188	Kleinschmidt GmbH Invoices - Payment Receipt.exe	103
PID 2188 wrote to memory of 4996	2188	Kleinschmidt GmbH Invoices - Payment Receipt.exe	105
PID 2188 wrote to memory of 4996	2188	Kleinschmidt GmbH Invoices - Payment Receipt.exe	105
PID 2188 wrote to memory of 4996	2188	Kleinschmidt GmbH Invoices - Payment Receipt.exe	105
PID 2188 wrote to memory of 4996	2188	Kleinschmidt GmbH Invoices - Payment Receipt.exe	105
PID 2188 wrote to memory of 4996	2188	Kleinschmidt GmbH Invoices - Payment Receipt.exe	105
PID 2188 wrote to memory of 4996	2188	Kleinschmidt GmbH Invoices - Payment Receipt.exe	105
PID 2188 wrote to memory of 4996	2188	Kleinschmidt GmbH Invoices - Payment Receipt.exe	105
PID 2188 wrote to memory of 4996	2188	Kleinschmidt GmbH Invoices - Payment Receipt.exe	105

C:\Users\Admin\AppData\Local\Temp\Kleinschmidt GmbH Invoices - Payment Receipt.exe
"C:\Users\Admin\AppData\Local\Temp\Kleinschmidt GmbH Invoices - Payment Receipt.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2188
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Kleinschmidt GmbH Invoices - Payment Receipt.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4756
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\bVUhnvekcvHWd.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:308
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\bVUhnvekcvHWd" /XML "C:\Users\Admin\AppData\Local\Temp\tmp7BF6.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:3392
- C:\Users\Admin\AppData\Local\Temp\Kleinschmidt GmbH Invoices - Payment Receipt.exe
  "C:\Users\Admin\AppData\Local\Temp\Kleinschmidt GmbH Invoices - Payment Receipt.exe"
  2⤵
  PID:4996

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
3d086a433708053f9bf9523e1d87a4e8

SHA1
b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28

SHA256
6f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69

SHA512
931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
913240a0ecdd4e5143fd491b71a3b46d

SHA1
419de92c376f2595eb56dffe1eec84c6cdb3791e

SHA256
9ec8df3739010942d5531e29fca9f9db017240bc065867fc5cd5ea329e7e5450

SHA512
1044f0d104f32b86037c0995a145632fcf45c537092ef7050562f0bd01031864cbac4fb7273997131a28f91ae51be17a7d20eb9098fb539ea5c940dce30366d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp7BF6.tmp

Filesize
1KB

MD5
7f8afc4bc919dca98113b44900af9915

SHA1
d4f80e19265ebddf432eb20a56f5558109c35e01

SHA256
8a568ae935b3adfb91c79ad0fde4637526abc976f9a294cbc6ee56a91bc53b68

SHA512
b56abc39f714c760aaf70fc0cc86a7b1a1581168f3778e176b199984f802430ed099de885407006eb4a3b8704cf0adda7b9d9dbc1aff9a9454266a1f53672c5d

Download Submit
memory/308-160-0x0000000007A10000-0x0000000007A1E000-memory.dmp

Filesize
56KB

Download
memory/308-161-0x0000000007B20000-0x0000000007B3A000-memory.dmp

Filesize
104KB

Download
memory/308-154-0x0000000007490000-0x00000000074AE000-memory.dmp

Filesize
120KB

Download
memory/308-157-0x00000000077E0000-0x00000000077FA000-memory.dmp

Filesize
104KB

Download
memory/308-142-0x0000000000000000-mapping.dmp

Download
memory/308-153-0x00000000757A0000-0x00000000757EC000-memory.dmp

Filesize
304KB

Download
memory/308-159-0x0000000007A60000-0x0000000007AF6000-memory.dmp

Filesize
600KB

Download
memory/308-162-0x0000000007B00000-0x0000000007B08000-memory.dmp

Filesize
32KB

Download
memory/308-147-0x0000000005530000-0x0000000005552000-memory.dmp

Filesize
136KB

Download
memory/308-151-0x00000000064C0000-0x00000000064DE000-memory.dmp

Filesize
120KB

Download
memory/308-148-0x0000000005E00000-0x0000000005E66000-memory.dmp

Filesize
408KB

Download
memory/2188-137-0x00000000059F0000-0x0000000005A82000-memory.dmp

Filesize
584KB

Download
memory/2188-135-0x0000000000FA0000-0x000000000106C000-memory.dmp

Filesize
816KB

Download
memory/2188-136-0x0000000005FA0000-0x0000000006544000-memory.dmp

Filesize
5.6MB

Download
memory/2188-139-0x0000000009420000-0x00000000094BC000-memory.dmp

Filesize
624KB

Download
memory/2188-138-0x0000000005B80000-0x0000000005B8A000-memory.dmp

Filesize
40KB

Download
memory/2188-140-0x0000000009750000-0x00000000097B6000-memory.dmp

Filesize
408KB

Download
memory/3392-144-0x0000000000000000-mapping.dmp

Download
memory/4756-156-0x0000000007E00000-0x000000000847A000-memory.dmp

Filesize
6.5MB

Download
memory/4756-155-0x00000000757A0000-0x00000000757EC000-memory.dmp

Filesize
304KB

Download
memory/4756-158-0x00000000077A0000-0x00000000077AA000-memory.dmp

Filesize
40KB

Download
memory/4756-152-0x0000000006A00000-0x0000000006A32000-memory.dmp

Filesize
200KB

Download
memory/4756-145-0x00000000055A0000-0x0000000005BC8000-memory.dmp

Filesize
6.2MB

Download
memory/4756-143-0x0000000004E60000-0x0000000004E96000-memory.dmp

Filesize
216KB

Download
memory/4756-141-0x0000000000000000-mapping.dmp

Download
memory/4996-150-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/4996-149-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads