asyncrat | 387a91f2a3775ee7d2a764fa5219c63478cd497c9a0a5625d63666a7561b2640

General

Target

HEUR-Backdoor.MSIL.Crysan.gen-387a91f2a3775ee7d2a764fa5219c63478cd497c9a0a5625d63666a7561b2640.exe
Size

58KB
MD5

278a0cd8cf2ad02e2f2b139e78406ac9
SHA1

e824197381e55771bf91fe67f3652dd0e75bd4fa
SHA256

387a91f2a3775ee7d2a764fa5219c63478cd497c9a0a5625d63666a7561b2640
SHA512

31bd692fe817af9de4c4aaf26d4f37011827014cf86f8a08e51e9ec77114f0130dd17dcfb9360bb141e0432f0bd9d6ecf59c609e1bb63bdc496fa0309044fbb4
SSDEEP

1536:EuyRNTAGo2s7LI5ymUbZFyn62MHKdVal7:Euy/TAGo2s3I5ymUbZ462Mqval7

Score

10^/10

asyncrat default rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

Default

C2

92.138.188.75:7006

Mutex

AsyncMutex_6SI8OkPnk

Attributes

delay
3
install
true
install_file
anydesk.exe
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
rat asyncrat

Async RAT payload 5 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/828-54-0x0000000000CE0000-0x0000000000CF4000-memory.dmp	asyncrat
\Users\Admin\AppData\Roaming\anydesk.exe	asyncrat
C:\Users\Admin\AppData\Roaming\anydesk.exe	asyncrat
C:\Users\Admin\AppData\Roaming\anydesk.exe	asyncrat
behavioral1/memory/1132-65-0x00000000001F0000-0x0000000000204000-memory.dmp	asyncrat

Executes dropped EXE 1 IoCs

Processes:

anydesk.exe

pid process

1132 anydesk.exe
Loads dropped DLL 1 IoCs

Processes:

cmd.exe

pid process

1496 cmd.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

816 schtasks.exe
Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

300 timeout.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

HEUR-Backdoor.MSIL.Crysan.gen-387a91f2a3775ee7d2a764fa5219c63478cd497c9a0a5625d63666a7561b2640.exe

pid process

828 HEUR-Backdoor.MSIL.Crysan.gen-387a91f2a3775ee7d2a764fa5219c63478cd497c9a0a5625d63666a7561b2640.exe

pid	process
1132	anydesk.exe

pid	process
1496	cmd.exe

pid	process
816	schtasks.exe

pid	process
300	timeout.exe

pid	process
828	HEUR-Backdoor.MSIL.Crysan.gen-387a91f2a3775ee7d2a764fa5219c63478cd497c9a0a5625d63666a7561b2640.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

HEUR-Backdoor.MSIL.Crysan.gen-387a91f2a3775ee7d2a764fa5219c63478cd497c9a0a5625d63666a7561b2640.exeanydesk.exe

description	pid	process
Token: SeDebugPrivilege	828	HEUR-Backdoor.MSIL.Crysan.gen-387a91f2a3775ee7d2a764fa5219c63478cd497c9a0a5625d63666a7561b2640.exe
Token: SeDebugPrivilege	1132	anydesk.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

HEUR-Backdoor.MSIL.Crysan.gen-387a91f2a3775ee7d2a764fa5219c63478cd497c9a0a5625d63666a7561b2640.execmd.execmd.exe

description	pid	process	target process
PID 828 wrote to memory of 1876	828	HEUR-Backdoor.MSIL.Crysan.gen-387a91f2a3775ee7d2a764fa5219c63478cd497c9a0a5625d63666a7561b2640.exe	cmd.exe
PID 828 wrote to memory of 1876	828	HEUR-Backdoor.MSIL.Crysan.gen-387a91f2a3775ee7d2a764fa5219c63478cd497c9a0a5625d63666a7561b2640.exe	cmd.exe
PID 828 wrote to memory of 1876	828	HEUR-Backdoor.MSIL.Crysan.gen-387a91f2a3775ee7d2a764fa5219c63478cd497c9a0a5625d63666a7561b2640.exe	cmd.exe
PID 828 wrote to memory of 1876	828	HEUR-Backdoor.MSIL.Crysan.gen-387a91f2a3775ee7d2a764fa5219c63478cd497c9a0a5625d63666a7561b2640.exe	cmd.exe
PID 828 wrote to memory of 1496	828	HEUR-Backdoor.MSIL.Crysan.gen-387a91f2a3775ee7d2a764fa5219c63478cd497c9a0a5625d63666a7561b2640.exe	cmd.exe
PID 828 wrote to memory of 1496	828	HEUR-Backdoor.MSIL.Crysan.gen-387a91f2a3775ee7d2a764fa5219c63478cd497c9a0a5625d63666a7561b2640.exe	cmd.exe
PID 828 wrote to memory of 1496	828	HEUR-Backdoor.MSIL.Crysan.gen-387a91f2a3775ee7d2a764fa5219c63478cd497c9a0a5625d63666a7561b2640.exe	cmd.exe
PID 828 wrote to memory of 1496	828	HEUR-Backdoor.MSIL.Crysan.gen-387a91f2a3775ee7d2a764fa5219c63478cd497c9a0a5625d63666a7561b2640.exe	cmd.exe
PID 1876 wrote to memory of 816	1876	cmd.exe	schtasks.exe
PID 1876 wrote to memory of 816	1876	cmd.exe	schtasks.exe
PID 1876 wrote to memory of 816	1876	cmd.exe	schtasks.exe
PID 1876 wrote to memory of 816	1876	cmd.exe	schtasks.exe
PID 1496 wrote to memory of 300	1496	cmd.exe	timeout.exe
PID 1496 wrote to memory of 300	1496	cmd.exe	timeout.exe
PID 1496 wrote to memory of 300	1496	cmd.exe	timeout.exe
PID 1496 wrote to memory of 300	1496	cmd.exe	timeout.exe
PID 1496 wrote to memory of 1132	1496	cmd.exe	anydesk.exe
PID 1496 wrote to memory of 1132	1496	cmd.exe	anydesk.exe
PID 1496 wrote to memory of 1132	1496	cmd.exe	anydesk.exe
PID 1496 wrote to memory of 1132	1496	cmd.exe	anydesk.exe

C:\Users\Admin\AppData\Local\Temp\HEUR-Backdoor.MSIL.Crysan.gen-387a91f2a3775ee7d2a764fa5219c63478cd497c9a0a5625d63666a7561b2640.exe
"C:\Users\Admin\AppData\Local\Temp\HEUR-Backdoor.MSIL.Crysan.gen-387a91f2a3775ee7d2a764fa5219c63478cd497c9a0a5625d63666a7561b2640.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:828

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "anydesk" /tr '"C:\Users\Admin\AppData\Roaming\anydesk.exe"' & exit
2⤵
- Suspicious use of WriteProcessMemory
PID:1876

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /f /sc onlogon /rl highest /tn "anydesk" /tr '"C:\Users\Admin\AppData\Roaming\anydesk.exe"'
3⤵
- Creates scheduled task(s)
PID:816

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp2869.tmp.bat""
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1496

C:\Windows\SysWOW64\timeout.exe
timeout 3
3⤵
- Delays execution with timeout.exe
PID:300

C:\Users\Admin\AppData\Roaming\anydesk.exe
"C:\Users\Admin\AppData\Roaming\anydesk.exe"
3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1132

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp2869.tmp.bat
Filesize
151B

MD5
3467d1b3e74b1ed981c00ae12e62a2e3

SHA1
715b69ecdbd08ab85d6a19213b5d8481b3fdcf6f

SHA256
71c9c18ee401f4e8c2fdc78bb4866092dca3515c9ba5261623341ae810dc596e

SHA512
cfbf749360460d9114b018b1795bd41f4b5d10e1ba49fc3f9541166c4b06eef5b01676037e2321f875ace313b0ed9a8313fb7c7b43bf90a4a6380e56ff588a63

Download Submit
C:\Users\Admin\AppData\Roaming\anydesk.exe
Filesize
58KB

MD5
278a0cd8cf2ad02e2f2b139e78406ac9

SHA1
e824197381e55771bf91fe67f3652dd0e75bd4fa

SHA256
387a91f2a3775ee7d2a764fa5219c63478cd497c9a0a5625d63666a7561b2640

SHA512
31bd692fe817af9de4c4aaf26d4f37011827014cf86f8a08e51e9ec77114f0130dd17dcfb9360bb141e0432f0bd9d6ecf59c609e1bb63bdc496fa0309044fbb4

Download Submit
C:\Users\Admin\AppData\Roaming\anydesk.exe
Filesize
58KB

MD5
278a0cd8cf2ad02e2f2b139e78406ac9

SHA1
e824197381e55771bf91fe67f3652dd0e75bd4fa

SHA256
387a91f2a3775ee7d2a764fa5219c63478cd497c9a0a5625d63666a7561b2640

SHA512
31bd692fe817af9de4c4aaf26d4f37011827014cf86f8a08e51e9ec77114f0130dd17dcfb9360bb141e0432f0bd9d6ecf59c609e1bb63bdc496fa0309044fbb4

Download Submit
\Users\Admin\AppData\Roaming\anydesk.exe
Filesize
58KB

MD5
278a0cd8cf2ad02e2f2b139e78406ac9

SHA1
e824197381e55771bf91fe67f3652dd0e75bd4fa

SHA256
387a91f2a3775ee7d2a764fa5219c63478cd497c9a0a5625d63666a7561b2640

SHA512
31bd692fe817af9de4c4aaf26d4f37011827014cf86f8a08e51e9ec77114f0130dd17dcfb9360bb141e0432f0bd9d6ecf59c609e1bb63bdc496fa0309044fbb4

Download Submit
memory/300-60-0x0000000000000000-mapping.dmp

Download
memory/816-59-0x0000000000000000-mapping.dmp

Download
memory/828-54-0x0000000000CE0000-0x0000000000CF4000-memory.dmp

Filesize
80KB

Download
memory/828-55-0x0000000075BB1000-0x0000000075BB3000-memory.dmp

Filesize
8KB

Download
memory/1132-63-0x0000000000000000-mapping.dmp

Download
memory/1132-65-0x00000000001F0000-0x0000000000204000-memory.dmp

Filesize
80KB

Download
memory/1496-57-0x0000000000000000-mapping.dmp

Download
memory/1876-56-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads