asyncrat | ef1cddd57724a667599eb57a77aedde1f256853f54698a68a610c3d54f924f1e

General

Target

DOC_20221012_094045716_stripped.scr
Size

105KB
MD5

640cc9bb769a9591c548cc63a15d15bf
SHA1

56e456d997ef4f2735b7ba48a3b0e4861327ed61
SHA256

ef1cddd57724a667599eb57a77aedde1f256853f54698a68a610c3d54f924f1e
SHA512

9e05ca442fae59a54d25fced3a156cd7eb00ba4a0ec80e69468a06639b558ee34c6c6509815eb9a10e6f833d34d48832f073fa7c0f4075ee8da16283d0a58d06
SSDEEP

3072:M+rR+Y6VgvQdJK0vtNZg/V7S+O+dvvAun:M+BFI3vtNZNH+dv

Score

10^/10

asyncrat oct 11 rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

Oct 11

C2

donzola.duckdns.org:2000

Mutex

AsyncMutex_6SI8OkPnk

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
rat asyncrat

Async RAT payload 6 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1468-59-0x0000000000400000-0x0000000000416000-memory.dmp	asyncrat
behavioral1/memory/1468-61-0x0000000000400000-0x0000000000416000-memory.dmp	asyncrat
behavioral1/memory/1468-62-0x0000000000400000-0x0000000000416000-memory.dmp	asyncrat
behavioral1/memory/1468-63-0x000000000040C73E-mapping.dmp	asyncrat
behavioral1/memory/1468-65-0x0000000000400000-0x0000000000416000-memory.dmp	asyncrat
behavioral1/memory/1468-67-0x0000000000400000-0x0000000000416000-memory.dmp	asyncrat

Executes dropped EXE 1 IoCs

Processes:

Windows Media Player Network Sharing Service.exe

pid process

1168 Windows Media Player Network Sharing Service.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

DOC_20221012_094045716_stripped.scr

description pid process target process

PID 1960 set thread context of 1468 1960 DOC_20221012_094045716_stripped.scr DOC_20221012_094045716_stripped.scr
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1380 schtasks.exe

pid	process
1168	Windows Media Player Network Sharing Service.exe

description	pid	process	target process
PID 1960 set thread context of 1468	1960	DOC_20221012_094045716_stripped.scr	DOC_20221012_094045716_stripped.scr

pid	process
1380	schtasks.exe

Suspicious use of WriteProcessMemory 35 IoCs

Processes:

DOC_20221012_094045716_stripped.scrcmd.exetaskeng.exe

description	pid	process	target process
PID 1960 wrote to memory of 1468	1960	DOC_20221012_094045716_stripped.scr	DOC_20221012_094045716_stripped.scr
PID 1960 wrote to memory of 1468	1960	DOC_20221012_094045716_stripped.scr	DOC_20221012_094045716_stripped.scr
PID 1960 wrote to memory of 1468	1960	DOC_20221012_094045716_stripped.scr	DOC_20221012_094045716_stripped.scr
PID 1960 wrote to memory of 1468	1960	DOC_20221012_094045716_stripped.scr	DOC_20221012_094045716_stripped.scr
PID 1960 wrote to memory of 1468	1960	DOC_20221012_094045716_stripped.scr	DOC_20221012_094045716_stripped.scr
PID 1960 wrote to memory of 1468	1960	DOC_20221012_094045716_stripped.scr	DOC_20221012_094045716_stripped.scr
PID 1960 wrote to memory of 1468	1960	DOC_20221012_094045716_stripped.scr	DOC_20221012_094045716_stripped.scr
PID 1960 wrote to memory of 1468	1960	DOC_20221012_094045716_stripped.scr	DOC_20221012_094045716_stripped.scr
PID 1960 wrote to memory of 1468	1960	DOC_20221012_094045716_stripped.scr	DOC_20221012_094045716_stripped.scr
PID 1960 wrote to memory of 1468	1960	DOC_20221012_094045716_stripped.scr	DOC_20221012_094045716_stripped.scr
PID 1960 wrote to memory of 1468	1960	DOC_20221012_094045716_stripped.scr	DOC_20221012_094045716_stripped.scr
PID 1960 wrote to memory of 1468	1960	DOC_20221012_094045716_stripped.scr	DOC_20221012_094045716_stripped.scr
PID 1960 wrote to memory of 276	1960	DOC_20221012_094045716_stripped.scr	cmd.exe
PID 1960 wrote to memory of 276	1960	DOC_20221012_094045716_stripped.scr	cmd.exe
PID 1960 wrote to memory of 276	1960	DOC_20221012_094045716_stripped.scr	cmd.exe
PID 1960 wrote to memory of 276	1960	DOC_20221012_094045716_stripped.scr	cmd.exe
PID 1960 wrote to memory of 436	1960	DOC_20221012_094045716_stripped.scr	cmd.exe
PID 1960 wrote to memory of 436	1960	DOC_20221012_094045716_stripped.scr	cmd.exe
PID 1960 wrote to memory of 436	1960	DOC_20221012_094045716_stripped.scr	cmd.exe
PID 1960 wrote to memory of 436	1960	DOC_20221012_094045716_stripped.scr	cmd.exe
PID 1960 wrote to memory of 588	1960	DOC_20221012_094045716_stripped.scr	cmd.exe
PID 1960 wrote to memory of 588	1960	DOC_20221012_094045716_stripped.scr	cmd.exe
PID 1960 wrote to memory of 588	1960	DOC_20221012_094045716_stripped.scr	cmd.exe
PID 1960 wrote to memory of 588	1960	DOC_20221012_094045716_stripped.scr	cmd.exe
PID 436 wrote to memory of 1380	436	cmd.exe	schtasks.exe
PID 436 wrote to memory of 1380	436	cmd.exe	schtasks.exe
PID 436 wrote to memory of 1380	436	cmd.exe	schtasks.exe
PID 436 wrote to memory of 1380	436	cmd.exe	schtasks.exe
PID 1392 wrote to memory of 1168	1392	taskeng.exe	Windows Media Player Network Sharing Service.exe
PID 1392 wrote to memory of 1168	1392	taskeng.exe	Windows Media Player Network Sharing Service.exe
PID 1392 wrote to memory of 1168	1392	taskeng.exe	Windows Media Player Network Sharing Service.exe
PID 1392 wrote to memory of 1168	1392	taskeng.exe	Windows Media Player Network Sharing Service.exe
PID 1392 wrote to memory of 1168	1392	taskeng.exe	Windows Media Player Network Sharing Service.exe
PID 1392 wrote to memory of 1168	1392	taskeng.exe	Windows Media Player Network Sharing Service.exe
PID 1392 wrote to memory of 1168	1392	taskeng.exe	Windows Media Player Network Sharing Service.exe

C:\Users\Admin\AppData\Local\Temp\DOC_20221012_094045716_stripped.scr
"C:\Users\Admin\AppData\Local\Temp\DOC_20221012_094045716_stripped.scr" /S
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1960

C:\Users\Admin\AppData\Local\Temp\DOC_20221012_094045716_stripped.scr
"C:\Users\Admin\AppData\Local\Temp\DOC_20221012_094045716_stripped.scr"
2⤵
PID:1468

C:\Windows\SysWOW64\cmd.exe
"cmd" /c mkdir "C:\Users\Admin\AppData\Roaming\Windows Media Player Network Sharing Service"
2⤵
PID:276

C:\Windows\SysWOW64\cmd.exe
"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\Windows Media Player Network Sharing Service\Windows Media Player Network Sharing Service.exe'" /f
2⤵
- Suspicious use of WriteProcessMemory
PID:436

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\Windows Media Player Network Sharing Service\Windows Media Player Network Sharing Service.exe'" /f
3⤵
- Creates scheduled task(s)
PID:1380

C:\Windows\SysWOW64\cmd.exe
"cmd" /c copy "C:\Users\Admin\AppData\Local\Temp\DOC_20221012_094045716_stripped.scr" "C:\Users\Admin\AppData\Roaming\Windows Media Player Network Sharing Service\Windows Media Player Network Sharing Service.exe"
2⤵
PID:588

C:\Windows\system32\taskeng.exe
taskeng.exe {05193E2C-6366-4106-8507-9FEFBDF88F1E} S-1-5-21-3845472200-3839195424-595303356-1000:ZERMMMDR\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:1392

C:\Users\Admin\AppData\Roaming\Windows Media Player Network Sharing Service\Windows Media Player Network Sharing Service.exe
"C:\Users\Admin\AppData\Roaming\Windows Media Player Network Sharing Service\Windows Media Player Network Sharing Service.exe"
2⤵
- Executes dropped EXE
PID:1168

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Windows Media Player Network Sharing Service\Windows Media Player Network Sharing Service.exe
Filesize
105KB

MD5
640cc9bb769a9591c548cc63a15d15bf

SHA1
56e456d997ef4f2735b7ba48a3b0e4861327ed61

SHA256
ef1cddd57724a667599eb57a77aedde1f256853f54698a68a610c3d54f924f1e

SHA512
9e05ca442fae59a54d25fced3a156cd7eb00ba4a0ec80e69468a06639b558ee34c6c6509815eb9a10e6f833d34d48832f073fa7c0f4075ee8da16283d0a58d06

Download Submit
C:\Users\Admin\AppData\Roaming\Windows Media Player Network Sharing Service\Windows Media Player Network Sharing Service.exe
Filesize
105KB

MD5
640cc9bb769a9591c548cc63a15d15bf

SHA1
56e456d997ef4f2735b7ba48a3b0e4861327ed61

SHA256
ef1cddd57724a667599eb57a77aedde1f256853f54698a68a610c3d54f924f1e

SHA512
9e05ca442fae59a54d25fced3a156cd7eb00ba4a0ec80e69468a06639b558ee34c6c6509815eb9a10e6f833d34d48832f073fa7c0f4075ee8da16283d0a58d06

Download Submit
memory/276-68-0x0000000000000000-mapping.dmp

Download
memory/436-69-0x0000000000000000-mapping.dmp

Download
memory/588-70-0x0000000000000000-mapping.dmp

Download
memory/1168-76-0x0000000000310000-0x0000000000330000-memory.dmp

Filesize
128KB

Download
memory/1168-74-0x0000000000000000-mapping.dmp

Download
memory/1380-71-0x0000000000000000-mapping.dmp

Download
memory/1468-57-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/1468-67-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/1468-65-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/1468-63-0x000000000040C73E-mapping.dmp

Download
memory/1468-62-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/1468-61-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/1468-59-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/1468-56-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/1960-54-0x0000000000FB0000-0x0000000000FD0000-memory.dmp

Filesize
128KB

Download
memory/1960-55-0x00000000751A1000-0x00000000751A3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads