asyncrat | 8c07c75832300423a6c95e75e776b7ce9de117201bd218d59cc73dc780319649

Analysis

max time kernel
191s
max time network
226s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
28-11-2022 07:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

CamScanner-397841.exe
Size

310KB
MD5

a6c57b4233f83a6c0520774b51f6ee2a
SHA1

2978d695644ed629ae927ea3644f701f7c44f282
SHA256

8c07c75832300423a6c95e75e776b7ce9de117201bd218d59cc73dc780319649
SHA512

aa0e9af462565b4ff2688cffada4321527a06db182b1f6b90d1e88ac4e21891f6fdcc76da8ba16f50784997d54382a229dcb5b2ba28bfd3cc497146339691c51
SSDEEP

6144:0C8TB5f88m6yVaPuEuubHszgySrtdPNwvwmjyF8CyalOh:biMSyVaPuUbH6gySrtXwoWyF5dlw

Score

10^/10

asyncrat default persistence rat

Malware Config

Extracted

Family

asyncrat

Version

1.0.7

Botnet

Default

fghnmvhdf.duckdns.org:8026

Mutex

DcRatMutex_qwqdanchun

Attributes

delay
1
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
rat asyncrat

Async RAT payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/1532-135-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat
behavioral2/memory/1532-136-0x000000000040CBBE-mapping.dmp	asyncrat

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

CamScanner-397841.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\16D21CDED6E346B4889D0F0E9E83C729 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\CamScanner-397841.exe\""	CamScanner-397841.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

CamScanner-397841.exe

description pid process target process

PID 2212 set thread context of 1532 2212 CamScanner-397841.exe InstallUtil.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

CamScanner-397841.exe

description pid process

Token: SeDebugPrivilege 2212 CamScanner-397841.exe

description	pid	process	target process
PID 2212 set thread context of 1532	2212	CamScanner-397841.exe	InstallUtil.exe

description	pid	process
Token: SeDebugPrivilege	2212	CamScanner-397841.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

CamScanner-397841.exe

description	pid	process	target process
PID 2212 wrote to memory of 1532	2212	CamScanner-397841.exe	InstallUtil.exe
PID 2212 wrote to memory of 1532	2212	CamScanner-397841.exe	InstallUtil.exe
PID 2212 wrote to memory of 1532	2212	CamScanner-397841.exe	InstallUtil.exe
PID 2212 wrote to memory of 1532	2212	CamScanner-397841.exe	InstallUtil.exe
PID 2212 wrote to memory of 1532	2212	CamScanner-397841.exe	InstallUtil.exe
PID 2212 wrote to memory of 1532	2212	CamScanner-397841.exe	InstallUtil.exe
PID 2212 wrote to memory of 1532	2212	CamScanner-397841.exe	InstallUtil.exe
PID 2212 wrote to memory of 1532	2212	CamScanner-397841.exe	InstallUtil.exe

C:\Users\Admin\AppData\Local\Temp\CamScanner-397841.exe
"C:\Users\Admin\AppData\Local\Temp\CamScanner-397841.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2212
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
  2⤵
  PID:1532

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1532-135-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1532-136-0x000000000040CBBE-mapping.dmp

Download
memory/2212-132-0x000001A78D490000-0x000001A78D4E2000-memory.dmp

Filesize
328KB

Download
memory/2212-133-0x00007FF8C9B50000-0x00007FF8CA611000-memory.dmp

Filesize
10.8MB

Download
memory/2212-134-0x00007FF8C9B50000-0x00007FF8CA611000-memory.dmp

Filesize
10.8MB

Download
memory/2212-137-0x00007FF8C9B50000-0x00007FF8CA611000-memory.dmp

Filesize
10.8MB

Download