asyncrat | 3f88c9843cb12cb83e1428bd4518a62f6e057904d065a1ff379f4173fc238d50

General

Target

3f88c9843cb12cb83e1428bd4518a62f6e057904d065a1ff379f4173fc238d50.exe
Size

220KB
MD5

5b0eec2cad9696c56031231cd3aadfe7
SHA1

f89faf0532fcef570a12dc14c9ecec5cded37d1b
SHA256

3f88c9843cb12cb83e1428bd4518a62f6e057904d065a1ff379f4173fc238d50
SHA512

eb368a9a030120e89be4881ee28defe381135b5e9be42dbdbe858d9b97c7f359e0d7a692c457375378f020fe8e18cad98c70e2bd8c0cdb3fdfef22b7a51a17ff
SSDEEP

3072:tVUmiLbThQWh4gSPqMcFr1TIVBbF/WmzoaVaBvWRHLQiydGKzrulc0POiwLw9YG:knLbNsg6EzTI7J/poa0BeRQi9YC/POyZ

Score

10^/10

asyncrat default rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

Default

C2

127.0.0.1:6606

127.0.0.1:7707

127.0.0.1:8808

mr7bashbab.ddns.net:6606

mr7bashbab.ddns.net:7707

mr7bashbab.ddns.net:8808

Mutex

AsyncMutex_6SI8OkPnk

Attributes

delay
3
install
true
install_file
OBS.exe
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
rat asyncrat

Async RAT payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/748-55-0x0000000000200000-0x0000000000212000-memory.dmp	asyncrat
behavioral1/memory/1076-66-0x0000000000310000-0x0000000000322000-memory.dmp	asyncrat

Executes dropped EXE 1 IoCs

Processes:

OBS.exe

pid process

1076 OBS.exe
Loads dropped DLL 1 IoCs

Processes:

cmd.exe

pid process

1784 cmd.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1292 schtasks.exe
Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

1360 timeout.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

3f88c9843cb12cb83e1428bd4518a62f6e057904d065a1ff379f4173fc238d50.exe

pid process

748 3f88c9843cb12cb83e1428bd4518a62f6e057904d065a1ff379f4173fc238d50.exe

pid	process
1076	OBS.exe

pid	process
1784	cmd.exe

pid	process
1292	schtasks.exe

pid	process
1360	timeout.exe

pid	process
748	3f88c9843cb12cb83e1428bd4518a62f6e057904d065a1ff379f4173fc238d50.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

3f88c9843cb12cb83e1428bd4518a62f6e057904d065a1ff379f4173fc238d50.exeOBS.exe

description	pid	process
Token: SeDebugPrivilege	748	3f88c9843cb12cb83e1428bd4518a62f6e057904d065a1ff379f4173fc238d50.exe
Token: SeDebugPrivilege	1076	OBS.exe
Token: SeDebugPrivilege	1076	OBS.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

3f88c9843cb12cb83e1428bd4518a62f6e057904d065a1ff379f4173fc238d50.execmd.execmd.exe

description	pid	process	target process
PID 748 wrote to memory of 1952	748	3f88c9843cb12cb83e1428bd4518a62f6e057904d065a1ff379f4173fc238d50.exe	cmd.exe
PID 748 wrote to memory of 1952	748	3f88c9843cb12cb83e1428bd4518a62f6e057904d065a1ff379f4173fc238d50.exe	cmd.exe
PID 748 wrote to memory of 1952	748	3f88c9843cb12cb83e1428bd4518a62f6e057904d065a1ff379f4173fc238d50.exe	cmd.exe
PID 748 wrote to memory of 1952	748	3f88c9843cb12cb83e1428bd4518a62f6e057904d065a1ff379f4173fc238d50.exe	cmd.exe
PID 748 wrote to memory of 1784	748	3f88c9843cb12cb83e1428bd4518a62f6e057904d065a1ff379f4173fc238d50.exe	cmd.exe
PID 748 wrote to memory of 1784	748	3f88c9843cb12cb83e1428bd4518a62f6e057904d065a1ff379f4173fc238d50.exe	cmd.exe
PID 748 wrote to memory of 1784	748	3f88c9843cb12cb83e1428bd4518a62f6e057904d065a1ff379f4173fc238d50.exe	cmd.exe
PID 748 wrote to memory of 1784	748	3f88c9843cb12cb83e1428bd4518a62f6e057904d065a1ff379f4173fc238d50.exe	cmd.exe
PID 1952 wrote to memory of 1292	1952	cmd.exe	schtasks.exe
PID 1952 wrote to memory of 1292	1952	cmd.exe	schtasks.exe
PID 1952 wrote to memory of 1292	1952	cmd.exe	schtasks.exe
PID 1952 wrote to memory of 1292	1952	cmd.exe	schtasks.exe
PID 1784 wrote to memory of 1360	1784	cmd.exe	timeout.exe
PID 1784 wrote to memory of 1360	1784	cmd.exe	timeout.exe
PID 1784 wrote to memory of 1360	1784	cmd.exe	timeout.exe
PID 1784 wrote to memory of 1360	1784	cmd.exe	timeout.exe
PID 1784 wrote to memory of 1076	1784	cmd.exe	OBS.exe
PID 1784 wrote to memory of 1076	1784	cmd.exe	OBS.exe
PID 1784 wrote to memory of 1076	1784	cmd.exe	OBS.exe
PID 1784 wrote to memory of 1076	1784	cmd.exe	OBS.exe

C:\Users\Admin\AppData\Local\Temp\3f88c9843cb12cb83e1428bd4518a62f6e057904d065a1ff379f4173fc238d50.exe
"C:\Users\Admin\AppData\Local\Temp\3f88c9843cb12cb83e1428bd4518a62f6e057904d065a1ff379f4173fc238d50.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:748

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "OBS" /tr '"C:\Users\Admin\AppData\Roaming\OBS.exe"' & exit
2⤵
- Suspicious use of WriteProcessMemory
PID:1952

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /f /sc onlogon /rl highest /tn "OBS" /tr '"C:\Users\Admin\AppData\Roaming\OBS.exe"'
3⤵
- Creates scheduled task(s)
PID:1292

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp281B.tmp.bat""
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1784

C:\Windows\SysWOW64\timeout.exe
timeout 3
3⤵
- Delays execution with timeout.exe
PID:1360

C:\Users\Admin\AppData\Roaming\OBS.exe
"C:\Users\Admin\AppData\Roaming\OBS.exe"
3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1076

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp281B.tmp.bat
Filesize
147B

MD5
e7b368e1a9ce2a99e40b00d0da3f4b73

SHA1
f0673a8e3df8fc97ca7438ee6e618b393d1311d3

SHA256
9f8c6b1a47e55bac81bd1119830305adb2dc539a84b0bfea35fe2882484cd876

SHA512
a28efd7ad71f9a33edafea0c987b4bf14e1069458ce9fed8b21dff591006ba2a2e611fa63358700d771e73c8cab6061b118fb980ade64ef5ee684b00897dbf84

Download Submit
C:\Users\Admin\AppData\Roaming\OBS.exe
Filesize
220KB

MD5
5b0eec2cad9696c56031231cd3aadfe7

SHA1
f89faf0532fcef570a12dc14c9ecec5cded37d1b

SHA256
3f88c9843cb12cb83e1428bd4518a62f6e057904d065a1ff379f4173fc238d50

SHA512
eb368a9a030120e89be4881ee28defe381135b5e9be42dbdbe858d9b97c7f359e0d7a692c457375378f020fe8e18cad98c70e2bd8c0cdb3fdfef22b7a51a17ff

Download Submit
C:\Users\Admin\AppData\Roaming\OBS.exe
Filesize
220KB

MD5
5b0eec2cad9696c56031231cd3aadfe7

SHA1
f89faf0532fcef570a12dc14c9ecec5cded37d1b

SHA256
3f88c9843cb12cb83e1428bd4518a62f6e057904d065a1ff379f4173fc238d50

SHA512
eb368a9a030120e89be4881ee28defe381135b5e9be42dbdbe858d9b97c7f359e0d7a692c457375378f020fe8e18cad98c70e2bd8c0cdb3fdfef22b7a51a17ff

Download Submit
\Users\Admin\AppData\Roaming\OBS.exe
Filesize
220KB

MD5
5b0eec2cad9696c56031231cd3aadfe7

SHA1
f89faf0532fcef570a12dc14c9ecec5cded37d1b

SHA256
3f88c9843cb12cb83e1428bd4518a62f6e057904d065a1ff379f4173fc238d50

SHA512
eb368a9a030120e89be4881ee28defe381135b5e9be42dbdbe858d9b97c7f359e0d7a692c457375378f020fe8e18cad98c70e2bd8c0cdb3fdfef22b7a51a17ff

Download Submit
memory/748-55-0x0000000000200000-0x0000000000212000-memory.dmp

Filesize
72KB

Download
memory/748-54-0x0000000001150000-0x000000000115E000-memory.dmp

Filesize
56KB

Download
memory/1076-63-0x0000000000000000-mapping.dmp

Download
memory/1076-66-0x0000000000310000-0x0000000000322000-memory.dmp

Filesize
72KB

Download
memory/1076-65-0x00000000013A0000-0x00000000013AE000-memory.dmp

Filesize
56KB

Download
memory/1292-59-0x0000000000000000-mapping.dmp

Download
memory/1360-60-0x0000000000000000-mapping.dmp

Download
memory/1784-57-0x0000000000000000-mapping.dmp

Download
memory/1952-56-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads