asyncrat | 3f88c9843cb12cb83e1428bd4518a62f6e057904d065a1ff379f4173fc238d50

General

Target

3f88c9843cb12cb83e1428bd4518a62f6e057904d065a1ff379f4173fc238d50.exe
Size

220KB
MD5

5b0eec2cad9696c56031231cd3aadfe7
SHA1

f89faf0532fcef570a12dc14c9ecec5cded37d1b
SHA256

3f88c9843cb12cb83e1428bd4518a62f6e057904d065a1ff379f4173fc238d50
SHA512

eb368a9a030120e89be4881ee28defe381135b5e9be42dbdbe858d9b97c7f359e0d7a692c457375378f020fe8e18cad98c70e2bd8c0cdb3fdfef22b7a51a17ff
SSDEEP

3072:tVUmiLbThQWh4gSPqMcFr1TIVBbF/WmzoaVaBvWRHLQiydGKzrulc0POiwLw9YG:knLbNsg6EzTI7J/poa0BeRQi9YC/POyZ

Score

10^/10

asyncrat rat

Malware Config

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
rat asyncrat
Executes dropped EXE 1 IoCs

Processes:

OBS.exe

pid process

628 OBS.exe

pid	process
628	OBS.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

3f88c9843cb12cb83e1428bd4518a62f6e057904d065a1ff379f4173fc238d50.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	3f88c9843cb12cb83e1428bd4518a62f6e057904d065a1ff379f4173fc238d50.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

3636 schtasks.exe
Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

2768 timeout.exe

pid	process
3636	schtasks.exe

pid	process
2768	timeout.exe

Suspicious behavior: EnumeratesProcesses 23 IoCs

Processes:

3f88c9843cb12cb83e1428bd4518a62f6e057904d065a1ff379f4173fc238d50.exe

pid	process
2896	3f88c9843cb12cb83e1428bd4518a62f6e057904d065a1ff379f4173fc238d50.exe
2896	3f88c9843cb12cb83e1428bd4518a62f6e057904d065a1ff379f4173fc238d50.exe
2896	3f88c9843cb12cb83e1428bd4518a62f6e057904d065a1ff379f4173fc238d50.exe
2896	3f88c9843cb12cb83e1428bd4518a62f6e057904d065a1ff379f4173fc238d50.exe
2896	3f88c9843cb12cb83e1428bd4518a62f6e057904d065a1ff379f4173fc238d50.exe
2896	3f88c9843cb12cb83e1428bd4518a62f6e057904d065a1ff379f4173fc238d50.exe
2896	3f88c9843cb12cb83e1428bd4518a62f6e057904d065a1ff379f4173fc238d50.exe
2896	3f88c9843cb12cb83e1428bd4518a62f6e057904d065a1ff379f4173fc238d50.exe
2896	3f88c9843cb12cb83e1428bd4518a62f6e057904d065a1ff379f4173fc238d50.exe
2896	3f88c9843cb12cb83e1428bd4518a62f6e057904d065a1ff379f4173fc238d50.exe
2896	3f88c9843cb12cb83e1428bd4518a62f6e057904d065a1ff379f4173fc238d50.exe
2896	3f88c9843cb12cb83e1428bd4518a62f6e057904d065a1ff379f4173fc238d50.exe
2896	3f88c9843cb12cb83e1428bd4518a62f6e057904d065a1ff379f4173fc238d50.exe
2896	3f88c9843cb12cb83e1428bd4518a62f6e057904d065a1ff379f4173fc238d50.exe
2896	3f88c9843cb12cb83e1428bd4518a62f6e057904d065a1ff379f4173fc238d50.exe
2896	3f88c9843cb12cb83e1428bd4518a62f6e057904d065a1ff379f4173fc238d50.exe
2896	3f88c9843cb12cb83e1428bd4518a62f6e057904d065a1ff379f4173fc238d50.exe
2896	3f88c9843cb12cb83e1428bd4518a62f6e057904d065a1ff379f4173fc238d50.exe
2896	3f88c9843cb12cb83e1428bd4518a62f6e057904d065a1ff379f4173fc238d50.exe
2896	3f88c9843cb12cb83e1428bd4518a62f6e057904d065a1ff379f4173fc238d50.exe
2896	3f88c9843cb12cb83e1428bd4518a62f6e057904d065a1ff379f4173fc238d50.exe
2896	3f88c9843cb12cb83e1428bd4518a62f6e057904d065a1ff379f4173fc238d50.exe
2896	3f88c9843cb12cb83e1428bd4518a62f6e057904d065a1ff379f4173fc238d50.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

3f88c9843cb12cb83e1428bd4518a62f6e057904d065a1ff379f4173fc238d50.exeOBS.exe

description	pid	process
Token: SeDebugPrivilege	2896	3f88c9843cb12cb83e1428bd4518a62f6e057904d065a1ff379f4173fc238d50.exe
Token: SeDebugPrivilege	628	OBS.exe
Token: SeDebugPrivilege	628	OBS.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

3f88c9843cb12cb83e1428bd4518a62f6e057904d065a1ff379f4173fc238d50.execmd.execmd.exe

description	pid	process	target process
PID 2896 wrote to memory of 116	2896	3f88c9843cb12cb83e1428bd4518a62f6e057904d065a1ff379f4173fc238d50.exe	cmd.exe
PID 2896 wrote to memory of 116	2896	3f88c9843cb12cb83e1428bd4518a62f6e057904d065a1ff379f4173fc238d50.exe	cmd.exe
PID 2896 wrote to memory of 116	2896	3f88c9843cb12cb83e1428bd4518a62f6e057904d065a1ff379f4173fc238d50.exe	cmd.exe
PID 2896 wrote to memory of 3472	2896	3f88c9843cb12cb83e1428bd4518a62f6e057904d065a1ff379f4173fc238d50.exe	cmd.exe
PID 2896 wrote to memory of 3472	2896	3f88c9843cb12cb83e1428bd4518a62f6e057904d065a1ff379f4173fc238d50.exe	cmd.exe
PID 2896 wrote to memory of 3472	2896	3f88c9843cb12cb83e1428bd4518a62f6e057904d065a1ff379f4173fc238d50.exe	cmd.exe
PID 116 wrote to memory of 3636	116	cmd.exe	schtasks.exe
PID 116 wrote to memory of 3636	116	cmd.exe	schtasks.exe
PID 116 wrote to memory of 3636	116	cmd.exe	schtasks.exe
PID 3472 wrote to memory of 2768	3472	cmd.exe	timeout.exe
PID 3472 wrote to memory of 2768	3472	cmd.exe	timeout.exe
PID 3472 wrote to memory of 2768	3472	cmd.exe	timeout.exe
PID 3472 wrote to memory of 628	3472	cmd.exe	OBS.exe
PID 3472 wrote to memory of 628	3472	cmd.exe	OBS.exe
PID 3472 wrote to memory of 628	3472	cmd.exe	OBS.exe

C:\Users\Admin\AppData\Local\Temp\3f88c9843cb12cb83e1428bd4518a62f6e057904d065a1ff379f4173fc238d50.exe
"C:\Users\Admin\AppData\Local\Temp\3f88c9843cb12cb83e1428bd4518a62f6e057904d065a1ff379f4173fc238d50.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2896

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "OBS" /tr '"C:\Users\Admin\AppData\Roaming\OBS.exe"' & exit
2⤵
- Suspicious use of WriteProcessMemory
PID:116

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /f /sc onlogon /rl highest /tn "OBS" /tr '"C:\Users\Admin\AppData\Roaming\OBS.exe"'
3⤵
- Creates scheduled task(s)
PID:3636

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpE000.tmp.bat""
2⤵
- Suspicious use of WriteProcessMemory
PID:3472

C:\Windows\SysWOW64\timeout.exe
timeout 3
3⤵
- Delays execution with timeout.exe
PID:2768

C:\Users\Admin\AppData\Roaming\OBS.exe
"C:\Users\Admin\AppData\Roaming\OBS.exe"
3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:628

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpE000.tmp.bat
Filesize
147B

MD5
4bc86caf43eae6949f7069bc756bb2e6

SHA1
3daeb40dec3df3e892d7869d27ca15de43771eda

SHA256
a2c037a4307686e8d18d4bd6c68ed5741cf601451b17af612600972c36e2e285

SHA512
f4d6c45212d3a5e83931940b022ddcecc741f064b5d053a39e2ab166932459c03a16e8ef3c26fd1929c3a94e9560bee0a11b4745aed18d3a282ffb29b739ed37

Download Submit
C:\Users\Admin\AppData\Roaming\OBS.exe
Filesize
220KB

MD5
5b0eec2cad9696c56031231cd3aadfe7

SHA1
f89faf0532fcef570a12dc14c9ecec5cded37d1b

SHA256
3f88c9843cb12cb83e1428bd4518a62f6e057904d065a1ff379f4173fc238d50

SHA512
eb368a9a030120e89be4881ee28defe381135b5e9be42dbdbe858d9b97c7f359e0d7a692c457375378f020fe8e18cad98c70e2bd8c0cdb3fdfef22b7a51a17ff

Download Submit
C:\Users\Admin\AppData\Roaming\OBS.exe
Filesize
220KB

MD5
5b0eec2cad9696c56031231cd3aadfe7

SHA1
f89faf0532fcef570a12dc14c9ecec5cded37d1b

SHA256
3f88c9843cb12cb83e1428bd4518a62f6e057904d065a1ff379f4173fc238d50

SHA512
eb368a9a030120e89be4881ee28defe381135b5e9be42dbdbe858d9b97c7f359e0d7a692c457375378f020fe8e18cad98c70e2bd8c0cdb3fdfef22b7a51a17ff

Download Submit
memory/116-134-0x0000000000000000-mapping.dmp

Download
memory/628-139-0x0000000000000000-mapping.dmp

Download
memory/2768-138-0x0000000000000000-mapping.dmp

Download
memory/2896-132-0x00000000006A0000-0x00000000006AE000-memory.dmp

Filesize
56KB

Download
memory/2896-133-0x0000000005070000-0x000000000510C000-memory.dmp

Filesize
624KB

Download
memory/3472-135-0x0000000000000000-mapping.dmp

Download
memory/3636-136-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads