asyncrat | bec67588dfd5e24d948112f922e527c8c76386c5e849d32c6aac3b08c193e5f8

General

Target

bec67588dfd5e24d948112f922e527c8c76386c5e849d32c6aac3b08c193e5f8.exe
Size

306KB
MD5

b3ec5baf020e50acea70c6b4e8de7bc1
SHA1

e6c7cfa860cb338279600ba3b7398f9b43275fb6
SHA256

bec67588dfd5e24d948112f922e527c8c76386c5e849d32c6aac3b08c193e5f8
SHA512

758fa4dbd83ad68039f22b3575a28e02c66920a7e2ea9305515ba480746d8c77cb44f28ac2213e2e7718fc19e17b311b44c5788a87aae2f7792c4b04a07d86f7
SSDEEP

6144:IZ2rHi6Q+04RLO+ZJken+5mFyCCBC3QTszhNXVZOhRQ09Dguw1xC:IZf6Qh4RlZJken+5oyCeZsNNF29DiI

Score

10^/10

asyncrat default rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

Default

C2

kcfresh.ddns.net:6606

kcfresh.ddns.net:7707

kcfresh.ddns.net:8808

185.140.53.227:6606

185.140.53.227:7707

185.140.53.227:8808

Mutex

AsyncMutex_6SI8OkPnk

Attributes

delay
3
install
true
install_file
system services.exe
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
rat asyncrat

Async RAT payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/4084-138-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

bec67588dfd5e24d948112f922e527c8c76386c5e849d32c6aac3b08c193e5f8.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	bec67588dfd5e24d948112f922e527c8c76386c5e849d32c6aac3b08c193e5f8.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

bec67588dfd5e24d948112f922e527c8c76386c5e849d32c6aac3b08c193e5f8.exe

description	pid	process	target process
PID 696 set thread context of 4084	696	bec67588dfd5e24d948112f922e527c8c76386c5e849d32c6aac3b08c193e5f8.exe	bec67588dfd5e24d948112f922e527c8c76386c5e849d32c6aac3b08c193e5f8.exe

Drops file in Windows directory 1 IoCs

Processes:

dw20.exe

description ioc process

File created C:\Windows\AppCompat\Programs\Amcache.hve.tmp dw20.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	ioc	process
File created	C:\Windows\AppCompat\Programs\Amcache.hve.tmp	dw20.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

dw20.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	dw20.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

4128 schtasks.exe

pid	process
4128	schtasks.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

dw20.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dw20.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

bec67588dfd5e24d948112f922e527c8c76386c5e849d32c6aac3b08c193e5f8.exe

pid	process
696	bec67588dfd5e24d948112f922e527c8c76386c5e849d32c6aac3b08c193e5f8.exe
696	bec67588dfd5e24d948112f922e527c8c76386c5e849d32c6aac3b08c193e5f8.exe
696	bec67588dfd5e24d948112f922e527c8c76386c5e849d32c6aac3b08c193e5f8.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

bec67588dfd5e24d948112f922e527c8c76386c5e849d32c6aac3b08c193e5f8.exedw20.exe

description	pid	process
Token: SeDebugPrivilege	696	bec67588dfd5e24d948112f922e527c8c76386c5e849d32c6aac3b08c193e5f8.exe
Token: SeRestorePrivilege	4440	dw20.exe
Token: SeBackupPrivilege	4440	dw20.exe
Token: SeBackupPrivilege	4440	dw20.exe
Token: SeBackupPrivilege	4440	dw20.exe
Token: SeBackupPrivilege	4440	dw20.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

bec67588dfd5e24d948112f922e527c8c76386c5e849d32c6aac3b08c193e5f8.exebec67588dfd5e24d948112f922e527c8c76386c5e849d32c6aac3b08c193e5f8.exe

C:\Users\Admin\AppData\Local\Temp\bec67588dfd5e24d948112f922e527c8c76386c5e849d32c6aac3b08c193e5f8.exe
"C:\Users\Admin\AppData\Local\Temp\bec67588dfd5e24d948112f922e527c8c76386c5e849d32c6aac3b08c193e5f8.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:696

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\rVUWQBdj" /XML "C:\Users\Admin\AppData\Local\Temp\tmp431F.tmp"
2⤵
- Creates scheduled task(s)
PID:4128

C:\Users\Admin\AppData\Local\Temp\bec67588dfd5e24d948112f922e527c8c76386c5e849d32c6aac3b08c193e5f8.exe
"{path}"
2⤵
PID:4384

C:\Users\Admin\AppData\Local\Temp\bec67588dfd5e24d948112f922e527c8c76386c5e849d32c6aac3b08c193e5f8.exe
"{path}"
2⤵
- Suspicious use of WriteProcessMemory
PID:4084

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 772
3⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
PID:4440

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

3

T1012

System Information Discovery

4

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp431F.tmp
Filesize
1KB

MD5
ea30b5acfc44c3c99bc0d982f8dc260f

SHA1
3fc5b02ea98819c65442c92e74a05df7e7f0031e

SHA256
2a51723dc81f6f7a303673d8343408d8beb730eb832cb1349586893c2babda02

SHA512
c8f28420514a08532f607100871bd8c02d390a8ce89af79bbe81121bc9022ea89de09686851a61185b0359688693856d0499078971123dc6bc87a50274e20377

Download Submit
memory/696-132-0x0000000074D20000-0x00000000752D1000-memory.dmp

Filesize
5.7MB

Download
memory/696-133-0x0000000074D20000-0x00000000752D1000-memory.dmp

Filesize
5.7MB

Download
memory/696-140-0x0000000074D20000-0x00000000752D1000-memory.dmp

Filesize
5.7MB

Download
memory/4084-137-0x0000000000000000-mapping.dmp

Download
memory/4084-138-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/4084-141-0x0000000074D20000-0x00000000752D1000-memory.dmp

Filesize
5.7MB

Download
memory/4084-142-0x0000000074D20000-0x00000000752D1000-memory.dmp

Filesize
5.7MB

Download
memory/4084-143-0x0000000074D20000-0x00000000752D1000-memory.dmp

Filesize
5.7MB

Download
memory/4128-134-0x0000000000000000-mapping.dmp

Download
memory/4384-136-0x0000000000000000-mapping.dmp

Download
memory/4440-139-0x0000000000000000-mapping.dmp

Download

description	pid	process	target process
PID 696 wrote to memory of 4128	696	bec67588dfd5e24d948112f922e527c8c76386c5e849d32c6aac3b08c193e5f8.exe	schtasks.exe
PID 696 wrote to memory of 4128	696	bec67588dfd5e24d948112f922e527c8c76386c5e849d32c6aac3b08c193e5f8.exe	schtasks.exe
PID 696 wrote to memory of 4128	696	bec67588dfd5e24d948112f922e527c8c76386c5e849d32c6aac3b08c193e5f8.exe	schtasks.exe
PID 696 wrote to memory of 4384	696	bec67588dfd5e24d948112f922e527c8c76386c5e849d32c6aac3b08c193e5f8.exe	bec67588dfd5e24d948112f922e527c8c76386c5e849d32c6aac3b08c193e5f8.exe
PID 696 wrote to memory of 4384	696	bec67588dfd5e24d948112f922e527c8c76386c5e849d32c6aac3b08c193e5f8.exe	bec67588dfd5e24d948112f922e527c8c76386c5e849d32c6aac3b08c193e5f8.exe
PID 696 wrote to memory of 4384	696	bec67588dfd5e24d948112f922e527c8c76386c5e849d32c6aac3b08c193e5f8.exe	bec67588dfd5e24d948112f922e527c8c76386c5e849d32c6aac3b08c193e5f8.exe
PID 696 wrote to memory of 4084	696	bec67588dfd5e24d948112f922e527c8c76386c5e849d32c6aac3b08c193e5f8.exe	bec67588dfd5e24d948112f922e527c8c76386c5e849d32c6aac3b08c193e5f8.exe
PID 696 wrote to memory of 4084	696	bec67588dfd5e24d948112f922e527c8c76386c5e849d32c6aac3b08c193e5f8.exe	bec67588dfd5e24d948112f922e527c8c76386c5e849d32c6aac3b08c193e5f8.exe
PID 696 wrote to memory of 4084	696	bec67588dfd5e24d948112f922e527c8c76386c5e849d32c6aac3b08c193e5f8.exe	bec67588dfd5e24d948112f922e527c8c76386c5e849d32c6aac3b08c193e5f8.exe
PID 696 wrote to memory of 4084	696	bec67588dfd5e24d948112f922e527c8c76386c5e849d32c6aac3b08c193e5f8.exe	bec67588dfd5e24d948112f922e527c8c76386c5e849d32c6aac3b08c193e5f8.exe
PID 696 wrote to memory of 4084	696	bec67588dfd5e24d948112f922e527c8c76386c5e849d32c6aac3b08c193e5f8.exe	bec67588dfd5e24d948112f922e527c8c76386c5e849d32c6aac3b08c193e5f8.exe
PID 696 wrote to memory of 4084	696	bec67588dfd5e24d948112f922e527c8c76386c5e849d32c6aac3b08c193e5f8.exe	bec67588dfd5e24d948112f922e527c8c76386c5e849d32c6aac3b08c193e5f8.exe
PID 696 wrote to memory of 4084	696	bec67588dfd5e24d948112f922e527c8c76386c5e849d32c6aac3b08c193e5f8.exe	bec67588dfd5e24d948112f922e527c8c76386c5e849d32c6aac3b08c193e5f8.exe
PID 696 wrote to memory of 4084	696	bec67588dfd5e24d948112f922e527c8c76386c5e849d32c6aac3b08c193e5f8.exe	bec67588dfd5e24d948112f922e527c8c76386c5e849d32c6aac3b08c193e5f8.exe
PID 4084 wrote to memory of 4440	4084	bec67588dfd5e24d948112f922e527c8c76386c5e849d32c6aac3b08c193e5f8.exe	dw20.exe
PID 4084 wrote to memory of 4440	4084	bec67588dfd5e24d948112f922e527c8c76386c5e849d32c6aac3b08c193e5f8.exe	dw20.exe
PID 4084 wrote to memory of 4440	4084	bec67588dfd5e24d948112f922e527c8c76386c5e849d32c6aac3b08c193e5f8.exe	dw20.exe

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads