asyncrat | 822c659a8ad91358189573135d99d6af226b1271bcfa053a2f49a8ea193b1619

General

Target

822c659a8ad91358189573135d99d6af226b1271bcfa053a2f49a8ea193b1619.exe
Size

1.1MB
MD5

fd0f12448b7ce4e82e014b64b2676e93
SHA1

3b5891e13f7f63c25e88030ba78d3290934f8640
SHA256

822c659a8ad91358189573135d99d6af226b1271bcfa053a2f49a8ea193b1619
SHA512

34d01684dcc7f91439ac333e5ee86a1ce1e724ad8f71eaf3b7c215cd32b595e1b6835a7ed077c8ac3f42fe7975d103d06afae5031f446442a7b748f68a214c51
SSDEEP

12288:+fcAcrc5/VtuUogBwjWxEOR3LkAb8C1atShBs/yyaVtLhqG5lg1tArWUHW9keeU8:U

Score

10^/10

asyncrat default rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

Default

C2

hgjvhnfgg.duckdns.org:8057

Mutex

AsyncMutex_6SI8OkPnk

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
rat asyncrat

Async RAT payload 6 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1860-62-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat
behavioral1/memory/1860-63-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat
behavioral1/memory/1860-64-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat
behavioral1/memory/1860-65-0x000000000040C73E-mapping.dmp	asyncrat
behavioral1/memory/1860-67-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat
behavioral1/memory/1860-69-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat

Suspicious use of NtSetInformationThreadHideFromDebugger 8 IoCs

Processes:

822c659a8ad91358189573135d99d6af226b1271bcfa053a2f49a8ea193b1619.exe

pid	process
1816	822c659a8ad91358189573135d99d6af226b1271bcfa053a2f49a8ea193b1619.exe
1816	822c659a8ad91358189573135d99d6af226b1271bcfa053a2f49a8ea193b1619.exe
1816	822c659a8ad91358189573135d99d6af226b1271bcfa053a2f49a8ea193b1619.exe
1816	822c659a8ad91358189573135d99d6af226b1271bcfa053a2f49a8ea193b1619.exe
1816	822c659a8ad91358189573135d99d6af226b1271bcfa053a2f49a8ea193b1619.exe
1816	822c659a8ad91358189573135d99d6af226b1271bcfa053a2f49a8ea193b1619.exe
1816	822c659a8ad91358189573135d99d6af226b1271bcfa053a2f49a8ea193b1619.exe
1816	822c659a8ad91358189573135d99d6af226b1271bcfa053a2f49a8ea193b1619.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

822c659a8ad91358189573135d99d6af226b1271bcfa053a2f49a8ea193b1619.exe

description	pid	process	target process
PID 1816 set thread context of 1860	1816	822c659a8ad91358189573135d99d6af226b1271bcfa053a2f49a8ea193b1619.exe	822c659a8ad91358189573135d99d6af226b1271bcfa053a2f49a8ea193b1619.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

1984 timeout.exe

pid	process
1984	timeout.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

822c659a8ad91358189573135d99d6af226b1271bcfa053a2f49a8ea193b1619.exe

pid	process
1816	822c659a8ad91358189573135d99d6af226b1271bcfa053a2f49a8ea193b1619.exe
1816	822c659a8ad91358189573135d99d6af226b1271bcfa053a2f49a8ea193b1619.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

822c659a8ad91358189573135d99d6af226b1271bcfa053a2f49a8ea193b1619.exe

description pid process

Token: SeDebugPrivilege 1816 822c659a8ad91358189573135d99d6af226b1271bcfa053a2f49a8ea193b1619.exe

description	pid	process
Token: SeDebugPrivilege	1816	822c659a8ad91358189573135d99d6af226b1271bcfa053a2f49a8ea193b1619.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

822c659a8ad91358189573135d99d6af226b1271bcfa053a2f49a8ea193b1619.execmd.exe

description	pid	process	target process
PID 1816 wrote to memory of 1988	1816	822c659a8ad91358189573135d99d6af226b1271bcfa053a2f49a8ea193b1619.exe	cmd.exe
PID 1816 wrote to memory of 1988	1816	822c659a8ad91358189573135d99d6af226b1271bcfa053a2f49a8ea193b1619.exe	cmd.exe
PID 1816 wrote to memory of 1988	1816	822c659a8ad91358189573135d99d6af226b1271bcfa053a2f49a8ea193b1619.exe	cmd.exe
PID 1816 wrote to memory of 1988	1816	822c659a8ad91358189573135d99d6af226b1271bcfa053a2f49a8ea193b1619.exe	cmd.exe
PID 1988 wrote to memory of 1984	1988	cmd.exe	timeout.exe
PID 1988 wrote to memory of 1984	1988	cmd.exe	timeout.exe
PID 1988 wrote to memory of 1984	1988	cmd.exe	timeout.exe
PID 1988 wrote to memory of 1984	1988	cmd.exe	timeout.exe
PID 1816 wrote to memory of 1860	1816	822c659a8ad91358189573135d99d6af226b1271bcfa053a2f49a8ea193b1619.exe	822c659a8ad91358189573135d99d6af226b1271bcfa053a2f49a8ea193b1619.exe
PID 1816 wrote to memory of 1860	1816	822c659a8ad91358189573135d99d6af226b1271bcfa053a2f49a8ea193b1619.exe	822c659a8ad91358189573135d99d6af226b1271bcfa053a2f49a8ea193b1619.exe
PID 1816 wrote to memory of 1860	1816	822c659a8ad91358189573135d99d6af226b1271bcfa053a2f49a8ea193b1619.exe	822c659a8ad91358189573135d99d6af226b1271bcfa053a2f49a8ea193b1619.exe
PID 1816 wrote to memory of 1860	1816	822c659a8ad91358189573135d99d6af226b1271bcfa053a2f49a8ea193b1619.exe	822c659a8ad91358189573135d99d6af226b1271bcfa053a2f49a8ea193b1619.exe
PID 1816 wrote to memory of 1860	1816	822c659a8ad91358189573135d99d6af226b1271bcfa053a2f49a8ea193b1619.exe	822c659a8ad91358189573135d99d6af226b1271bcfa053a2f49a8ea193b1619.exe
PID 1816 wrote to memory of 1860	1816	822c659a8ad91358189573135d99d6af226b1271bcfa053a2f49a8ea193b1619.exe	822c659a8ad91358189573135d99d6af226b1271bcfa053a2f49a8ea193b1619.exe
PID 1816 wrote to memory of 1860	1816	822c659a8ad91358189573135d99d6af226b1271bcfa053a2f49a8ea193b1619.exe	822c659a8ad91358189573135d99d6af226b1271bcfa053a2f49a8ea193b1619.exe
PID 1816 wrote to memory of 1860	1816	822c659a8ad91358189573135d99d6af226b1271bcfa053a2f49a8ea193b1619.exe	822c659a8ad91358189573135d99d6af226b1271bcfa053a2f49a8ea193b1619.exe
PID 1816 wrote to memory of 1860	1816	822c659a8ad91358189573135d99d6af226b1271bcfa053a2f49a8ea193b1619.exe	822c659a8ad91358189573135d99d6af226b1271bcfa053a2f49a8ea193b1619.exe

C:\Users\Admin\AppData\Local\Temp\822c659a8ad91358189573135d99d6af226b1271bcfa053a2f49a8ea193b1619.exe
"C:\Users\Admin\AppData\Local\Temp\822c659a8ad91358189573135d99d6af226b1271bcfa053a2f49a8ea193b1619.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1816

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c timeout 1
2⤵
- Suspicious use of WriteProcessMemory
PID:1988

C:\Windows\SysWOW64\timeout.exe
timeout 1
3⤵
- Delays execution with timeout.exe
PID:1984

C:\Users\Admin\AppData\Local\Temp\822c659a8ad91358189573135d99d6af226b1271bcfa053a2f49a8ea193b1619.exe
"C:\Users\Admin\AppData\Local\Temp\822c659a8ad91358189573135d99d6af226b1271bcfa053a2f49a8ea193b1619.exe"
2⤵
PID:1860

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1816-54-0x00000000002B0000-0x00000000003C6000-memory.dmp

Filesize
1.1MB

Download
memory/1816-55-0x00000000756A1000-0x00000000756A3000-memory.dmp

Filesize
8KB

Download
memory/1816-56-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1860-64-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1860-60-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1860-62-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1860-59-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1860-63-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1860-65-0x000000000040C73E-mapping.dmp

Download
memory/1860-67-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1860-69-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1984-58-0x0000000000000000-mapping.dmp

Download
memory/1988-57-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads