asyncrat | 51db4d2c54e299ae26b3085633aa79476560f9a2f5cc4328683cdee5fb6591fe

General

Target
windll32.exe
Size 57KB
Sample221207-gdfd2acf81
SHA256 51db4d2c54e299ae26b3085633aa79476560f9a2f5cc4328683cdee5fb6591fe
MD5 3c7f22b2aec2778946449c555b71abf9
SHA1 230eb5af23d0fd72331f056e4b6bdb3d43c6671a
SHA512 cd1a439ba1b8e11d7203ed5cbe145245017ab8980feb08c3786ebb493b847cfab9934eb4fff3bc99f71594c05092c31fe78a6a86bfa2fa4089ee9ebd5afee85b
SSDEEP 1536:8uYH9T34l26qvDm3bbXSMZyuB3ibtdXxKDHz/kP0N:8uYdT34l26QDm3bbFl2t1xKXkP0N
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

asyncrat rat

Malware Config

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
rat asyncrat

Async RAT payload 5 IoCs

rat

resource	yara_rule
behavioral1/memory/1308-54-0x0000000000970000-0x0000000000982000-memory.dmp	asyncrat
behavioral1/files/0x000b000000012306-61.dat	asyncrat
behavioral1/files/0x000b000000012306-62.dat	asyncrat
behavioral1/files/0x000b000000012306-64.dat	asyncrat
behavioral1/memory/1552-65-0x00000000003E0000-0x00000000003F2000-memory.dmp	asyncrat

Executes dropped EXE 1 IoCs

pid	Process
1552	path.exe

Loads dropped DLL 1 IoCs

pid	Process
1884	cmd.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
668	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
964	timeout.exe

Modifies system certificate store 2 TTPs 4 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474	path.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 0f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f0b0000000100000034000000420061006c00740069006d006f007200650020004300790062006500720054007200750073007400200052006f006f007400000053000000010000002400000030223020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c0140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df01d0000000100000010000000918ad43a9475f78bb5243de886d8103c09000000010000000c000000300a06082b06010505070301030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae47420000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9	path.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 040000000100000010000000acb694a59c17e0d791529bb19706a6e4030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae47409000000010000000c000000300a06082b060105050703011d0000000100000010000000918ad43a9475f78bb5243de886d8103c140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df053000000010000002400000030223020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c00b0000000100000034000000420061006c00740069006d006f007200650020004300790062006500720054007200750073007400200052006f006f00740000000f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f20000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9	path.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 19000000010000001000000068cb42b035ea773e52ef50ecf50ec5290f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f0b0000000100000034000000420061006c00740069006d006f007200650020004300790062006500720054007200750073007400200052006f006f007400000053000000010000002400000030223020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c0140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df01d0000000100000010000000918ad43a9475f78bb5243de886d8103c09000000010000000c000000300a06082b06010505070301030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae474040000000100000010000000acb694a59c17e0d791529bb19706a6e420000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9	path.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1308	windll32.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1308	windll32.exe
Token: SeDebugPrivilege	1552	path.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 1308 wrote to memory of 880	1308	windll32.exe	28
PID 1308 wrote to memory of 880	1308	windll32.exe	28
PID 1308 wrote to memory of 880	1308	windll32.exe	28
PID 1308 wrote to memory of 880	1308	windll32.exe	28
PID 1308 wrote to memory of 1884	1308	windll32.exe	30
PID 1308 wrote to memory of 1884	1308	windll32.exe	30
PID 1308 wrote to memory of 1884	1308	windll32.exe	30
PID 1308 wrote to memory of 1884	1308	windll32.exe	30
PID 880 wrote to memory of 668	880	cmd.exe	32
PID 880 wrote to memory of 668	880	cmd.exe	32
PID 880 wrote to memory of 668	880	cmd.exe	32
PID 880 wrote to memory of 668	880	cmd.exe	32
PID 1884 wrote to memory of 964	1884	cmd.exe	33
PID 1884 wrote to memory of 964	1884	cmd.exe	33
PID 1884 wrote to memory of 964	1884	cmd.exe	33
PID 1884 wrote to memory of 964	1884	cmd.exe	33
PID 1884 wrote to memory of 1552	1884	cmd.exe	34
PID 1884 wrote to memory of 1552	1884	cmd.exe	34
PID 1884 wrote to memory of 1552	1884	cmd.exe	34
PID 1884 wrote to memory of 1552	1884	cmd.exe	34

C:\Users\Admin\AppData\Local\Temp\windll32.exe
"C:\Users\Admin\AppData\Local\Temp\windll32.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1308
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "path" /tr '"C:\Users\Admin\AppData\Roaming\path.exe"' & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:880
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /f /sc onlogon /rl highest /tn "path" /tr '"C:\Users\Admin\AppData\Roaming\path.exe"'
    3⤵
    - Creates scheduled task(s)
    PID:668
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpC1CA.tmp.bat""
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1884
- - C:\Windows\SysWOW64\timeout.exe
    timeout 3
    3⤵
    - Delays execution with timeout.exe
    PID:964
- - C:\Users\Admin\AppData\Roaming\path.exe
    "C:\Users\Admin\AppData\Roaming\path.exe"
    3⤵
    - Executes dropped EXE
    - Modifies system certificate store
    - Suspicious use of AdjustPrivilegeToken
    PID:1552

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Install Root Certificate

Modify Registry

Web Service

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmpC1CA.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmpC1CA.tmp.bat
Size 148B
SHA256 dbed52c18fc089e9b70f4a1f1b8e69f12b83dd15275621538ba40a0bff8743eb
MD5 506fb8251d3144599e0e3679add49854
SHA1 96158b5b32ee50f4b2ce4951955c1a670e3c7383
SHA512 c1e156f55d76ba8993ed2a03b2f36e9dfb68890202664fe69afb5b26b03d11dec612e97a23ce800f99f54cde8cc9131bfd4eba3159f0ccc5fdbe40c82d1164a6
MD5 SHA1 SHA512

Submit Download

path.exe

Path C:\Users\Admin\AppData\Roaming\path.exe
Size 57KB
SHA256 51db4d2c54e299ae26b3085633aa79476560f9a2f5cc4328683cdee5fb6591fe
MD5 3c7f22b2aec2778946449c555b71abf9
SHA1 230eb5af23d0fd72331f056e4b6bdb3d43c6671a
SHA512 cd1a439ba1b8e11d7203ed5cbe145245017ab8980feb08c3786ebb493b847cfab9934eb4fff3bc99f71594c05092c31fe78a6a86bfa2fa4089ee9ebd5afee85b
SSDEEP 1536:8uYH9T34l26qvDm3bbXSMZyuB3ibtdXxKDHz/kP0N:8uYdT34l26QDm3bbFl2t1xKXkP0N
MD5 SHA1 SHA512 SSDEEP

Submit Download

path.exe

Path C:\Users\Admin\AppData\Roaming\path.exe
Size 57KB
SHA256 51db4d2c54e299ae26b3085633aa79476560f9a2f5cc4328683cdee5fb6591fe
MD5 3c7f22b2aec2778946449c555b71abf9
SHA1 230eb5af23d0fd72331f056e4b6bdb3d43c6671a
SHA512 cd1a439ba1b8e11d7203ed5cbe145245017ab8980feb08c3786ebb493b847cfab9934eb4fff3bc99f71594c05092c31fe78a6a86bfa2fa4089ee9ebd5afee85b
SSDEEP 1536:8uYH9T34l26qvDm3bbXSMZyuB3ibtdXxKDHz/kP0N:8uYdT34l26QDm3bbFl2t1xKXkP0N
MD5 SHA1 SHA512 SSDEEP

Submit Download

path.exe

Path \Users\Admin\AppData\Roaming\path.exe
Size 57KB
SHA256 51db4d2c54e299ae26b3085633aa79476560f9a2f5cc4328683cdee5fb6591fe
MD5 3c7f22b2aec2778946449c555b71abf9
SHA1 230eb5af23d0fd72331f056e4b6bdb3d43c6671a
SHA512 cd1a439ba1b8e11d7203ed5cbe145245017ab8980feb08c3786ebb493b847cfab9934eb4fff3bc99f71594c05092c31fe78a6a86bfa2fa4089ee9ebd5afee85b
SSDEEP 1536:8uYH9T34l26qvDm3bbXSMZyuB3ibtdXxKDHz/kP0N:8uYdT34l26QDm3bbFl2t1xKXkP0N
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1308-54-0x0000000000970000-0x0000000000982000-memory.dmp

Download

memory/1308-55-0x0000000076391000-0x0000000076393000-memory.dmp

Download

memory/1552-65-0x00000000003E0000-0x00000000003F2000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads