asyncrat | 38acb0a39a41cd025106836edc40beaa0b53cea2b7e5a3dcfebae8269b8f6c58

General

Target
98379a4b4b9f36794e4d85eedf2ccf8e.exe
Size 189KB
Sample221207-n47drseb85
SHA256 38acb0a39a41cd025106836edc40beaa0b53cea2b7e5a3dcfebae8269b8f6c58
MD5 98379a4b4b9f36794e4d85eedf2ccf8e
SHA1 7eabd6cf8bc2deecc6691c810146345f918213b9
SHA512 a5cceb8514f598f759e0dd9ba242fbbb7b029446d7d94f13b089da472dc8af52ec6014848b851bad67fe3ed268bb79db05284291e33e0bcdab58c2e05acdc63c
SSDEEP 3072:B3CX/huQkPjdYZ2kPTx6A9duTSzac6gEzGP7y3mw9mKlrqNPVJFUSo7c1Vwi:B0YQIiZJPT4RUAgvP7yVmKl+NPVJFUSw
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

asyncrat default rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

Default

C2

chinasea.duckdns.org:5201

Mutex

AsyncMutex_6SI8OkPnk

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
rat asyncrat

Async RAT payload 6 IoCs

rat

resource	yara_rule
behavioral1/memory/1188-63-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat
behavioral1/memory/1188-64-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat
behavioral1/memory/1188-65-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat
behavioral1/memory/1188-66-0x000000000040C72E-mapping.dmp	asyncrat
behavioral1/memory/1188-68-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat
behavioral1/memory/1188-70-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystJHKJHKem.exe	Powershell.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystJHKJHKem.exe	Powershell.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1672 set thread context of 1188	1672	98379a4b4b9f36794e4d85eedf2ccf8e.exe	29

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1500	Powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1672	98379a4b4b9f36794e4d85eedf2ccf8e.exe
Token: SeDebugPrivilege	1500	Powershell.exe
Token: SeDebugPrivilege	1188	RegSvcs.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1672 wrote to memory of 1500	1672	98379a4b4b9f36794e4d85eedf2ccf8e.exe	27
PID 1672 wrote to memory of 1500	1672	98379a4b4b9f36794e4d85eedf2ccf8e.exe	27
PID 1672 wrote to memory of 1500	1672	98379a4b4b9f36794e4d85eedf2ccf8e.exe	27
PID 1672 wrote to memory of 1500	1672	98379a4b4b9f36794e4d85eedf2ccf8e.exe	27
PID 1672 wrote to memory of 1188	1672	98379a4b4b9f36794e4d85eedf2ccf8e.exe	29
PID 1672 wrote to memory of 1188	1672	98379a4b4b9f36794e4d85eedf2ccf8e.exe	29
PID 1672 wrote to memory of 1188	1672	98379a4b4b9f36794e4d85eedf2ccf8e.exe	29
PID 1672 wrote to memory of 1188	1672	98379a4b4b9f36794e4d85eedf2ccf8e.exe	29
PID 1672 wrote to memory of 1188	1672	98379a4b4b9f36794e4d85eedf2ccf8e.exe	29
PID 1672 wrote to memory of 1188	1672	98379a4b4b9f36794e4d85eedf2ccf8e.exe	29
PID 1672 wrote to memory of 1188	1672	98379a4b4b9f36794e4d85eedf2ccf8e.exe	29
PID 1672 wrote to memory of 1188	1672	98379a4b4b9f36794e4d85eedf2ccf8e.exe	29
PID 1672 wrote to memory of 1188	1672	98379a4b4b9f36794e4d85eedf2ccf8e.exe	29
PID 1672 wrote to memory of 1188	1672	98379a4b4b9f36794e4d85eedf2ccf8e.exe	29
PID 1672 wrote to memory of 1188	1672	98379a4b4b9f36794e4d85eedf2ccf8e.exe	29
PID 1672 wrote to memory of 1188	1672	98379a4b4b9f36794e4d85eedf2ccf8e.exe	29

C:\Users\Admin\AppData\Local\Temp\98379a4b4b9f36794e4d85eedf2ccf8e.exe
"C:\Users\Admin\AppData\Local\Temp\98379a4b4b9f36794e4d85eedf2ccf8e.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1672
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Powershell.exe
  "Powershell" Copy-Item 'C:\Users\Admin\AppData\Local\Temp\98379a4b4b9f36794e4d85eedf2ccf8e.exe' 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystJHKJHKem.exe'
  2⤵
  - Drops startup file
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1500
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1188

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1188-65-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/1188-63-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/1188-70-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/1188-68-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/1188-64-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/1188-60-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/1188-61-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/1500-71-0x00000000719F0000-0x0000000071F9B000-memory.dmp

Download

memory/1500-73-0x00000000719F0000-0x0000000071F9B000-memory.dmp

Download

memory/1672-55-0x00000000002F0000-0x0000000000314000-memory.dmp

Download

memory/1672-54-0x0000000000BD0000-0x0000000000C04000-memory.dmp

Download

memory/1672-59-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/1672-56-0x0000000075BD1000-0x0000000075BD3000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads