asyncrat | 2ecbf5a27adc238af0b125b985ae2a8b1bc14526faea3c9e40e6c3437245d830

Resubmissions

02-03-2023 12:37

230302-ptscjach87 10

23-12-2022 11:29

221223-nlkgaabe7y 10

Analysis

max time kernel
43s
max time network
147s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-12-2022 11:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SecuriteInfo.com.W32.MSIL_Agent.EFE.gen.Eldorado.18059.1151.exe
Size

159KB
MD5

b9df92b97a2ed049b84b14d95265c2dd
SHA1

07b74eb3ea78f0cbd5e63384446f8c0ce9949acf
SHA256

2ecbf5a27adc238af0b125b985ae2a8b1bc14526faea3c9e40e6c3437245d830
SHA512

51b451c3144964604dbdd68016bbb05529083d1cadd0d37997dadf4c1180b2727d9f7c03ce1da281c5e1623535c946d77c723e36dda06592c66a8aecfe21b2fe
SSDEEP

3072:N7RE3pQSCkpdSgT4YCySS3t4gWA/VdsSeZnaPeSaN9s/4W:N7RxkHSxYfSS9pWA/V2/nr9s/4

Score

10^/10

asyncrat default rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

Default

23.94.236.147:6606

23.94.236.147:7707

23.94.236.147:8808

Mutex

AsyncMutex_6SI8OkPnk

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
rat asyncrat

Async RAT payload 6 IoCs

rat

resource	yara_rule
behavioral1/memory/1548-63-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat
behavioral1/memory/1548-64-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat
behavioral1/memory/1548-66-0x000000000040C71E-mapping.dmp	asyncrat
behavioral1/memory/1548-65-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat
behavioral1/memory/1548-68-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat
behavioral1/memory/1548-70-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Systdeeem.exe	Powershell.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Systdeeem.exe	Powershell.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1800 set thread context of 1548	1800	SecuriteInfo.com.W32.MSIL_Agent.EFE.gen.Eldorado.18059.1151.exe	30

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1584	Powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1800	SecuriteInfo.com.W32.MSIL_Agent.EFE.gen.Eldorado.18059.1151.exe
Token: SeDebugPrivilege	1584	Powershell.exe
Token: SeDebugPrivilege	1548	RegSvcs.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1800 wrote to memory of 1584	1800	SecuriteInfo.com.W32.MSIL_Agent.EFE.gen.Eldorado.18059.1151.exe	28
PID 1800 wrote to memory of 1584	1800	SecuriteInfo.com.W32.MSIL_Agent.EFE.gen.Eldorado.18059.1151.exe	28
PID 1800 wrote to memory of 1584	1800	SecuriteInfo.com.W32.MSIL_Agent.EFE.gen.Eldorado.18059.1151.exe	28
PID 1800 wrote to memory of 1584	1800	SecuriteInfo.com.W32.MSIL_Agent.EFE.gen.Eldorado.18059.1151.exe	28
PID 1800 wrote to memory of 1548	1800	SecuriteInfo.com.W32.MSIL_Agent.EFE.gen.Eldorado.18059.1151.exe	30
PID 1800 wrote to memory of 1548	1800	SecuriteInfo.com.W32.MSIL_Agent.EFE.gen.Eldorado.18059.1151.exe	30
PID 1800 wrote to memory of 1548	1800	SecuriteInfo.com.W32.MSIL_Agent.EFE.gen.Eldorado.18059.1151.exe	30
PID 1800 wrote to memory of 1548	1800	SecuriteInfo.com.W32.MSIL_Agent.EFE.gen.Eldorado.18059.1151.exe	30
PID 1800 wrote to memory of 1548	1800	SecuriteInfo.com.W32.MSIL_Agent.EFE.gen.Eldorado.18059.1151.exe	30
PID 1800 wrote to memory of 1548	1800	SecuriteInfo.com.W32.MSIL_Agent.EFE.gen.Eldorado.18059.1151.exe	30
PID 1800 wrote to memory of 1548	1800	SecuriteInfo.com.W32.MSIL_Agent.EFE.gen.Eldorado.18059.1151.exe	30
PID 1800 wrote to memory of 1548	1800	SecuriteInfo.com.W32.MSIL_Agent.EFE.gen.Eldorado.18059.1151.exe	30
PID 1800 wrote to memory of 1548	1800	SecuriteInfo.com.W32.MSIL_Agent.EFE.gen.Eldorado.18059.1151.exe	30
PID 1800 wrote to memory of 1548	1800	SecuriteInfo.com.W32.MSIL_Agent.EFE.gen.Eldorado.18059.1151.exe	30
PID 1800 wrote to memory of 1548	1800	SecuriteInfo.com.W32.MSIL_Agent.EFE.gen.Eldorado.18059.1151.exe	30
PID 1800 wrote to memory of 1548	1800	SecuriteInfo.com.W32.MSIL_Agent.EFE.gen.Eldorado.18059.1151.exe	30

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.MSIL_Agent.EFE.gen.Eldorado.18059.1151.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.MSIL_Agent.EFE.gen.Eldorado.18059.1151.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1800
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Powershell.exe
  "Powershell" Copy-Item 'C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.MSIL_Agent.EFE.gen.Eldorado.18059.1151.exe' 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Systdeeem.exe'
  2⤵
  - Drops startup file
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1584
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1548

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1548-66-0x000000000040C71E-mapping.dmp

Download
memory/1548-64-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1548-70-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1548-68-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1548-63-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1548-60-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1548-65-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1548-61-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1584-57-0x0000000000000000-mapping.dmp

Download
memory/1584-71-0x00000000722F0000-0x000000007289B000-memory.dmp

Filesize
5.7MB

Download
memory/1800-55-0x0000000000340000-0x0000000000364000-memory.dmp

Filesize
144KB

Download
memory/1800-54-0x00000000000D0000-0x00000000000FE000-memory.dmp

Filesize
184KB

Download
memory/1800-58-0x00000000004E0000-0x00000000004FC000-memory.dmp

Filesize
112KB

Download
memory/1800-56-0x00000000758C1000-0x00000000758C3000-memory.dmp

Filesize
8KB

Download