asyncrat | 2ecbf5a27adc238af0b125b985ae2a8b1bc14526faea3c9e40e6c3437245d830

Resubmissions

02-03-2023 12:37

230302-ptscjach87 10

23-12-2022 11:29

221223-nlkgaabe7y 10

Analysis

max time kernel
91s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-12-2022 11:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SecuriteInfo.com.W32.MSIL_Agent.EFE.gen.Eldorado.18059.1151.exe
Size

159KB
MD5

b9df92b97a2ed049b84b14d95265c2dd
SHA1

07b74eb3ea78f0cbd5e63384446f8c0ce9949acf
SHA256

2ecbf5a27adc238af0b125b985ae2a8b1bc14526faea3c9e40e6c3437245d830
SHA512

51b451c3144964604dbdd68016bbb05529083d1cadd0d37997dadf4c1180b2727d9f7c03ce1da281c5e1623535c946d77c723e36dda06592c66a8aecfe21b2fe
SSDEEP

3072:N7RE3pQSCkpdSgT4YCySS3t4gWA/VdsSeZnaPeSaN9s/4W:N7RxkHSxYfSS9pWA/V2/nr9s/4

Score

10^/10

asyncrat default rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

Default

23.94.236.147:6606

23.94.236.147:7707

23.94.236.147:8808

Mutex

AsyncMutex_6SI8OkPnk

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral2/memory/4428-138-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Systdeeem.exe	Powershell.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Systdeeem.exe	Powershell.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2712 set thread context of 4428	2712	SecuriteInfo.com.W32.MSIL_Agent.EFE.gen.Eldorado.18059.1151.exe	89

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3876	Powershell.exe
3876	Powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2712	SecuriteInfo.com.W32.MSIL_Agent.EFE.gen.Eldorado.18059.1151.exe
Token: SeDebugPrivilege	3876	Powershell.exe
Token: SeDebugPrivilege	4428	RegSvcs.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2712 wrote to memory of 3876	2712	SecuriteInfo.com.W32.MSIL_Agent.EFE.gen.Eldorado.18059.1151.exe	87
PID 2712 wrote to memory of 3876	2712	SecuriteInfo.com.W32.MSIL_Agent.EFE.gen.Eldorado.18059.1151.exe	87
PID 2712 wrote to memory of 3876	2712	SecuriteInfo.com.W32.MSIL_Agent.EFE.gen.Eldorado.18059.1151.exe	87
PID 2712 wrote to memory of 4428	2712	SecuriteInfo.com.W32.MSIL_Agent.EFE.gen.Eldorado.18059.1151.exe	89
PID 2712 wrote to memory of 4428	2712	SecuriteInfo.com.W32.MSIL_Agent.EFE.gen.Eldorado.18059.1151.exe	89
PID 2712 wrote to memory of 4428	2712	SecuriteInfo.com.W32.MSIL_Agent.EFE.gen.Eldorado.18059.1151.exe	89
PID 2712 wrote to memory of 4428	2712	SecuriteInfo.com.W32.MSIL_Agent.EFE.gen.Eldorado.18059.1151.exe	89
PID 2712 wrote to memory of 4428	2712	SecuriteInfo.com.W32.MSIL_Agent.EFE.gen.Eldorado.18059.1151.exe	89
PID 2712 wrote to memory of 4428	2712	SecuriteInfo.com.W32.MSIL_Agent.EFE.gen.Eldorado.18059.1151.exe	89
PID 2712 wrote to memory of 4428	2712	SecuriteInfo.com.W32.MSIL_Agent.EFE.gen.Eldorado.18059.1151.exe	89
PID 2712 wrote to memory of 4428	2712	SecuriteInfo.com.W32.MSIL_Agent.EFE.gen.Eldorado.18059.1151.exe	89

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.MSIL_Agent.EFE.gen.Eldorado.18059.1151.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.MSIL_Agent.EFE.gen.Eldorado.18059.1151.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2712
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Powershell.exe
  "Powershell" Copy-Item 'C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.MSIL_Agent.EFE.gen.Eldorado.18059.1151.exe' 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Systdeeem.exe'
  2⤵
  - Drops startup file
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3876
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4428

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2712-132-0x0000000000080000-0x00000000000AE000-memory.dmp

Filesize
184KB

Download
memory/2712-133-0x0000000007540000-0x0000000007AE4000-memory.dmp

Filesize
5.6MB

Download
memory/2712-134-0x0000000006F90000-0x000000000702C000-memory.dmp

Filesize
624KB

Download
memory/3876-141-0x00000000050D0000-0x0000000005136000-memory.dmp

Filesize
408KB

Download
memory/3876-136-0x0000000002530000-0x0000000002566000-memory.dmp

Filesize
216KB

Download
memory/3876-139-0x0000000005160000-0x0000000005788000-memory.dmp

Filesize
6.2MB

Download
memory/3876-140-0x0000000004E70000-0x0000000004E92000-memory.dmp

Filesize
136KB

Download
memory/3876-135-0x0000000000000000-mapping.dmp

Download
memory/3876-142-0x0000000005790000-0x00000000057F6000-memory.dmp

Filesize
408KB

Download
memory/3876-143-0x0000000005DF0000-0x0000000005E0E000-memory.dmp

Filesize
120KB

Download
memory/3876-144-0x0000000006FA0000-0x0000000007036000-memory.dmp

Filesize
600KB

Download
memory/3876-145-0x00000000062E0000-0x00000000062FA000-memory.dmp

Filesize
104KB

Download
memory/3876-146-0x0000000006350000-0x0000000006372000-memory.dmp

Filesize
136KB

Download
memory/4428-137-0x0000000000000000-mapping.dmp

Download
memory/4428-138-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download