asyncrat | cf1de08c2a552617a6e8591a2bd25c72d597854e9564246a700329aa60b08be7

General

Target

cf1de08c2a552617a6e8591a2bd25c72d597854e9564246a700329aa60b08be7.exe
Size

1.8MB
MD5

4fae4e3df84f89f77df25ed6e9674940
SHA1

720372d130c4931506ed0df1ede36dada6803f72
SHA256

cf1de08c2a552617a6e8591a2bd25c72d597854e9564246a700329aa60b08be7
SHA512

08161380459a529918a94acb6acf9d149ba1e4de0a78f90c4db32cabb54a24114d1902da57dbbe49750e61607af667c8ff851201caf42cde83f2391bca6d2c2a
SSDEEP

49152:diszHX1u6cLxfOEPZldmn0TAI5FWQzt+1wBcv+lRA6ZtrPt9gsjGvlaQz:EszHXM6c1dmsAIiQzt+1wmv+lRAorPLq

Score

10^/10

asyncrat default rat

Malware Config

Extracted

Credentials

Protocol: ftp
Host:
43.155.145.155
Port:
21
Username:
123
Password:
123

Extracted

Family

asyncrat

Version

Gh0st RAT

Botnet

Default

C2

43.249.30.55:8848

Mutex

DcRatMutex

Attributes

delay
1
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
rat asyncrat

Async RAT payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1704-66-0x0000000000EE0000-0x0000000000EF2000-memory.dmp	asyncrat

Executes dropped EXE 2 IoCs

Processes:

wwlib.exeWINWORD.exe

pid process

1704 wwlib.exe
2004 WINWORD.exe

pid	process
1704	wwlib.exe
2004	WINWORD.exe

Loads dropped DLL 2 IoCs

Processes:

cf1de08c2a552617a6e8591a2bd25c72d597854e9564246a700329aa60b08be7.exe

pid	process
1220	cf1de08c2a552617a6e8591a2bd25c72d597854e9564246a700329aa60b08be7.exe
1220	cf1de08c2a552617a6e8591a2bd25c72d597854e9564246a700329aa60b08be7.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

wwlib.exe

description pid process

Token: SeDebugPrivilege 1704 wwlib.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

wwlib.exe

pid process

1704 wwlib.exe

description	pid	process
Token: SeDebugPrivilege	1704	wwlib.exe

pid	process
1704	wwlib.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

cf1de08c2a552617a6e8591a2bd25c72d597854e9564246a700329aa60b08be7.exe

description	pid	process	target process
PID 1220 wrote to memory of 1704	1220	cf1de08c2a552617a6e8591a2bd25c72d597854e9564246a700329aa60b08be7.exe	wwlib.exe
PID 1220 wrote to memory of 1704	1220	cf1de08c2a552617a6e8591a2bd25c72d597854e9564246a700329aa60b08be7.exe	wwlib.exe
PID 1220 wrote to memory of 1704	1220	cf1de08c2a552617a6e8591a2bd25c72d597854e9564246a700329aa60b08be7.exe	wwlib.exe
PID 1220 wrote to memory of 1704	1220	cf1de08c2a552617a6e8591a2bd25c72d597854e9564246a700329aa60b08be7.exe	wwlib.exe
PID 1220 wrote to memory of 2004	1220	cf1de08c2a552617a6e8591a2bd25c72d597854e9564246a700329aa60b08be7.exe	WINWORD.exe
PID 1220 wrote to memory of 2004	1220	cf1de08c2a552617a6e8591a2bd25c72d597854e9564246a700329aa60b08be7.exe	WINWORD.exe
PID 1220 wrote to memory of 2004	1220	cf1de08c2a552617a6e8591a2bd25c72d597854e9564246a700329aa60b08be7.exe	WINWORD.exe
PID 1220 wrote to memory of 2004	1220	cf1de08c2a552617a6e8591a2bd25c72d597854e9564246a700329aa60b08be7.exe	WINWORD.exe

C:\Users\Admin\AppData\Local\Temp\cf1de08c2a552617a6e8591a2bd25c72d597854e9564246a700329aa60b08be7.exe
"C:\Users\Admin\AppData\Local\Temp\cf1de08c2a552617a6e8591a2bd25c72d597854e9564246a700329aa60b08be7.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1220

C:\ProgramData\test2\wwlib.exe
C:\ProgramData\test2\wwlib.exe
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1704

C:\ProgramData\test2\WINWORD.exe
C:\ProgramData\test2\WINWORD.exe
2⤵
- Executes dropped EXE
PID:2004

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\test2\WINWORD.exe
Filesize
142KB

MD5
4ff52e75438413467ddd272199e70366

SHA1
b4f53f04321031ea927dbd4c52acaf3e5fc01b77

SHA256
c756d4795d2a54189bc62af7df05dea22edf9c7e113550bac5e75cfdf4481306

SHA512
789040e729aae68d0d9ef42918c9b0d289b80a5942d766b40f3b4a6afd48896cc3dbc69b315aaf3419ec9c252212bac38596b66e3908377f7cf754d77cfd19fb

Download Submit
C:\ProgramData\test2\WINWORD.exe
Filesize
142KB

MD5
4ff52e75438413467ddd272199e70366

SHA1
b4f53f04321031ea927dbd4c52acaf3e5fc01b77

SHA256
c756d4795d2a54189bc62af7df05dea22edf9c7e113550bac5e75cfdf4481306

SHA512
789040e729aae68d0d9ef42918c9b0d289b80a5942d766b40f3b4a6afd48896cc3dbc69b315aaf3419ec9c252212bac38596b66e3908377f7cf754d77cfd19fb

Download Submit
C:\ProgramData\test2\wwlib.exe
Filesize
1.6MB

MD5
0c506cd4887583473cce3bb72614aa64

SHA1
7af74582a2b916855a5c6b49f32c9449dd06a614

SHA256
beb1eda4c7c0ee27f1a17c8a4faae3dba515a45f6b4ef3b63079cc2de77b7112

SHA512
3368ac6c7caded66e0a0d6f7e2b163b2e83801108b15bcbadf641031dbdd4a7c304a890ce504d02afb1b02fd5d80fce7f4d5c0279819714ad439fdef66dbeaa7

Download Submit
C:\ProgramData\test2\wwlib.exe
Filesize
1.6MB

MD5
0c506cd4887583473cce3bb72614aa64

SHA1
7af74582a2b916855a5c6b49f32c9449dd06a614

SHA256
beb1eda4c7c0ee27f1a17c8a4faae3dba515a45f6b4ef3b63079cc2de77b7112

SHA512
3368ac6c7caded66e0a0d6f7e2b163b2e83801108b15bcbadf641031dbdd4a7c304a890ce504d02afb1b02fd5d80fce7f4d5c0279819714ad439fdef66dbeaa7

Download Submit
\ProgramData\test2\WINWORD.exe
Filesize
142KB

MD5
4ff52e75438413467ddd272199e70366

SHA1
b4f53f04321031ea927dbd4c52acaf3e5fc01b77

SHA256
c756d4795d2a54189bc62af7df05dea22edf9c7e113550bac5e75cfdf4481306

SHA512
789040e729aae68d0d9ef42918c9b0d289b80a5942d766b40f3b4a6afd48896cc3dbc69b315aaf3419ec9c252212bac38596b66e3908377f7cf754d77cfd19fb

Download Submit
\ProgramData\test2\wwlib.exe
Filesize
1.6MB

MD5
0c506cd4887583473cce3bb72614aa64

SHA1
7af74582a2b916855a5c6b49f32c9449dd06a614

SHA256
beb1eda4c7c0ee27f1a17c8a4faae3dba515a45f6b4ef3b63079cc2de77b7112

SHA512
3368ac6c7caded66e0a0d6f7e2b163b2e83801108b15bcbadf641031dbdd4a7c304a890ce504d02afb1b02fd5d80fce7f4d5c0279819714ad439fdef66dbeaa7

Download Submit
memory/1704-59-0x0000000075A91000-0x0000000075A93000-memory.dmp

Filesize
8KB

Download
memory/1704-55-0x0000000000000000-mapping.dmp

Download
memory/1704-66-0x0000000000EE0000-0x0000000000EF2000-memory.dmp

Filesize
72KB

Download
memory/2004-58-0x0000000000000000-mapping.dmp

Download
memory/2004-63-0x0000000000B40000-0x0000000000B6A000-memory.dmp

Filesize
168KB

Download
memory/2004-64-0x000007FEFB5B1000-0x000007FEFB5B3000-memory.dmp

Filesize
8KB

Download
memory/2004-65-0x000000001AAB6000-0x000000001AAD5000-memory.dmp

Filesize
124KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads