asyncrat | 9797431c1548f6720062e6d128ea506ce9efd18cd4e00b87e5b7a1877fb8d7ee

General

Target

1dac278c05c70bc6df9e9eff71a38932549c61f51e1fed6239420a3c542c0476.exe
Size

48KB
MD5

6a2fe740af2f9b1bcf6b4f05bc38c810
SHA1

17f247fb43800115495b4463f10355660e5d5b45
SHA256

1dac278c05c70bc6df9e9eff71a38932549c61f51e1fed6239420a3c542c0476
SHA512

12c428724eece2c7ae9b85fb5b5b95b5151ee9e0a0f5e8b3ab9739d6a7394e9f2374c03b0744c44d14cf10bc75c80f0e9c4e39587065d2db7e69a0286aa3c6ea
SSDEEP

768:mUkPIL2C6y+DiNbik7U8Yb2g1WyCXvEgK/JSTJVc6KN:mU22UzbpAyCXnkJqJVclN

Score

10^/10

asyncrat default rat

Malware Config

Extracted

Family

asyncrat

Version

1.0.7

Botnet

Default

C2

135.181.204.51:8848

Mutex

DcRatMutex_qwqdanchun

Attributes

delay
1
install
true
install_file
Desktop Window Manager.exe
install_folder
%Temp%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
rat asyncrat

Async RAT payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/3996-132-0x0000000000980000-0x0000000000992000-memory.dmp	asyncrat
C:\Users\Admin\AppData\Local\Temp\Desktop Window Manager.exe	asyncrat
C:\Users\Admin\AppData\Local\Temp\Desktop Window Manager.exe	asyncrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

1dac278c05c70bc6df9e9eff71a38932549c61f51e1fed6239420a3c542c0476.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	1dac278c05c70bc6df9e9eff71a38932549c61f51e1fed6239420a3c542c0476.exe

Executes dropped EXE 1 IoCs

Processes:

Desktop Window Manager.exe

pid process

1256 Desktop Window Manager.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1332 schtasks.exe
Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

1412 timeout.exe

pid	process
1256	Desktop Window Manager.exe

pid	process
1332	schtasks.exe

pid	process
1412	timeout.exe

Suspicious behavior: EnumeratesProcesses 23 IoCs

Processes:

1dac278c05c70bc6df9e9eff71a38932549c61f51e1fed6239420a3c542c0476.exe

pid	process
3996	1dac278c05c70bc6df9e9eff71a38932549c61f51e1fed6239420a3c542c0476.exe
3996	1dac278c05c70bc6df9e9eff71a38932549c61f51e1fed6239420a3c542c0476.exe
3996	1dac278c05c70bc6df9e9eff71a38932549c61f51e1fed6239420a3c542c0476.exe
3996	1dac278c05c70bc6df9e9eff71a38932549c61f51e1fed6239420a3c542c0476.exe
3996	1dac278c05c70bc6df9e9eff71a38932549c61f51e1fed6239420a3c542c0476.exe
3996	1dac278c05c70bc6df9e9eff71a38932549c61f51e1fed6239420a3c542c0476.exe
3996	1dac278c05c70bc6df9e9eff71a38932549c61f51e1fed6239420a3c542c0476.exe
3996	1dac278c05c70bc6df9e9eff71a38932549c61f51e1fed6239420a3c542c0476.exe
3996	1dac278c05c70bc6df9e9eff71a38932549c61f51e1fed6239420a3c542c0476.exe
3996	1dac278c05c70bc6df9e9eff71a38932549c61f51e1fed6239420a3c542c0476.exe
3996	1dac278c05c70bc6df9e9eff71a38932549c61f51e1fed6239420a3c542c0476.exe
3996	1dac278c05c70bc6df9e9eff71a38932549c61f51e1fed6239420a3c542c0476.exe
3996	1dac278c05c70bc6df9e9eff71a38932549c61f51e1fed6239420a3c542c0476.exe
3996	1dac278c05c70bc6df9e9eff71a38932549c61f51e1fed6239420a3c542c0476.exe
3996	1dac278c05c70bc6df9e9eff71a38932549c61f51e1fed6239420a3c542c0476.exe
3996	1dac278c05c70bc6df9e9eff71a38932549c61f51e1fed6239420a3c542c0476.exe
3996	1dac278c05c70bc6df9e9eff71a38932549c61f51e1fed6239420a3c542c0476.exe
3996	1dac278c05c70bc6df9e9eff71a38932549c61f51e1fed6239420a3c542c0476.exe
3996	1dac278c05c70bc6df9e9eff71a38932549c61f51e1fed6239420a3c542c0476.exe
3996	1dac278c05c70bc6df9e9eff71a38932549c61f51e1fed6239420a3c542c0476.exe
3996	1dac278c05c70bc6df9e9eff71a38932549c61f51e1fed6239420a3c542c0476.exe
3996	1dac278c05c70bc6df9e9eff71a38932549c61f51e1fed6239420a3c542c0476.exe
3996	1dac278c05c70bc6df9e9eff71a38932549c61f51e1fed6239420a3c542c0476.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

1dac278c05c70bc6df9e9eff71a38932549c61f51e1fed6239420a3c542c0476.exeDesktop Window Manager.exe

description	pid	process
Token: SeDebugPrivilege	3996	1dac278c05c70bc6df9e9eff71a38932549c61f51e1fed6239420a3c542c0476.exe
Token: SeDebugPrivilege	1256	Desktop Window Manager.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

1dac278c05c70bc6df9e9eff71a38932549c61f51e1fed6239420a3c542c0476.execmd.execmd.exe

description	pid	process	target process
PID 3996 wrote to memory of 5000	3996	1dac278c05c70bc6df9e9eff71a38932549c61f51e1fed6239420a3c542c0476.exe	cmd.exe
PID 3996 wrote to memory of 5000	3996	1dac278c05c70bc6df9e9eff71a38932549c61f51e1fed6239420a3c542c0476.exe	cmd.exe
PID 3996 wrote to memory of 628	3996	1dac278c05c70bc6df9e9eff71a38932549c61f51e1fed6239420a3c542c0476.exe	cmd.exe
PID 3996 wrote to memory of 628	3996	1dac278c05c70bc6df9e9eff71a38932549c61f51e1fed6239420a3c542c0476.exe	cmd.exe
PID 628 wrote to memory of 1412	628	cmd.exe	timeout.exe
PID 628 wrote to memory of 1412	628	cmd.exe	timeout.exe
PID 5000 wrote to memory of 1332	5000	cmd.exe	schtasks.exe
PID 5000 wrote to memory of 1332	5000	cmd.exe	schtasks.exe
PID 628 wrote to memory of 1256	628	cmd.exe	Desktop Window Manager.exe
PID 628 wrote to memory of 1256	628	cmd.exe	Desktop Window Manager.exe

C:\Users\Admin\AppData\Local\Temp\1dac278c05c70bc6df9e9eff71a38932549c61f51e1fed6239420a3c542c0476.exe
"C:\Users\Admin\AppData\Local\Temp\1dac278c05c70bc6df9e9eff71a38932549c61f51e1fed6239420a3c542c0476.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3996

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Desktop Window Manager" /tr '"C:\Users\Admin\AppData\Local\Temp\Desktop Window Manager.exe"' & exit
2⤵
- Suspicious use of WriteProcessMemory
PID:5000

C:\Windows\system32\schtasks.exe
schtasks /create /f /sc onlogon /rl highest /tn "Desktop Window Manager" /tr '"C:\Users\Admin\AppData\Local\Temp\Desktop Window Manager.exe"'
3⤵
- Creates scheduled task(s)
PID:1332

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpBA8B.tmp.bat""
2⤵
- Suspicious use of WriteProcessMemory
PID:628

C:\Windows\system32\timeout.exe
timeout 3
3⤵
- Delays execution with timeout.exe
PID:1412

C:\Users\Admin\AppData\Local\Temp\Desktop Window Manager.exe
"C:\Users\Admin\AppData\Local\Temp\Desktop Window Manager.exe"
3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1256

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Desktop Window Manager.exe
Filesize
48KB

MD5
6a2fe740af2f9b1bcf6b4f05bc38c810

SHA1
17f247fb43800115495b4463f10355660e5d5b45

SHA256
1dac278c05c70bc6df9e9eff71a38932549c61f51e1fed6239420a3c542c0476

SHA512
12c428724eece2c7ae9b85fb5b5b95b5151ee9e0a0f5e8b3ab9739d6a7394e9f2374c03b0744c44d14cf10bc75c80f0e9c4e39587065d2db7e69a0286aa3c6ea

Download Submit
C:\Users\Admin\AppData\Local\Temp\Desktop Window Manager.exe
Filesize
48KB

MD5
6a2fe740af2f9b1bcf6b4f05bc38c810

SHA1
17f247fb43800115495b4463f10355660e5d5b45

SHA256
1dac278c05c70bc6df9e9eff71a38932549c61f51e1fed6239420a3c542c0476

SHA512
12c428724eece2c7ae9b85fb5b5b95b5151ee9e0a0f5e8b3ab9739d6a7394e9f2374c03b0744c44d14cf10bc75c80f0e9c4e39587065d2db7e69a0286aa3c6ea

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpBA8B.tmp.bat
Filesize
169B

MD5
c9e292b9d40a21393fedb903f64e46bb

SHA1
568456d75bac545b62c75305f5697db397d2cc91

SHA256
2a932b7e1f23df8394853053533c9c881e480a4ca009376e15e0245429ba2d5e

SHA512
fe060fa0962db0a6106fbcd07d50ce87fd996c2b1bb70cb940c0296d21d1ab06ac014929bb3f4c6f1f719ff07257b3a9877e3b6bb754deb6f60f9a438af3836a

Download Submit
memory/628-135-0x0000000000000000-mapping.dmp

Download
memory/1256-140-0x0000000000000000-mapping.dmp

Download
memory/1256-143-0x00007FFBC8BD0000-0x00007FFBC9691000-memory.dmp

Filesize
10.8MB

Download
memory/1256-144-0x00007FFBC8BD0000-0x00007FFBC9691000-memory.dmp

Filesize
10.8MB

Download
memory/1332-138-0x0000000000000000-mapping.dmp

Download
memory/1412-137-0x0000000000000000-mapping.dmp

Download
memory/3996-132-0x0000000000980000-0x0000000000992000-memory.dmp

Filesize
72KB

Download
memory/3996-139-0x00007FFBC8BD0000-0x00007FFBC9691000-memory.dmp

Filesize
10.8MB

Download
memory/3996-133-0x00007FFBC8BD0000-0x00007FFBC9691000-memory.dmp

Filesize
10.8MB

Download
memory/5000-134-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads