asyncrat | 71c9ed2c4eed613b53dc4324dd037ef1356aa990ba3de509d46a3144c847545d

General

Target

PujH3zZZ8CZ2PQh.exe
Size

690KB
MD5

ff03d21030f0ceec34b64a1354e12eca
SHA1

d4fd57bf4a367e0c3c7c12d1bf5d2fa24cfb4050
SHA256

f77b10f6ec51ae7c41bbf862324e2ec41527f2ddda49b85765ea45919480832e
SHA512

0c2a0c81aee2277a56d161c970d51e21bdf507bebbe6f85ffaaacc456765dba6c31a328bb014f3493d569c4e62f38ffa01972b5d88ffddf4b3e8b26bab61df2f
SSDEEP

12288:Gh6q6EM7YC0ND571Vd8Sd9GNx1l3V8HzLUExWB:GYXpQ57jfaxPleoB

Score

10^/10

asyncrat default rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

Default

C2

192.3.193.136:2023

Mutex

AsyncMutex_6SI8OkPnk

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
rat asyncrat

Async RAT payload 6 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1468-70-0x0000000000400000-0x000000000041E000-memory.dmp	asyncrat
behavioral1/memory/1468-75-0x0000000000400000-0x000000000041E000-memory.dmp	asyncrat
behavioral1/memory/1468-73-0x0000000000400000-0x000000000041E000-memory.dmp	asyncrat
behavioral1/memory/1468-76-0x000000000040C6FE-mapping.dmp	asyncrat
behavioral1/memory/1468-80-0x0000000000400000-0x000000000041E000-memory.dmp	asyncrat
behavioral1/memory/1468-78-0x0000000000400000-0x000000000041E000-memory.dmp	asyncrat

Suspicious use of SetThreadContext 1 IoCs

Processes:

PujH3zZZ8CZ2PQh.exe

description pid process target process

PID 1408 set thread context of 1468 1408 PujH3zZZ8CZ2PQh.exe RegSvcs.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1748 schtasks.exe
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

PujH3zZZ8CZ2PQh.exepowershell.exepowershell.exe

pid process

1408 PujH3zZZ8CZ2PQh.exe
1408 PujH3zZZ8CZ2PQh.exe
1700 powershell.exe
1140 powershell.exe
1408 PujH3zZZ8CZ2PQh.exe
1408 PujH3zZZ8CZ2PQh.exe

description	pid	process	target process
PID 1408 set thread context of 1468	1408	PujH3zZZ8CZ2PQh.exe	RegSvcs.exe

pid	process
1748	schtasks.exe

pid	process
1408	PujH3zZZ8CZ2PQh.exe
1408	PujH3zZZ8CZ2PQh.exe
1700	powershell.exe
1140	powershell.exe
1408	PujH3zZZ8CZ2PQh.exe
1408	PujH3zZZ8CZ2PQh.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

PujH3zZZ8CZ2PQh.exepowershell.exepowershell.exeRegSvcs.exe

description	pid	process
Token: SeDebugPrivilege	1408	PujH3zZZ8CZ2PQh.exe
Token: SeDebugPrivilege	1700	powershell.exe
Token: SeDebugPrivilege	1140	powershell.exe
Token: SeDebugPrivilege	1468	RegSvcs.exe

Suspicious use of WriteProcessMemory 24 IoCs

Processes:

PujH3zZZ8CZ2PQh.exe

description	pid	process	target process
PID 1408 wrote to memory of 1140	1408	PujH3zZZ8CZ2PQh.exe	powershell.exe
PID 1408 wrote to memory of 1140	1408	PujH3zZZ8CZ2PQh.exe	powershell.exe
PID 1408 wrote to memory of 1140	1408	PujH3zZZ8CZ2PQh.exe	powershell.exe
PID 1408 wrote to memory of 1140	1408	PujH3zZZ8CZ2PQh.exe	powershell.exe
PID 1408 wrote to memory of 1700	1408	PujH3zZZ8CZ2PQh.exe	powershell.exe
PID 1408 wrote to memory of 1700	1408	PujH3zZZ8CZ2PQh.exe	powershell.exe
PID 1408 wrote to memory of 1700	1408	PujH3zZZ8CZ2PQh.exe	powershell.exe
PID 1408 wrote to memory of 1700	1408	PujH3zZZ8CZ2PQh.exe	powershell.exe
PID 1408 wrote to memory of 1748	1408	PujH3zZZ8CZ2PQh.exe	schtasks.exe
PID 1408 wrote to memory of 1748	1408	PujH3zZZ8CZ2PQh.exe	schtasks.exe
PID 1408 wrote to memory of 1748	1408	PujH3zZZ8CZ2PQh.exe	schtasks.exe
PID 1408 wrote to memory of 1748	1408	PujH3zZZ8CZ2PQh.exe	schtasks.exe
PID 1408 wrote to memory of 1468	1408	PujH3zZZ8CZ2PQh.exe	RegSvcs.exe
PID 1408 wrote to memory of 1468	1408	PujH3zZZ8CZ2PQh.exe	RegSvcs.exe
PID 1408 wrote to memory of 1468	1408	PujH3zZZ8CZ2PQh.exe	RegSvcs.exe
PID 1408 wrote to memory of 1468	1408	PujH3zZZ8CZ2PQh.exe	RegSvcs.exe
PID 1408 wrote to memory of 1468	1408	PujH3zZZ8CZ2PQh.exe	RegSvcs.exe
PID 1408 wrote to memory of 1468	1408	PujH3zZZ8CZ2PQh.exe	RegSvcs.exe
PID 1408 wrote to memory of 1468	1408	PujH3zZZ8CZ2PQh.exe	RegSvcs.exe
PID 1408 wrote to memory of 1468	1408	PujH3zZZ8CZ2PQh.exe	RegSvcs.exe
PID 1408 wrote to memory of 1468	1408	PujH3zZZ8CZ2PQh.exe	RegSvcs.exe
PID 1408 wrote to memory of 1468	1408	PujH3zZZ8CZ2PQh.exe	RegSvcs.exe
PID 1408 wrote to memory of 1468	1408	PujH3zZZ8CZ2PQh.exe	RegSvcs.exe
PID 1408 wrote to memory of 1468	1408	PujH3zZZ8CZ2PQh.exe	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\PujH3zZZ8CZ2PQh.exe
"C:\Users\Admin\AppData\Local\Temp\PujH3zZZ8CZ2PQh.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1408

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\PujH3zZZ8CZ2PQh.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1140

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\ThpFXqJuWD.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1700

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ThpFXqJuWD" /XML "C:\Users\Admin\AppData\Local\Temp\tmpCEE4.tmp"
2⤵
- Creates scheduled task(s)
PID:1748

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1468

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpCEE4.tmp
Filesize
1KB

MD5
b8c1dd3f0e9e4851354931648a59d615

SHA1
3a2fad3878ae55f287ac51292ec6e5fd061a672f

SHA256
6537a518c86a785307b0b61d9e2c525f05d3970c98d073d43cd7fc349caa352e

SHA512
b88004e79b2f95213873e1a35f7766c81a1a19443f6d42eaee1f4ef53b3c0b64664b1f70c0622d4794d496e7f0b289c01d4ec5bb1b46b416708b79b0d5322c3f

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Filesize
7KB

MD5
3e32bc825d88bac094f97067e6dce7a2

SHA1
54111a31b0612660ea9baa0d59ed0034f0bac90e

SHA256
20e95bc3adc6a735aefd7547fb0b6d6b71f656f56cd2e2af81f31b4a572b874d

SHA512
6b05d0252ed8b118e8aa242cab8845ee5bacddb3f89f37bd1ac2d693cc189efd4a5cc8e87d4062990f1b7da5b175096f75ab865002413393f52be25c46cd77a3

Download Submit
memory/1140-59-0x0000000000000000-mapping.dmp

Download
memory/1140-81-0x000000006E190000-0x000000006E195000-memory.dmp

Filesize
20KB

Download
memory/1140-71-0x000000006E190000-0x000000006E73B000-memory.dmp

Filesize
5.7MB

Download
memory/1408-66-0x0000000004880000-0x00000000048A2000-memory.dmp

Filesize
136KB

Download
memory/1408-56-0x0000000000530000-0x0000000000544000-memory.dmp

Filesize
80KB

Download
memory/1408-55-0x0000000074B51000-0x0000000074B53000-memory.dmp

Filesize
8KB

Download
memory/1408-58-0x00000000053B0000-0x0000000005420000-memory.dmp

Filesize
448KB

Download
memory/1408-57-0x0000000000560000-0x000000000056C000-memory.dmp

Filesize
48KB

Download
memory/1408-54-0x0000000000190000-0x0000000000244000-memory.dmp

Filesize
720KB

Download
memory/1468-70-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1468-68-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1468-67-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1468-75-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1468-73-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1468-76-0x000000000040C6FE-mapping.dmp

Download
memory/1468-80-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1468-78-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1700-61-0x0000000000000000-mapping.dmp

Download
memory/1700-74-0x000000006E190000-0x000000006E73B000-memory.dmp

Filesize
5.7MB

Download
memory/1700-82-0x000000006E190000-0x000000006E195000-memory.dmp

Filesize
20KB

Download
memory/1748-62-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads