asyncrat | 785ebeb84c2bc65d0b0a55691f18631c110531b132f60535b8462684d2492b81

General

Target

SecuriteInfo.com.Trojan.GenericKDZ.97497.29505.12657.exe
Size

621KB
MD5

45f42e17dd7229140a940f3346ddf3a9
SHA1

dbf51050b80bd2932bfed81fc867495bbd856ca6
SHA256

785ebeb84c2bc65d0b0a55691f18631c110531b132f60535b8462684d2492b81
SHA512

3a1c2a3ee5382c61759e1a2664f2871eb49c567de6dec8ad70e797d4698f7950ec78eb567aba3ad286723bae926856509e880777d4165a75cc2463fcb4fbc7ef
SSDEEP

12288:NeHlPTZh6q6/TKPzG7rjkKzG9DP+ogIGdjPETxpj:NeHllY/TKPzG7+B+TIOjPWxF

Score

10^/10

asyncrat default rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

Default

C2

192.3.193.136:2023

Mutex

AsyncMutex_6SI8OkPnk

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
rat asyncrat

Async RAT payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/1636-147-0x0000000000400000-0x000000000041E000-memory.dmp	asyncrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

SecuriteInfo.com.Trojan.GenericKDZ.97497.29505.12657.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	SecuriteInfo.com.Trojan.GenericKDZ.97497.29505.12657.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

SecuriteInfo.com.Trojan.GenericKDZ.97497.29505.12657.exe

description pid process target process

PID 716 set thread context of 1636 716 SecuriteInfo.com.Trojan.GenericKDZ.97497.29505.12657.exe RegSvcs.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

4100 schtasks.exe

description	pid	process	target process
PID 716 set thread context of 1636	716	SecuriteInfo.com.Trojan.GenericKDZ.97497.29505.12657.exe	RegSvcs.exe

pid	process
4100	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

SecuriteInfo.com.Trojan.GenericKDZ.97497.29505.12657.exepowershell.exepowershell.exe

pid	process
716	SecuriteInfo.com.Trojan.GenericKDZ.97497.29505.12657.exe
716	SecuriteInfo.com.Trojan.GenericKDZ.97497.29505.12657.exe
2136	powershell.exe
4336	powershell.exe
716	SecuriteInfo.com.Trojan.GenericKDZ.97497.29505.12657.exe
716	SecuriteInfo.com.Trojan.GenericKDZ.97497.29505.12657.exe
2136	powershell.exe
4336	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

SecuriteInfo.com.Trojan.GenericKDZ.97497.29505.12657.exepowershell.exepowershell.exeRegSvcs.exe

description	pid	process
Token: SeDebugPrivilege	716	SecuriteInfo.com.Trojan.GenericKDZ.97497.29505.12657.exe
Token: SeDebugPrivilege	2136	powershell.exe
Token: SeDebugPrivilege	4336	powershell.exe
Token: SeDebugPrivilege	1636	RegSvcs.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

SecuriteInfo.com.Trojan.GenericKDZ.97497.29505.12657.exe

description	pid	process	target process
PID 716 wrote to memory of 2136	716	SecuriteInfo.com.Trojan.GenericKDZ.97497.29505.12657.exe	powershell.exe
PID 716 wrote to memory of 2136	716	SecuriteInfo.com.Trojan.GenericKDZ.97497.29505.12657.exe	powershell.exe
PID 716 wrote to memory of 2136	716	SecuriteInfo.com.Trojan.GenericKDZ.97497.29505.12657.exe	powershell.exe
PID 716 wrote to memory of 4336	716	SecuriteInfo.com.Trojan.GenericKDZ.97497.29505.12657.exe	powershell.exe
PID 716 wrote to memory of 4336	716	SecuriteInfo.com.Trojan.GenericKDZ.97497.29505.12657.exe	powershell.exe
PID 716 wrote to memory of 4336	716	SecuriteInfo.com.Trojan.GenericKDZ.97497.29505.12657.exe	powershell.exe
PID 716 wrote to memory of 4100	716	SecuriteInfo.com.Trojan.GenericKDZ.97497.29505.12657.exe	schtasks.exe
PID 716 wrote to memory of 4100	716	SecuriteInfo.com.Trojan.GenericKDZ.97497.29505.12657.exe	schtasks.exe
PID 716 wrote to memory of 4100	716	SecuriteInfo.com.Trojan.GenericKDZ.97497.29505.12657.exe	schtasks.exe
PID 716 wrote to memory of 1636	716	SecuriteInfo.com.Trojan.GenericKDZ.97497.29505.12657.exe	RegSvcs.exe
PID 716 wrote to memory of 1636	716	SecuriteInfo.com.Trojan.GenericKDZ.97497.29505.12657.exe	RegSvcs.exe
PID 716 wrote to memory of 1636	716	SecuriteInfo.com.Trojan.GenericKDZ.97497.29505.12657.exe	RegSvcs.exe
PID 716 wrote to memory of 1636	716	SecuriteInfo.com.Trojan.GenericKDZ.97497.29505.12657.exe	RegSvcs.exe
PID 716 wrote to memory of 1636	716	SecuriteInfo.com.Trojan.GenericKDZ.97497.29505.12657.exe	RegSvcs.exe
PID 716 wrote to memory of 1636	716	SecuriteInfo.com.Trojan.GenericKDZ.97497.29505.12657.exe	RegSvcs.exe
PID 716 wrote to memory of 1636	716	SecuriteInfo.com.Trojan.GenericKDZ.97497.29505.12657.exe	RegSvcs.exe
PID 716 wrote to memory of 1636	716	SecuriteInfo.com.Trojan.GenericKDZ.97497.29505.12657.exe	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.GenericKDZ.97497.29505.12657.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.GenericKDZ.97497.29505.12657.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:716

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.GenericKDZ.97497.29505.12657.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2136

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\rTYeHpkLYAzXn.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4336

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\rTYeHpkLYAzXn" /XML "C:\Users\Admin\AppData\Local\Temp\tmp56CB.tmp"
2⤵
- Creates scheduled task(s)
PID:4100

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1636

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Filesize
2KB

MD5
968cb9309758126772781b83adb8a28f

SHA1
8da30e71accf186b2ba11da1797cf67f8f78b47c

SHA256
92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

SHA512
4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
18KB

MD5
82b4f3ce548be8dda3ffaceaeea2d600

SHA1
12effe54a9bbc1152e1b7d3e770fd0d436a40360

SHA256
20e1616662fd31d1fc923f3c3c0c21952f83ea8f1e007c952e1319e662bf0fd7

SHA512
491d5a968ce1be5fdafb84f49fd7e2dc828c100481bfb5d02f154ab3cecd608b298f2c46f57cd2fd9c6ca4524c41d532caaeff673a1dfa97ecbd7aa2d69bf1e9

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp56CB.tmp
Filesize
1KB

MD5
07d755feffe3c6bb4594d57d73e1dac1

SHA1
9fe49ef8be691462c55146cd47d88f39429269fe

SHA256
7a49cab4bace55ba44a7a6ca7a2ae4a6cfe5333a11cb884596c76a4d33fd38a4

SHA512
dbf6fa9959a0ba54cd0d77f60abb9c6358b12ee734bcf3c23af4c454eff27872d79e03bfbb5f01dc629963968934ab7d01afab0d9730c739edf6362db94b2b43

Download Submit
memory/716-133-0x0000000005680000-0x0000000005C24000-memory.dmp

Filesize
5.6MB

Download
memory/716-134-0x0000000004FF0000-0x0000000005082000-memory.dmp

Filesize
584KB

Download
memory/716-135-0x00000000050B0000-0x00000000050BA000-memory.dmp

Filesize
40KB

Download
memory/716-136-0x0000000008FD0000-0x000000000906C000-memory.dmp

Filesize
624KB

Download
memory/716-132-0x00000000006F0000-0x0000000000792000-memory.dmp

Filesize
648KB

Download
memory/1636-147-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1636-146-0x0000000000000000-mapping.dmp

Download
memory/2136-140-0x0000000000C40000-0x0000000000C76000-memory.dmp

Filesize
216KB

Download
memory/2136-154-0x0000000006CF0000-0x0000000006D0A000-memory.dmp

Filesize
104KB

Download
memory/2136-137-0x0000000000000000-mapping.dmp

Download
memory/2136-145-0x0000000004B30000-0x0000000004B96000-memory.dmp

Filesize
408KB

Download
memory/2136-141-0x0000000004BE0000-0x0000000005208000-memory.dmp

Filesize
6.2MB

Download
memory/2136-143-0x0000000004A20000-0x0000000004A42000-memory.dmp

Filesize
136KB

Download
memory/2136-148-0x00000000059E0000-0x00000000059FE000-memory.dmp

Filesize
120KB

Download
memory/2136-159-0x0000000007010000-0x0000000007018000-memory.dmp

Filesize
32KB

Download
memory/2136-150-0x0000000075360000-0x00000000753AC000-memory.dmp

Filesize
304KB

Download
memory/2136-151-0x0000000006960000-0x000000000697E000-memory.dmp

Filesize
120KB

Download
memory/2136-158-0x0000000007030000-0x000000000704A000-memory.dmp

Filesize
104KB

Download
memory/2136-157-0x0000000006F20000-0x0000000006F2E000-memory.dmp

Filesize
56KB

Download
memory/4100-139-0x0000000000000000-mapping.dmp

Download
memory/4336-155-0x0000000007120000-0x000000000712A000-memory.dmp

Filesize
40KB

Download
memory/4336-156-0x0000000007330000-0x00000000073C6000-memory.dmp

Filesize
600KB

Download
memory/4336-153-0x00000000076F0000-0x0000000007D6A000-memory.dmp

Filesize
6.5MB

Download
memory/4336-152-0x0000000075360000-0x00000000753AC000-memory.dmp

Filesize
304KB

Download
memory/4336-149-0x00000000063A0000-0x00000000063D2000-memory.dmp

Filesize
200KB

Download
memory/4336-138-0x0000000000000000-mapping.dmp

Download
memory/4336-144-0x00000000054E0000-0x0000000005546000-memory.dmp

Filesize
408KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads