asyncrat | 325076c547bffb21683f5bc023739016ad025c0739a7e122aa7289fa91fc88c2

General

Target

document_viewer.exe
Size

580KB
MD5

bc1722ec205a1c5ed34b8766971fe608
SHA1

43ded76bf48088b7684879214ad4d66b58ef9a90
SHA256

325076c547bffb21683f5bc023739016ad025c0739a7e122aa7289fa91fc88c2
SHA512

9eee2a624c14281de538b34032457c53276c3dad67b89989e7f95a3e93dae05e87bda13791aa00d8928d4a9845879d164ff900084ad5a120db44e934b0f89465
SSDEEP

12288:bIqDSu4Dsv9thG2SEzak3cgH+/nSsYCrDl0wnhkDsv9t:MqDSu8gLY/nWiuY

Score

10^/10

asyncrat default rat

Malware Config

Extracted

Family

asyncrat

Version

Venom RAT + HVNC + Stealer + Grabber v6.0.0

Botnet

Default

C2

179.43.142.197:5789

Mutex

ncarwpqkcbklyda

Attributes

delay
1
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
rat asyncrat

Async RAT payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/8-147-0x0000000000400000-0x0000000000416000-memory.dmp	asyncrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

document_viewer.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	document_viewer.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

document_viewer.exe

description pid process target process

PID 4984 set thread context of 8 4984 document_viewer.exe document_viewer.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

3336 schtasks.exe

description	pid	process	target process
PID 4984 set thread context of 8	4984	document_viewer.exe	document_viewer.exe

pid	process
3336	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

document_viewer.exepowershell.exepowershell.exedocument_viewer.exe

pid	process
4984	document_viewer.exe
4724	powershell.exe
3036	powershell.exe
4984	document_viewer.exe
3036	powershell.exe
4724	powershell.exe
8	document_viewer.exe
8	document_viewer.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

document_viewer.exepowershell.exepowershell.exedocument_viewer.exe

description	pid	process
Token: SeDebugPrivilege	4984	document_viewer.exe
Token: SeDebugPrivilege	3036	powershell.exe
Token: SeDebugPrivilege	4724	powershell.exe
Token: SeDebugPrivilege	8	document_viewer.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

document_viewer.exe

pid process

8 document_viewer.exe

pid	process
8	document_viewer.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

document_viewer.exe

description	pid	process	target process
PID 4984 wrote to memory of 4724	4984	document_viewer.exe	powershell.exe
PID 4984 wrote to memory of 4724	4984	document_viewer.exe	powershell.exe
PID 4984 wrote to memory of 4724	4984	document_viewer.exe	powershell.exe
PID 4984 wrote to memory of 3036	4984	document_viewer.exe	powershell.exe
PID 4984 wrote to memory of 3036	4984	document_viewer.exe	powershell.exe
PID 4984 wrote to memory of 3036	4984	document_viewer.exe	powershell.exe
PID 4984 wrote to memory of 3336	4984	document_viewer.exe	schtasks.exe
PID 4984 wrote to memory of 3336	4984	document_viewer.exe	schtasks.exe
PID 4984 wrote to memory of 3336	4984	document_viewer.exe	schtasks.exe
PID 4984 wrote to memory of 8	4984	document_viewer.exe	document_viewer.exe
PID 4984 wrote to memory of 8	4984	document_viewer.exe	document_viewer.exe
PID 4984 wrote to memory of 8	4984	document_viewer.exe	document_viewer.exe
PID 4984 wrote to memory of 8	4984	document_viewer.exe	document_viewer.exe
PID 4984 wrote to memory of 8	4984	document_viewer.exe	document_viewer.exe
PID 4984 wrote to memory of 8	4984	document_viewer.exe	document_viewer.exe
PID 4984 wrote to memory of 8	4984	document_viewer.exe	document_viewer.exe
PID 4984 wrote to memory of 8	4984	document_viewer.exe	document_viewer.exe

C:\Users\Admin\AppData\Local\Temp\document_viewer.exe
"C:\Users\Admin\AppData\Local\Temp\document_viewer.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4984

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\document_viewer.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4724

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\sDCoBOTNA.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3036

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\sDCoBOTNA" /XML "C:\Users\Admin\AppData\Local\Temp\tmp179F.tmp"
2⤵
- Creates scheduled task(s)
PID:3336

C:\Users\Admin\AppData\Local\Temp\document_viewer.exe
"C:\Users\Admin\AppData\Local\Temp\document_viewer.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:8

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Filesize
2KB

MD5
968cb9309758126772781b83adb8a28f

SHA1
8da30e71accf186b2ba11da1797cf67f8f78b47c

SHA256
92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

SHA512
4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
18KB

MD5
4faaac7bd2472ea685cdb3d233886646

SHA1
ac59e490f54400b0457de9aff03bb8c14a44395c

SHA256
713b0140a2475ba4cdc4e701cede46631ca29977a847ec8451b7093353b0c7d9

SHA512
5f3eb1da42660acd0ffc1f4ea6d10662d4d6bffe17925a7e6526b31f10c01aabdc38323dfd1a747a93b55e560d554959c65e1649f2e2f7ea0eb8eba4f5105f43

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp179F.tmp
Filesize
1KB

MD5
100aa8c0c1096bbd4f089b4363d0c448

SHA1
08b5de7aa0d146b52a98334e57f9b3a5ed22f169

SHA256
25f4079d5c917a6c7bbae6b224cc53f8199fdd796c682c162d76bf54043b0cc3

SHA512
8e22f5febea21e7d925d91dee099bdbd0d02d6b852ff02c2f82428cc75a2edcb41f8a78aaeda5b2d1642572455bdafaac61627c47e15c96fef63c7e2b0f3e202

Download Submit
memory/8-163-0x0000000006F20000-0x0000000006F3E000-memory.dmp

Filesize
120KB

Download
memory/8-162-0x0000000006F60000-0x0000000006FD6000-memory.dmp

Filesize
472KB

Download
memory/8-147-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/8-146-0x0000000000000000-mapping.dmp

Download
memory/3036-154-0x0000000006DD0000-0x0000000006DEA000-memory.dmp

Filesize
104KB

Download
memory/3036-148-0x0000000005AC0000-0x0000000005ADE000-memory.dmp

Filesize
120KB

Download
memory/3036-150-0x00000000757C0000-0x000000007580C000-memory.dmp

Filesize
304KB

Download
memory/3036-157-0x0000000007000000-0x000000000700E000-memory.dmp

Filesize
56KB

Download
memory/3036-144-0x00000000053C0000-0x0000000005426000-memory.dmp

Filesize
408KB

Download
memory/3036-149-0x0000000006AB0000-0x0000000006AE2000-memory.dmp

Filesize
200KB

Download
memory/3036-145-0x0000000005430000-0x0000000005496000-memory.dmp

Filesize
408KB

Download
memory/3036-138-0x0000000000000000-mapping.dmp

Download
memory/3036-159-0x00000000070F0000-0x00000000070F8000-memory.dmp

Filesize
32KB

Download
memory/3336-140-0x0000000000000000-mapping.dmp

Download
memory/4724-155-0x0000000007BA0000-0x0000000007BAA000-memory.dmp

Filesize
40KB

Download
memory/4724-139-0x0000000002F30000-0x0000000002F66000-memory.dmp

Filesize
216KB

Download
memory/4724-152-0x0000000006DC0000-0x0000000006DDE000-memory.dmp

Filesize
120KB

Download
memory/4724-141-0x0000000005A50000-0x0000000006078000-memory.dmp

Filesize
6.2MB

Download
memory/4724-153-0x0000000008170000-0x00000000087EA000-memory.dmp

Filesize
6.5MB

Download
memory/4724-137-0x0000000000000000-mapping.dmp

Download
memory/4724-151-0x00000000757C0000-0x000000007580C000-memory.dmp

Filesize
304KB

Download
memory/4724-156-0x0000000007DB0000-0x0000000007E46000-memory.dmp

Filesize
600KB

Download
memory/4724-143-0x00000000059E0000-0x0000000005A02000-memory.dmp

Filesize
136KB

Download
memory/4724-158-0x0000000007E70000-0x0000000007E8A000-memory.dmp

Filesize
104KB

Download
memory/4984-132-0x0000000000860000-0x00000000008F8000-memory.dmp

Filesize
608KB

Download
memory/4984-136-0x0000000007F90000-0x000000000802C000-memory.dmp

Filesize
624KB

Download
memory/4984-135-0x0000000005460000-0x000000000546A000-memory.dmp

Filesize
40KB

Download
memory/4984-134-0x00000000052D0000-0x0000000005362000-memory.dmp

Filesize
584KB

Download
memory/4984-133-0x00000000057E0000-0x0000000005D84000-memory.dmp

Filesize
5.6MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads