asyncrat | d1d057a3ef58e9d59c66346c27b1a9905fc6a90d28cefc69d46ae8fbdf7954e7

General

Target

d1d057a3ef58e9d59c66346c27b1a9905fc6a90d28cefc69d46ae8fbdf7954e7.exe
Size

591KB
MD5

401240d7a40901b74d85ac7620b83915
SHA1

3f512a8ff2f7d143a14badbc6191c3b8e09d23f6
SHA256

d1d057a3ef58e9d59c66346c27b1a9905fc6a90d28cefc69d46ae8fbdf7954e7
SHA512

996da140a45b98cfd0e8f803037296b1b73cb01793c6302784d2bd1ae6fb3a58b17f171e6eefd406b73637457031fb1363ff9c2f97ca6eaeb71a51c1bd0f5cd2
SSDEEP

12288:Yr8m6f8WlGdAGUow9aR9IlzTmKa188LY1dPijURkY6z7ZIahRZ5GcrO:bIeG5IHgoiqjqZIS5GcrO

Score

10^/10

asyncrat default rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

Default

C2

100.42.65.218:8080

100.42.65.218:6606

Mutex

AsyncMutex_6SI8OkPnk

Attributes

delay
3
install
false
install_file
winsyd.exe
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
rat asyncrat

Async RAT payload 6 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/904-67-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat
behavioral1/memory/904-68-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat
behavioral1/memory/904-70-0x000000000040C71E-mapping.dmp	asyncrat
behavioral1/memory/904-69-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat
behavioral1/memory/904-72-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat
behavioral1/memory/904-74-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat

Suspicious use of SetThreadContext 1 IoCs

Processes:

d1d057a3ef58e9d59c66346c27b1a9905fc6a90d28cefc69d46ae8fbdf7954e7.exe

description	pid	process	target process
PID 952 set thread context of 904	952	d1d057a3ef58e9d59c66346c27b1a9905fc6a90d28cefc69d46ae8fbdf7954e7.exe	RegSvcs.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

992 schtasks.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid process

1872 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 1872 powershell.exe

pid	process
992	schtasks.exe

pid	process
1872	powershell.exe

description	pid	process
Token: SeDebugPrivilege	1872	powershell.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

d1d057a3ef58e9d59c66346c27b1a9905fc6a90d28cefc69d46ae8fbdf7954e7.exe

description	pid	process	target process
PID 952 wrote to memory of 1872	952	d1d057a3ef58e9d59c66346c27b1a9905fc6a90d28cefc69d46ae8fbdf7954e7.exe	powershell.exe
PID 952 wrote to memory of 1872	952	d1d057a3ef58e9d59c66346c27b1a9905fc6a90d28cefc69d46ae8fbdf7954e7.exe	powershell.exe
PID 952 wrote to memory of 1872	952	d1d057a3ef58e9d59c66346c27b1a9905fc6a90d28cefc69d46ae8fbdf7954e7.exe	powershell.exe
PID 952 wrote to memory of 1872	952	d1d057a3ef58e9d59c66346c27b1a9905fc6a90d28cefc69d46ae8fbdf7954e7.exe	powershell.exe
PID 952 wrote to memory of 992	952	d1d057a3ef58e9d59c66346c27b1a9905fc6a90d28cefc69d46ae8fbdf7954e7.exe	schtasks.exe
PID 952 wrote to memory of 992	952	d1d057a3ef58e9d59c66346c27b1a9905fc6a90d28cefc69d46ae8fbdf7954e7.exe	schtasks.exe
PID 952 wrote to memory of 992	952	d1d057a3ef58e9d59c66346c27b1a9905fc6a90d28cefc69d46ae8fbdf7954e7.exe	schtasks.exe
PID 952 wrote to memory of 992	952	d1d057a3ef58e9d59c66346c27b1a9905fc6a90d28cefc69d46ae8fbdf7954e7.exe	schtasks.exe
PID 952 wrote to memory of 904	952	d1d057a3ef58e9d59c66346c27b1a9905fc6a90d28cefc69d46ae8fbdf7954e7.exe	RegSvcs.exe
PID 952 wrote to memory of 904	952	d1d057a3ef58e9d59c66346c27b1a9905fc6a90d28cefc69d46ae8fbdf7954e7.exe	RegSvcs.exe
PID 952 wrote to memory of 904	952	d1d057a3ef58e9d59c66346c27b1a9905fc6a90d28cefc69d46ae8fbdf7954e7.exe	RegSvcs.exe
PID 952 wrote to memory of 904	952	d1d057a3ef58e9d59c66346c27b1a9905fc6a90d28cefc69d46ae8fbdf7954e7.exe	RegSvcs.exe
PID 952 wrote to memory of 904	952	d1d057a3ef58e9d59c66346c27b1a9905fc6a90d28cefc69d46ae8fbdf7954e7.exe	RegSvcs.exe
PID 952 wrote to memory of 904	952	d1d057a3ef58e9d59c66346c27b1a9905fc6a90d28cefc69d46ae8fbdf7954e7.exe	RegSvcs.exe
PID 952 wrote to memory of 904	952	d1d057a3ef58e9d59c66346c27b1a9905fc6a90d28cefc69d46ae8fbdf7954e7.exe	RegSvcs.exe
PID 952 wrote to memory of 904	952	d1d057a3ef58e9d59c66346c27b1a9905fc6a90d28cefc69d46ae8fbdf7954e7.exe	RegSvcs.exe
PID 952 wrote to memory of 904	952	d1d057a3ef58e9d59c66346c27b1a9905fc6a90d28cefc69d46ae8fbdf7954e7.exe	RegSvcs.exe
PID 952 wrote to memory of 904	952	d1d057a3ef58e9d59c66346c27b1a9905fc6a90d28cefc69d46ae8fbdf7954e7.exe	RegSvcs.exe
PID 952 wrote to memory of 904	952	d1d057a3ef58e9d59c66346c27b1a9905fc6a90d28cefc69d46ae8fbdf7954e7.exe	RegSvcs.exe
PID 952 wrote to memory of 904	952	d1d057a3ef58e9d59c66346c27b1a9905fc6a90d28cefc69d46ae8fbdf7954e7.exe	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\d1d057a3ef58e9d59c66346c27b1a9905fc6a90d28cefc69d46ae8fbdf7954e7.exe
"C:\Users\Admin\AppData\Local\Temp\d1d057a3ef58e9d59c66346c27b1a9905fc6a90d28cefc69d46ae8fbdf7954e7.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:952

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\LGlGutVnWHPDKx.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1872

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\LGlGutVnWHPDKx" /XML "C:\Users\Admin\AppData\Local\Temp\tmp2E13.tmp"
2⤵
- Creates scheduled task(s)
PID:992

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
2⤵
PID:904

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp2E13.tmp
Filesize
1KB

MD5
8bbbf6237932f375e0c901db8e2b8505

SHA1
37b2bc762a682dcc0cc8ad1f7af879aea670a1b4

SHA256
7cf0a8a5fd7bdd03a23a881e5758c5aa28d844d0e2daa233b9b852aca91569ed

SHA512
b27439b0f88c657c79c40f0ad8dab51c402a6dd348b2385b86f9ddc5d223b707f920293798dc82391ff9c9aabb789e020118465eb36b4a7d59bfb7e72d66d8e8

Download Submit
memory/904-72-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/904-68-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/904-64-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/904-69-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/904-65-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/904-70-0x000000000040C71E-mapping.dmp

Download
memory/904-67-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/904-74-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/952-57-0x0000000001210000-0x000000000127E000-memory.dmp

Filesize
440KB

Download
memory/952-75-0x00000000012D5000-0x00000000012E6000-memory.dmp

Filesize
68KB

Download
memory/952-63-0x0000000001060000-0x0000000001074000-memory.dmp

Filesize
80KB

Download
memory/952-55-0x0000000076941000-0x0000000076943000-memory.dmp

Filesize
8KB

Download
memory/952-56-0x0000000000370000-0x0000000000388000-memory.dmp

Filesize
96KB

Download
memory/952-58-0x00000000012D5000-0x00000000012E6000-memory.dmp

Filesize
68KB

Download
memory/952-54-0x0000000001360000-0x00000000013F8000-memory.dmp

Filesize
608KB

Download
memory/992-60-0x0000000000000000-mapping.dmp

Download
memory/1872-77-0x000000006BAC0000-0x000000006C06B000-memory.dmp

Filesize
5.7MB

Download
memory/1872-76-0x000000006BAC0000-0x000000006C06B000-memory.dmp

Filesize
5.7MB

Download
memory/1872-59-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads