asyncrat | 6385b31519c35421fe238e9e51ff6aee15c9e3719eaeb1d86aaea0b074be687b

General

Target

1f96941dc2540d33d143719ec73bb9cc.exe
Size

1.7MB
MD5

1f96941dc2540d33d143719ec73bb9cc
SHA1

c89543d4efcb4e8f74a2716dcb9bb2fbd2f94cee
SHA256

6385b31519c35421fe238e9e51ff6aee15c9e3719eaeb1d86aaea0b074be687b
SHA512

7bb6cd9e680b5f851249b1d77c507e2f7623af1828bbdfb4ac13e29c92b484bf02c906de23cfa8853ebf390ebc87380bd87d15a8bfb2c1487eb0fa644b0dea80
SSDEEP

24576:LR9Ot09OX7l348A5NyRQ80zEbiRRCRnOO8v6JnOk6PzdNhCQa61NEzMvPJgqqaF6:hz+Rn0tqaWxuGND

Score

10^/10

asyncrat zf persistence rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

ZF

C2

127.0.0.1:6606

127.0.0.1:7707

127.0.0.1:8808

127.0.0.1:11334

139.180.143.50:6606

139.180.143.50:7707

139.180.143.50:8808

139.180.143.50:11334

Mutex

GPT_Conn4

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/2040-76-0x000000001B2B0000-0x000000001B2C2000-memory.dmp	asyncrat

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

1f96941dc2540d33d143719ec73bb9cc.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Windows\CurrentVersion\Run\Hfxioqcy = "\"C:\\Users\\Admin\\AppData\\Roaming\\Eacayjaokvn\\Hfxioqcy.exe\""	1f96941dc2540d33d143719ec73bb9cc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid process

784 powershell.exe

pid	process
784	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

powershell.exe1f96941dc2540d33d143719ec73bb9cc.exe

description	pid	process
Token: SeDebugPrivilege	784	powershell.exe
Token: SeDebugPrivilege	2040	1f96941dc2540d33d143719ec73bb9cc.exe
Token: SeDebugPrivilege	2040	1f96941dc2540d33d143719ec73bb9cc.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

1f96941dc2540d33d143719ec73bb9cc.exe

description	pid	process	target process
PID 2040 wrote to memory of 784	2040	1f96941dc2540d33d143719ec73bb9cc.exe	powershell.exe
PID 2040 wrote to memory of 784	2040	1f96941dc2540d33d143719ec73bb9cc.exe	powershell.exe
PID 2040 wrote to memory of 784	2040	1f96941dc2540d33d143719ec73bb9cc.exe	powershell.exe

C:\Users\Admin\AppData\Local\Temp\1f96941dc2540d33d143719ec73bb9cc.exe
"C:\Users\Admin\AppData\Local\Temp\1f96941dc2540d33d143719ec73bb9cc.exe"
1⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2040

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMgAwAA==
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:784

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/784-73-0x0000000002450000-0x00000000024D0000-memory.dmp

Filesize
512KB

Download
memory/784-65-0x0000000002220000-0x0000000002228000-memory.dmp

Filesize
32KB

Download
memory/784-66-0x0000000002450000-0x00000000024D0000-memory.dmp

Filesize
512KB

Download
memory/784-67-0x0000000002450000-0x00000000024D0000-memory.dmp

Filesize
512KB

Download
memory/784-74-0x0000000002450000-0x00000000024D0000-memory.dmp

Filesize
512KB

Download
memory/784-72-0x0000000002450000-0x00000000024D0000-memory.dmp

Filesize
512KB

Download
memory/784-64-0x000000001B120000-0x000000001B402000-memory.dmp

Filesize
2.9MB

Download
memory/784-68-0x0000000002450000-0x00000000024D0000-memory.dmp

Filesize
512KB

Download
memory/784-71-0x0000000002450000-0x00000000024D0000-memory.dmp

Filesize
512KB

Download
memory/2040-59-0x000000001BD60000-0x000000001BDE0000-memory.dmp

Filesize
512KB

Download
memory/2040-76-0x000000001B2B0000-0x000000001B2C2000-memory.dmp

Filesize
72KB

Download
memory/2040-69-0x000000001BD60000-0x000000001BDE0000-memory.dmp

Filesize
512KB

Download
memory/2040-70-0x000000001BD60000-0x000000001BDE0000-memory.dmp

Filesize
512KB

Download
memory/2040-78-0x00000000025E0000-0x00000000025F5000-memory.dmp

Filesize
84KB

Download
memory/2040-55-0x0000000000550000-0x0000000000575000-memory.dmp

Filesize
148KB

Download
memory/2040-54-0x0000000000F10000-0x00000000010CE000-memory.dmp

Filesize
1.7MB

Download
memory/2040-58-0x000000001BF30000-0x000000001BFC2000-memory.dmp

Filesize
584KB

Download
memory/2040-57-0x000000001BDE0000-0x000000001BF2C000-memory.dmp

Filesize
1.3MB

Download
memory/2040-77-0x0000000000D10000-0x0000000000D11000-memory.dmp

Filesize
4KB

Download
memory/2040-56-0x000000001BD60000-0x000000001BDE0000-memory.dmp

Filesize
512KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads