asyncrat | b93b6f677a941b530dbec8b1abe68c75315d2c1f536d21af726274810c2a10d6

General

Target

101023d30c7a9abcbc6215d42dff4c37.exe
Size

143KB
MD5

101023d30c7a9abcbc6215d42dff4c37
SHA1

f14a2e8943d48418d0c6c07516c5886483e6e5d7
SHA256

b93b6f677a941b530dbec8b1abe68c75315d2c1f536d21af726274810c2a10d6
SHA512

5aede8159e50f1875a19dbfe803310c719eb3653c007c6dcecafa72ea4641f1e192fd6a8dc3d157ca0417b0428c7c9ae9f3ed93364f0eed18dba0baa2d0c5c27
SSDEEP

3072:ubOKrClE0kow0sERAeumu+tDryuYOn6GLKdV7k30P+Gborp42xL:ubOKrClE0sGyy6na0lboBL

Score

10^/10

asyncrat rat

Malware Config

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 5 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1760-54-0x0000000000B20000-0x0000000000B4A000-memory.dmp	asyncrat
\Users\Admin\AppData\Roaming\.Installer.exe	asyncrat
C:\Users\Admin\AppData\Roaming\.Installer.exe	asyncrat
C:\Users\Admin\AppData\Roaming\.Installer.exe	asyncrat
behavioral1/memory/972-68-0x0000000000FB0000-0x0000000000FDA000-memory.dmp	asyncrat

Executes dropped EXE 1 IoCs

Processes:

.Installer.exe

pid process

972 .Installer.exe
Loads dropped DLL 1 IoCs

Processes:

cmd.exe

pid process

1808 cmd.exe
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

888 schtasks.exe
Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

1328 timeout.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

101023d30c7a9abcbc6215d42dff4c37.exe

pid process

1760 101023d30c7a9abcbc6215d42dff4c37.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

101023d30c7a9abcbc6215d42dff4c37.exe.Installer.exe

description pid process

Token: SeDebugPrivilege 1760 101023d30c7a9abcbc6215d42dff4c37.exe
Token: SeDebugPrivilege 972 .Installer.exe

pid	process
972	.Installer.exe

pid	process
1808	cmd.exe

pid	process
888	schtasks.exe

pid	process
1328	timeout.exe

pid	process
1760	101023d30c7a9abcbc6215d42dff4c37.exe

description	pid	process
Token: SeDebugPrivilege	1760	101023d30c7a9abcbc6215d42dff4c37.exe
Token: SeDebugPrivilege	972	.Installer.exe

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

101023d30c7a9abcbc6215d42dff4c37.execmd.execmd.exe

description	pid	process	target process
PID 1760 wrote to memory of 1920	1760	101023d30c7a9abcbc6215d42dff4c37.exe	cmd.exe
PID 1760 wrote to memory of 1920	1760	101023d30c7a9abcbc6215d42dff4c37.exe	cmd.exe
PID 1760 wrote to memory of 1920	1760	101023d30c7a9abcbc6215d42dff4c37.exe	cmd.exe
PID 1760 wrote to memory of 1920	1760	101023d30c7a9abcbc6215d42dff4c37.exe	cmd.exe
PID 1760 wrote to memory of 1808	1760	101023d30c7a9abcbc6215d42dff4c37.exe	cmd.exe
PID 1760 wrote to memory of 1808	1760	101023d30c7a9abcbc6215d42dff4c37.exe	cmd.exe
PID 1760 wrote to memory of 1808	1760	101023d30c7a9abcbc6215d42dff4c37.exe	cmd.exe
PID 1760 wrote to memory of 1808	1760	101023d30c7a9abcbc6215d42dff4c37.exe	cmd.exe
PID 1920 wrote to memory of 888	1920	cmd.exe	schtasks.exe
PID 1920 wrote to memory of 888	1920	cmd.exe	schtasks.exe
PID 1920 wrote to memory of 888	1920	cmd.exe	schtasks.exe
PID 1920 wrote to memory of 888	1920	cmd.exe	schtasks.exe
PID 1808 wrote to memory of 1328	1808	cmd.exe	timeout.exe
PID 1808 wrote to memory of 1328	1808	cmd.exe	timeout.exe
PID 1808 wrote to memory of 1328	1808	cmd.exe	timeout.exe
PID 1808 wrote to memory of 1328	1808	cmd.exe	timeout.exe
PID 1808 wrote to memory of 972	1808	cmd.exe	.Installer.exe
PID 1808 wrote to memory of 972	1808	cmd.exe	.Installer.exe
PID 1808 wrote to memory of 972	1808	cmd.exe	.Installer.exe
PID 1808 wrote to memory of 972	1808	cmd.exe	.Installer.exe
PID 1808 wrote to memory of 972	1808	cmd.exe	.Installer.exe
PID 1808 wrote to memory of 972	1808	cmd.exe	.Installer.exe
PID 1808 wrote to memory of 972	1808	cmd.exe	.Installer.exe

C:\Users\Admin\AppData\Local\Temp\101023d30c7a9abcbc6215d42dff4c37.exe
"C:\Users\Admin\AppData\Local\Temp\101023d30c7a9abcbc6215d42dff4c37.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1760

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn ".Installer" /tr '"C:\Users\Admin\AppData\Roaming\.Installer.exe"' & exit
2⤵
- Suspicious use of WriteProcessMemory
PID:1920

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /f /sc onlogon /rl highest /tn ".Installer" /tr '"C:\Users\Admin\AppData\Roaming\.Installer.exe"'
3⤵
- Creates scheduled task(s)
PID:888

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp251E.tmp.bat""
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1808

C:\Windows\SysWOW64\timeout.exe
timeout 3
3⤵
- Delays execution with timeout.exe
PID:1328

C:\Users\Admin\AppData\Roaming\.Installer.exe
"C:\Users\Admin\AppData\Roaming\.Installer.exe"
3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:972

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1

T1102

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp251E.tmp.bat
Filesize
154B

MD5
6b5765581a532320b83fa49465b4e515

SHA1
ea88c8b6d3403b81b93ba4a4ec22692376ef68d3

SHA256
212eae3378c9417e580898983977ca76466a97ba83f7b9f8fedd2d3c7f386c8e

SHA512
4c294c5f2d21b6108a4d421d8c2a61c4a9f30e513b41660369efff6f7428a2d054281890b1f6a76a425b8e39bf41c18cc5216c6a785831a8299492096340b057

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp251E.tmp.bat
Filesize
154B

MD5
6b5765581a532320b83fa49465b4e515

SHA1
ea88c8b6d3403b81b93ba4a4ec22692376ef68d3

SHA256
212eae3378c9417e580898983977ca76466a97ba83f7b9f8fedd2d3c7f386c8e

SHA512
4c294c5f2d21b6108a4d421d8c2a61c4a9f30e513b41660369efff6f7428a2d054281890b1f6a76a425b8e39bf41c18cc5216c6a785831a8299492096340b057

Download Submit
C:\Users\Admin\AppData\Roaming\.Installer.exe
Filesize
143KB

MD5
101023d30c7a9abcbc6215d42dff4c37

SHA1
f14a2e8943d48418d0c6c07516c5886483e6e5d7

SHA256
b93b6f677a941b530dbec8b1abe68c75315d2c1f536d21af726274810c2a10d6

SHA512
5aede8159e50f1875a19dbfe803310c719eb3653c007c6dcecafa72ea4641f1e192fd6a8dc3d157ca0417b0428c7c9ae9f3ed93364f0eed18dba0baa2d0c5c27

Download Submit
C:\Users\Admin\AppData\Roaming\.Installer.exe
Filesize
143KB

MD5
101023d30c7a9abcbc6215d42dff4c37

SHA1
f14a2e8943d48418d0c6c07516c5886483e6e5d7

SHA256
b93b6f677a941b530dbec8b1abe68c75315d2c1f536d21af726274810c2a10d6

SHA512
5aede8159e50f1875a19dbfe803310c719eb3653c007c6dcecafa72ea4641f1e192fd6a8dc3d157ca0417b0428c7c9ae9f3ed93364f0eed18dba0baa2d0c5c27

Download Submit
\Users\Admin\AppData\Roaming\.Installer.exe
Filesize
143KB

MD5
101023d30c7a9abcbc6215d42dff4c37

SHA1
f14a2e8943d48418d0c6c07516c5886483e6e5d7

SHA256
b93b6f677a941b530dbec8b1abe68c75315d2c1f536d21af726274810c2a10d6

SHA512
5aede8159e50f1875a19dbfe803310c719eb3653c007c6dcecafa72ea4641f1e192fd6a8dc3d157ca0417b0428c7c9ae9f3ed93364f0eed18dba0baa2d0c5c27

Download Submit
memory/972-68-0x0000000000FB0000-0x0000000000FDA000-memory.dmp

Filesize
168KB

Download
memory/972-69-0x0000000000500000-0x0000000000540000-memory.dmp

Filesize
256KB

Download
memory/972-70-0x0000000000500000-0x0000000000540000-memory.dmp

Filesize
256KB

Download
memory/1760-54-0x0000000000B20000-0x0000000000B4A000-memory.dmp

Filesize
168KB

Download
memory/1760-55-0x0000000004EA0000-0x0000000004EE0000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads