asyncrat | b93b6f677a941b530dbec8b1abe68c75315d2c1f536d21af726274810c2a10d6

General

Target

101023d30c7a9abcbc6215d42dff4c37.exe
Size

143KB
MD5

101023d30c7a9abcbc6215d42dff4c37
SHA1

f14a2e8943d48418d0c6c07516c5886483e6e5d7
SHA256

b93b6f677a941b530dbec8b1abe68c75315d2c1f536d21af726274810c2a10d6
SHA512

5aede8159e50f1875a19dbfe803310c719eb3653c007c6dcecafa72ea4641f1e192fd6a8dc3d157ca0417b0428c7c9ae9f3ed93364f0eed18dba0baa2d0c5c27
SSDEEP

3072:ubOKrClE0kow0sERAeumu+tDryuYOn6GLKdV7k30P+Gborp42xL:ubOKrClE0sGyy6na0lboBL

Score

10^/10

asyncrat rat

Malware Config

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/4508-133-0x0000000000F70000-0x0000000000F9A000-memory.dmp	asyncrat
C:\Users\Admin\AppData\Roaming\.Installer.exe	asyncrat
C:\Users\Admin\AppData\Roaming\.Installer.exe	asyncrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

101023d30c7a9abcbc6215d42dff4c37.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Control Panel\International\Geo\Nation	101023d30c7a9abcbc6215d42dff4c37.exe

Executes dropped EXE 1 IoCs

Processes:

.Installer.exe

pid process

3988 .Installer.exe
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

3776 schtasks.exe
Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

4320 timeout.exe

pid	process
3988	.Installer.exe

pid	process
3776	schtasks.exe

pid	process
4320	timeout.exe

Suspicious behavior: EnumeratesProcesses 23 IoCs

Processes:

101023d30c7a9abcbc6215d42dff4c37.exe

pid	process
4508	101023d30c7a9abcbc6215d42dff4c37.exe
4508	101023d30c7a9abcbc6215d42dff4c37.exe
4508	101023d30c7a9abcbc6215d42dff4c37.exe
4508	101023d30c7a9abcbc6215d42dff4c37.exe
4508	101023d30c7a9abcbc6215d42dff4c37.exe
4508	101023d30c7a9abcbc6215d42dff4c37.exe
4508	101023d30c7a9abcbc6215d42dff4c37.exe
4508	101023d30c7a9abcbc6215d42dff4c37.exe
4508	101023d30c7a9abcbc6215d42dff4c37.exe
4508	101023d30c7a9abcbc6215d42dff4c37.exe
4508	101023d30c7a9abcbc6215d42dff4c37.exe
4508	101023d30c7a9abcbc6215d42dff4c37.exe
4508	101023d30c7a9abcbc6215d42dff4c37.exe
4508	101023d30c7a9abcbc6215d42dff4c37.exe
4508	101023d30c7a9abcbc6215d42dff4c37.exe
4508	101023d30c7a9abcbc6215d42dff4c37.exe
4508	101023d30c7a9abcbc6215d42dff4c37.exe
4508	101023d30c7a9abcbc6215d42dff4c37.exe
4508	101023d30c7a9abcbc6215d42dff4c37.exe
4508	101023d30c7a9abcbc6215d42dff4c37.exe
4508	101023d30c7a9abcbc6215d42dff4c37.exe
4508	101023d30c7a9abcbc6215d42dff4c37.exe
4508	101023d30c7a9abcbc6215d42dff4c37.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

101023d30c7a9abcbc6215d42dff4c37.exe.Installer.exe

description pid process

Token: SeDebugPrivilege 4508 101023d30c7a9abcbc6215d42dff4c37.exe
Token: SeDebugPrivilege 3988 .Installer.exe

description	pid	process
Token: SeDebugPrivilege	4508	101023d30c7a9abcbc6215d42dff4c37.exe
Token: SeDebugPrivilege	3988	.Installer.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

101023d30c7a9abcbc6215d42dff4c37.execmd.execmd.exe

description	pid	process	target process
PID 4508 wrote to memory of 1952	4508	101023d30c7a9abcbc6215d42dff4c37.exe	cmd.exe
PID 4508 wrote to memory of 1952	4508	101023d30c7a9abcbc6215d42dff4c37.exe	cmd.exe
PID 4508 wrote to memory of 1952	4508	101023d30c7a9abcbc6215d42dff4c37.exe	cmd.exe
PID 4508 wrote to memory of 3864	4508	101023d30c7a9abcbc6215d42dff4c37.exe	cmd.exe
PID 4508 wrote to memory of 3864	4508	101023d30c7a9abcbc6215d42dff4c37.exe	cmd.exe
PID 4508 wrote to memory of 3864	4508	101023d30c7a9abcbc6215d42dff4c37.exe	cmd.exe
PID 3864 wrote to memory of 4320	3864	cmd.exe	timeout.exe
PID 3864 wrote to memory of 4320	3864	cmd.exe	timeout.exe
PID 3864 wrote to memory of 4320	3864	cmd.exe	timeout.exe
PID 1952 wrote to memory of 3776	1952	cmd.exe	schtasks.exe
PID 1952 wrote to memory of 3776	1952	cmd.exe	schtasks.exe
PID 1952 wrote to memory of 3776	1952	cmd.exe	schtasks.exe
PID 3864 wrote to memory of 3988	3864	cmd.exe	.Installer.exe
PID 3864 wrote to memory of 3988	3864	cmd.exe	.Installer.exe
PID 3864 wrote to memory of 3988	3864	cmd.exe	.Installer.exe

C:\Users\Admin\AppData\Local\Temp\101023d30c7a9abcbc6215d42dff4c37.exe
"C:\Users\Admin\AppData\Local\Temp\101023d30c7a9abcbc6215d42dff4c37.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4508

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn ".Installer" /tr '"C:\Users\Admin\AppData\Roaming\.Installer.exe"' & exit
2⤵
- Suspicious use of WriteProcessMemory
PID:1952

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /f /sc onlogon /rl highest /tn ".Installer" /tr '"C:\Users\Admin\AppData\Roaming\.Installer.exe"'
3⤵
- Creates scheduled task(s)
PID:3776

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpEAB3.tmp.bat""
2⤵
- Suspicious use of WriteProcessMemory
PID:3864

C:\Windows\SysWOW64\timeout.exe
timeout 3
3⤵
- Delays execution with timeout.exe
PID:4320

C:\Users\Admin\AppData\Roaming\.Installer.exe
"C:\Users\Admin\AppData\Roaming\.Installer.exe"
3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3988

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1

T1102

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpEAB3.tmp.bat
Filesize
154B

MD5
5df93452e913d314ea979d1468790d47

SHA1
f05caa6f01f9b77f2ace742390582f8686bd1985

SHA256
f807bae5e48dcf16d32d34dafabd57cf6c9c951b1c8f606aafd8449d3f218fe3

SHA512
296af66bcd3ee0d204b904b121ad4f1b26a0bf8ae786105883e4afd674647219fcab551a79330bac260cd4906163c788d622fdc60d17721056f2a552962cc7d4

Download Submit
C:\Users\Admin\AppData\Roaming\.Installer.exe
Filesize
143KB

MD5
101023d30c7a9abcbc6215d42dff4c37

SHA1
f14a2e8943d48418d0c6c07516c5886483e6e5d7

SHA256
b93b6f677a941b530dbec8b1abe68c75315d2c1f536d21af726274810c2a10d6

SHA512
5aede8159e50f1875a19dbfe803310c719eb3653c007c6dcecafa72ea4641f1e192fd6a8dc3d157ca0417b0428c7c9ae9f3ed93364f0eed18dba0baa2d0c5c27

Download Submit
C:\Users\Admin\AppData\Roaming\.Installer.exe
Filesize
143KB

MD5
101023d30c7a9abcbc6215d42dff4c37

SHA1
f14a2e8943d48418d0c6c07516c5886483e6e5d7

SHA256
b93b6f677a941b530dbec8b1abe68c75315d2c1f536d21af726274810c2a10d6

SHA512
5aede8159e50f1875a19dbfe803310c719eb3653c007c6dcecafa72ea4641f1e192fd6a8dc3d157ca0417b0428c7c9ae9f3ed93364f0eed18dba0baa2d0c5c27

Download Submit
memory/3988-145-0x0000000004F70000-0x0000000004F80000-memory.dmp

Filesize
64KB

Download
memory/3988-146-0x0000000004F70000-0x0000000004F80000-memory.dmp

Filesize
64KB

Download
memory/4508-133-0x0000000000F70000-0x0000000000F9A000-memory.dmp

Filesize
168KB

Download
memory/4508-134-0x00000000059B0000-0x00000000059C0000-memory.dmp

Filesize
64KB

Download
memory/4508-135-0x0000000005A30000-0x0000000005A96000-memory.dmp

Filesize
408KB

Download
memory/4508-136-0x0000000005EC0000-0x0000000005F5C000-memory.dmp

Filesize
624KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads