asyncrat | ba0b8d476dc0152aa59cfc15b1a93fc039baab07cdf95677871d9157488babe4

General

Target

tmp.exe
Size

57KB
MD5

7422d3af2fc6d1f7ecef432d86353456
SHA1

fd470052846183329edd22a923d070ad71ba79cc
SHA256

ba0b8d476dc0152aa59cfc15b1a93fc039baab07cdf95677871d9157488babe4
SHA512

24baf349ae705d0d88571a79a5d449f3ee4bb3e9f751d44a26f263298d69e5872ee9d8e6f4b150dd24a669f534b67a1de184466ba25399b6d9da68537693063a
SSDEEP

1536:aIUw2xx5XbyB/licYH6GlQZXRwA2IJYkbHTH1lmK9Xx:aIUw2xx5Xb0/EcYH6GlQEANCkbHTNVx

Score

10^/10

asyncrat hawkeye a&h keylogger rat spyware stealer trojan

Malware Config

Extracted

Family

asyncrat

Version

| Edit 3LOSH RAT

Botnet

A&H

C2

aboreda.linkpc.net:6666

Mutex

AsyncMutex_6SI8OkPnk

Attributes

delay
10
install
true
install_file
WindowsUpdate.exe
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
HawkEye
HawkEye is a malware kit that has seen continuous development since at least 2013.
keylogger trojan stealer spyware hawkeye

Async RAT payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/384-133-0x0000000000290000-0x00000000002A4000-memory.dmp	asyncrat
C:\Users\Admin\AppData\Roaming\WindowsUpdate.exe	asyncrat
C:\Users\Admin\AppData\Roaming\WindowsUpdate.exe	asyncrat

Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

tmp.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation tmp.exe
Executes dropped EXE 1 IoCs

Processes:

WindowsUpdate.exe

pid process

1452 WindowsUpdate.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

4200 schtasks.exe
Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

1272 timeout.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation	tmp.exe

pid	process
1452	WindowsUpdate.exe

pid	process
4200	schtasks.exe

pid	process
1272	timeout.exe

Suspicious behavior: EnumeratesProcesses 23 IoCs

Processes:

tmp.exe

pid	process
384	tmp.exe
384	tmp.exe
384	tmp.exe
384	tmp.exe
384	tmp.exe
384	tmp.exe
384	tmp.exe
384	tmp.exe
384	tmp.exe
384	tmp.exe
384	tmp.exe
384	tmp.exe
384	tmp.exe
384	tmp.exe
384	tmp.exe
384	tmp.exe
384	tmp.exe
384	tmp.exe
384	tmp.exe
384	tmp.exe
384	tmp.exe
384	tmp.exe
384	tmp.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

tmp.exeWindowsUpdate.exe

description pid process

Token: SeDebugPrivilege 384 tmp.exe
Token: SeDebugPrivilege 1452 WindowsUpdate.exe

description	pid	process
Token: SeDebugPrivilege	384	tmp.exe
Token: SeDebugPrivilege	1452	WindowsUpdate.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

tmp.execmd.execmd.exe

description	pid	process	target process
PID 384 wrote to memory of 3180	384	tmp.exe	cmd.exe
PID 384 wrote to memory of 3180	384	tmp.exe	cmd.exe
PID 384 wrote to memory of 3180	384	tmp.exe	cmd.exe
PID 384 wrote to memory of 4768	384	tmp.exe	cmd.exe
PID 384 wrote to memory of 4768	384	tmp.exe	cmd.exe
PID 384 wrote to memory of 4768	384	tmp.exe	cmd.exe
PID 4768 wrote to memory of 1272	4768	cmd.exe	timeout.exe
PID 4768 wrote to memory of 1272	4768	cmd.exe	timeout.exe
PID 4768 wrote to memory of 1272	4768	cmd.exe	timeout.exe
PID 3180 wrote to memory of 4200	3180	cmd.exe	schtasks.exe
PID 3180 wrote to memory of 4200	3180	cmd.exe	schtasks.exe
PID 3180 wrote to memory of 4200	3180	cmd.exe	schtasks.exe
PID 4768 wrote to memory of 1452	4768	cmd.exe	WindowsUpdate.exe
PID 4768 wrote to memory of 1452	4768	cmd.exe	WindowsUpdate.exe
PID 4768 wrote to memory of 1452	4768	cmd.exe	WindowsUpdate.exe

C:\Users\Admin\AppData\Local\Temp\tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmp.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:384

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "WindowsUpdate" /tr '"C:\Users\Admin\AppData\Roaming\WindowsUpdate.exe"' & exit
2⤵
- Suspicious use of WriteProcessMemory
PID:3180

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /f /sc onlogon /rl highest /tn "WindowsUpdate" /tr '"C:\Users\Admin\AppData\Roaming\WindowsUpdate.exe"'
3⤵
- Creates scheduled task(s)
PID:4200

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpB366.tmp.bat""
2⤵
- Suspicious use of WriteProcessMemory
PID:4768

C:\Windows\SysWOW64\timeout.exe
timeout 3
3⤵
- Delays execution with timeout.exe
PID:1272

C:\Users\Admin\AppData\Roaming\WindowsUpdate.exe
"C:\Users\Admin\AppData\Roaming\WindowsUpdate.exe"
3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1452

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpB366.tmp.bat
Filesize
157B

MD5
2e9a429a29f55de65dee5e50de45b9d5

SHA1
178d0449e03d65ab93d6f7d5e8564db116bb3d63

SHA256
583a5ee750f2f612522e360e8cc58c70797ceaed5f044fede51baccfa1a168f2

SHA512
6dc9ef060dcbf53468b6055fc0c02e527a966917d73268ce477569d746ac5f621bf7e574154b4f534c2029899921148cd21cc4cf587041e4efbfce54316b52cb

Download Submit
C:\Users\Admin\AppData\Roaming\WindowsUpdate.exe
Filesize
57KB

MD5
7422d3af2fc6d1f7ecef432d86353456

SHA1
fd470052846183329edd22a923d070ad71ba79cc

SHA256
ba0b8d476dc0152aa59cfc15b1a93fc039baab07cdf95677871d9157488babe4

SHA512
24baf349ae705d0d88571a79a5d449f3ee4bb3e9f751d44a26f263298d69e5872ee9d8e6f4b150dd24a669f534b67a1de184466ba25399b6d9da68537693063a

Download Submit
C:\Users\Admin\AppData\Roaming\WindowsUpdate.exe
Filesize
57KB

MD5
7422d3af2fc6d1f7ecef432d86353456

SHA1
fd470052846183329edd22a923d070ad71ba79cc

SHA256
ba0b8d476dc0152aa59cfc15b1a93fc039baab07cdf95677871d9157488babe4

SHA512
24baf349ae705d0d88571a79a5d449f3ee4bb3e9f751d44a26f263298d69e5872ee9d8e6f4b150dd24a669f534b67a1de184466ba25399b6d9da68537693063a

Download Submit
memory/384-133-0x0000000000290000-0x00000000002A4000-memory.dmp

Filesize
80KB

Download
memory/384-134-0x00000000027C0000-0x00000000027D0000-memory.dmp

Filesize
64KB

Download
memory/384-135-0x0000000004DC0000-0x0000000004E5C000-memory.dmp

Filesize
624KB

Download
memory/1452-144-0x0000000005950000-0x0000000005960000-memory.dmp

Filesize
64KB

Download
memory/1452-145-0x00000000062F0000-0x0000000006894000-memory.dmp

Filesize
5.6MB

Download
memory/1452-146-0x0000000005DC0000-0x0000000005E26000-memory.dmp

Filesize
408KB

Download
memory/1452-147-0x0000000005950000-0x0000000005960000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads