asyncrat | 127c167eab781efef570aaa089b6a66141953dc700beb9f5d5ba4cfa6ae4c97d

General

Target

01206099.exe
Size

698KB
MD5

acca46dd166c04133d2916b8d780e245
SHA1

e426111a0a29367369a81219161e7577158f0204
SHA256

127c167eab781efef570aaa089b6a66141953dc700beb9f5d5ba4cfa6ae4c97d
SHA512

e603a3c651c612edc29bfbb0e688b75e4faa8e7b96a94dbb860d404191d04f1a1ea488302aa4516f778922bb866014591963732cb42e67f608db90411f1a5004
SSDEEP

6144:XWoSFtKEx6Ixb26rQ7jnr83cVcg6fBuBuDuHJMJlFRQJfYyu2gHuFdfYJFuVBiLQ:XYxa/7jn7lTMZod7Y8

Score

10^/10

asyncrat rat

Malware Config

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 3 IoCs

rat

resource	yara_rule
behavioral2/memory/4932-133-0x0000000000AD0000-0x0000000000B84000-memory.dmp	asyncrat
behavioral2/files/0x0003000000000739-144.dat	asyncrat
behavioral2/files/0x0003000000000739-145.dat	asyncrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation	01206099.exe

Executes dropped EXE 1 IoCs

pid	Process
3660	service.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
2224	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
4332	timeout.exe

Suspicious behavior: EnumeratesProcesses 23 IoCs

pid	Process
4932	01206099.exe
4932	01206099.exe
4932	01206099.exe
4932	01206099.exe
4932	01206099.exe
4932	01206099.exe
4932	01206099.exe
4932	01206099.exe
4932	01206099.exe
4932	01206099.exe
4932	01206099.exe
4932	01206099.exe
4932	01206099.exe
4932	01206099.exe
4932	01206099.exe
4932	01206099.exe
4932	01206099.exe
4932	01206099.exe
4932	01206099.exe
4932	01206099.exe
4932	01206099.exe
4932	01206099.exe
4932	01206099.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4932	01206099.exe
Token: SeDebugPrivilege	3660	service.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 4932 wrote to memory of 2644	4932	01206099.exe	85
PID 4932 wrote to memory of 2644	4932	01206099.exe	85
PID 4932 wrote to memory of 2644	4932	01206099.exe	85
PID 4932 wrote to memory of 5100	4932	01206099.exe	87
PID 4932 wrote to memory of 5100	4932	01206099.exe	87
PID 4932 wrote to memory of 5100	4932	01206099.exe	87
PID 2644 wrote to memory of 2224	2644	cmd.exe	89
PID 2644 wrote to memory of 2224	2644	cmd.exe	89
PID 2644 wrote to memory of 2224	2644	cmd.exe	89
PID 5100 wrote to memory of 4332	5100	cmd.exe	90
PID 5100 wrote to memory of 4332	5100	cmd.exe	90
PID 5100 wrote to memory of 4332	5100	cmd.exe	90
PID 5100 wrote to memory of 3660	5100	cmd.exe	94
PID 5100 wrote to memory of 3660	5100	cmd.exe	94
PID 5100 wrote to memory of 3660	5100	cmd.exe	94

C:\Users\Admin\AppData\Local\Temp\01206099.exe
"C:\Users\Admin\AppData\Local\Temp\01206099.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4932
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "service" /tr '"C:\Users\Admin\AppData\Roaming\service.exe"' & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2644
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /f /sc onlogon /rl highest /tn "service" /tr '"C:\Users\Admin\AppData\Roaming\service.exe"'
    3⤵
    - Creates scheduled task(s)
    PID:2224
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp9E77.tmp.bat""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5100
- - C:\Windows\SysWOW64\timeout.exe
    timeout 3
    3⤵
    - Delays execution with timeout.exe
    PID:4332
- - C:\Users\Admin\AppData\Roaming\service.exe
    "C:\Users\Admin\AppData\Roaming\service.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:3660

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Web Service

1

T1102

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp9E77.tmp.bat

Filesize
151B

MD5
a00b8e1ebe187811bffc5dabc9a0d414

SHA1
462d70fbf2c734902d9598401c3253adee5c85e2

SHA256
7ba529b97f7671c1381ffb14b5d43c0dcfbcdaa0e579d1c75e958af6bad8fc41

SHA512
8796612e8233a635cc86c03e58f6795b7addd29320c976967bd935ac4d0a98b0dbdbee26a4dd8df585f0b8880ba469da57be9e894982f2cd1f36024ae68a32f8

Download Submit
C:\Users\Admin\AppData\Roaming\service.exe

Filesize
698KB

MD5
acca46dd166c04133d2916b8d780e245

SHA1
e426111a0a29367369a81219161e7577158f0204

SHA256
127c167eab781efef570aaa089b6a66141953dc700beb9f5d5ba4cfa6ae4c97d

SHA512
e603a3c651c612edc29bfbb0e688b75e4faa8e7b96a94dbb860d404191d04f1a1ea488302aa4516f778922bb866014591963732cb42e67f608db90411f1a5004

Download Submit
C:\Users\Admin\AppData\Roaming\service.exe

Filesize
698KB

MD5
acca46dd166c04133d2916b8d780e245

SHA1
e426111a0a29367369a81219161e7577158f0204

SHA256
127c167eab781efef570aaa089b6a66141953dc700beb9f5d5ba4cfa6ae4c97d

SHA512
e603a3c651c612edc29bfbb0e688b75e4faa8e7b96a94dbb860d404191d04f1a1ea488302aa4516f778922bb866014591963732cb42e67f608db90411f1a5004

Download Submit
memory/3660-146-0x0000000005920000-0x0000000005930000-memory.dmp

Filesize
64KB

Download
memory/3660-147-0x0000000005920000-0x0000000005930000-memory.dmp

Filesize
64KB

Download
memory/4932-133-0x0000000000AD0000-0x0000000000B84000-memory.dmp

Filesize
720KB

Download
memory/4932-134-0x0000000005500000-0x0000000005510000-memory.dmp

Filesize
64KB

Download
memory/4932-135-0x0000000005680000-0x00000000056E6000-memory.dmp

Filesize
408KB

Download
memory/4932-136-0x0000000005790000-0x000000000582C000-memory.dmp

Filesize
624KB

Download
memory/4932-137-0x0000000005E40000-0x0000000005ED2000-memory.dmp

Filesize
584KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads