asyncrat | 1270491bd3068a4159eee0ad8c8d6871cf0ba80cac9fd749a7e9d1c02f6f3653

General

Target

SCRSHOT02.scr.exe
Size

255KB
MD5

cc54630cfed370da5d83b5c3d0ee9ec4
SHA1

d18ba6e2d8e877bc0bec89536087f49a4bf32921
SHA256

1270491bd3068a4159eee0ad8c8d6871cf0ba80cac9fd749a7e9d1c02f6f3653
SHA512

1b7a78bb5303e97cb74896d68d6094a050e8859a2b944840619ad3b589a4654d292363e3afce33a7fd2d1805ead532ba706951149a9742f5040f2252d17b695a
SSDEEP

3072:FRsjupfBVcoFDzbtu/c762soY8zyCy0A:MKxBVjF3bc/cpsoYSHA

Score

10^/10

asyncrat default rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

Default

C2

iphy1.duckdns.org:8808

Mutex

AsyncMutex_6SI8OkPnkg

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 5 IoCs

rat

resource	yara_rule
behavioral1/memory/1932-59-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat
behavioral1/memory/1932-60-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat
behavioral1/memory/1932-62-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat
behavioral1/memory/1932-64-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat
behavioral1/memory/1932-66-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1980 set thread context of 1932	1980	SCRSHOT02.scr.exe	28

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
588	schtasks.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1980	SCRSHOT02.scr.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1932	vbc.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 1980 wrote to memory of 1932	1980	SCRSHOT02.scr.exe	28
PID 1980 wrote to memory of 1932	1980	SCRSHOT02.scr.exe	28
PID 1980 wrote to memory of 1932	1980	SCRSHOT02.scr.exe	28
PID 1980 wrote to memory of 1932	1980	SCRSHOT02.scr.exe	28
PID 1980 wrote to memory of 1932	1980	SCRSHOT02.scr.exe	28
PID 1980 wrote to memory of 1932	1980	SCRSHOT02.scr.exe	28
PID 1980 wrote to memory of 1932	1980	SCRSHOT02.scr.exe	28
PID 1980 wrote to memory of 1932	1980	SCRSHOT02.scr.exe	28
PID 1980 wrote to memory of 1932	1980	SCRSHOT02.scr.exe	28
PID 1980 wrote to memory of 2020	1980	SCRSHOT02.scr.exe	29
PID 1980 wrote to memory of 2020	1980	SCRSHOT02.scr.exe	29
PID 1980 wrote to memory of 2020	1980	SCRSHOT02.scr.exe	29
PID 1980 wrote to memory of 2020	1980	SCRSHOT02.scr.exe	29
PID 1980 wrote to memory of 268	1980	SCRSHOT02.scr.exe	31
PID 1980 wrote to memory of 268	1980	SCRSHOT02.scr.exe	31
PID 1980 wrote to memory of 268	1980	SCRSHOT02.scr.exe	31
PID 1980 wrote to memory of 268	1980	SCRSHOT02.scr.exe	31
PID 268 wrote to memory of 588	268	cmd.exe	33
PID 268 wrote to memory of 588	268	cmd.exe	33
PID 268 wrote to memory of 588	268	cmd.exe	33
PID 268 wrote to memory of 588	268	cmd.exe	33
PID 1980 wrote to memory of 2016	1980	SCRSHOT02.scr.exe	34
PID 1980 wrote to memory of 2016	1980	SCRSHOT02.scr.exe	34
PID 1980 wrote to memory of 2016	1980	SCRSHOT02.scr.exe	34
PID 1980 wrote to memory of 2016	1980	SCRSHOT02.scr.exe	34

C:\Users\Admin\AppData\Local\Temp\SCRSHOT02.scr.exe
"C:\Users\Admin\AppData\Local\Temp\SCRSHOT02.scr.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1980
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1932
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C mkdir "C:\Users\Admin\AppData\Roaming\winpr01"
  2⤵
  PID:2020
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\winpr01\winpr01.exe'" /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:268
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\winpr01\winpr01.exe'" /f
    3⤵
    - Creates scheduled task(s)
    PID:588
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C copy "C:\Users\Admin\AppData\Local\Temp\SCRSHOT02.scr.exe" "C:\Users\Admin\AppData\Roaming\winpr01\winpr01.exe"
  2⤵
  PID:2016

C:\Windows\system32\taskeng.exe
taskeng.exe {AD63F0F9-474F-44BC-A834-2D612A8DA8D1} S-1-5-21-3948302646-268491222-1934009652-1000:KXZDHPUW\Admin:Interactive:[1]
1⤵
PID:1136

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Scripting

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Scripting

1

T1064

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
62KB

MD5
3ac860860707baaf32469fa7cc7c0192

SHA1
c33c2acdaba0e6fa41fd2f00f186804722477639

SHA256
d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

SHA512
d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar773A.tmp

Filesize
164KB

MD5
4ff65ad929cd9a367680e0e5b1c08166

SHA1
c0af0d4396bd1f15c45f39d3b849ba444233b3a2

SHA256
c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6

SHA512
f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27

Download Submit
memory/1932-62-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1932-67-0x00000000005F0000-0x0000000000630000-memory.dmp

Filesize
256KB

Download
memory/1932-58-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1932-59-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1932-60-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1932-61-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/1932-109-0x0000000005370000-0x00000000053D0000-memory.dmp

Filesize
384KB

Download
memory/1932-64-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1932-66-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1932-57-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1932-85-0x0000000006170000-0x00000000061EE000-memory.dmp

Filesize
504KB

Download
memory/1932-86-0x00000000005F0000-0x0000000000630000-memory.dmp

Filesize
256KB

Download
memory/1932-108-0x0000000006650000-0x00000000066E0000-memory.dmp

Filesize
576KB

Download
memory/1932-107-0x0000000000AF0000-0x0000000000AFA000-memory.dmp

Filesize
40KB

Download
memory/1980-55-0x0000000002160000-0x00000000021A0000-memory.dmp

Filesize
256KB

Download
memory/1980-56-0x0000000000340000-0x0000000000350000-memory.dmp

Filesize
64KB

Download
memory/1980-54-0x0000000000350000-0x0000000000396000-memory.dmp

Filesize
280KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads