asyncrat | 119665a19ae82240ec86094aa58935708e081dea15b03da7574f342a0e96d153

General

Target

119665A19AE82240EC86094AA.exe
Size

48KB
MD5

47317851e54b34394181c9d05b936256
SHA1

4da8b0fcda1836d903d0c210ae8c27be27d8383e
SHA256

119665a19ae82240ec86094aa58935708e081dea15b03da7574f342a0e96d153
SHA512

550aaf26d3722718a4608d38ef124f09486a2b44ecc5d919b21fae32176d03143eb166526d505713d32e1d8abfc17c594317b9d2b195f863aec87dd36db5d418
SSDEEP

768:Eov5MNNmnO4Gl2CNm/u2ZHCLkjbsgr3iifkEH5zn+FSJWClZJ2tYcFmVc6K:Eov5MNQruyckbjrSmRrJKmVcl

Score

10^/10

asyncrat default rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.6D

Botnet

Default

C2

seznam.zapto.org:6606

seznam.zapto.org:7707

seznam.zapto.org:8808

milla.publicvm.com:6606

milla.publicvm.com:7707

milla.publicvm.com:8808

Mutex

hkpebjnelrq

Attributes

delay
8
install
true
install_file
microsafta.exe
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 5 IoCs

rat

resource	yara_rule
behavioral1/memory/2136-54-0x0000000000F70000-0x0000000000F82000-memory.dmp	asyncrat
behavioral1/files/0x0009000000012287-66.dat	asyncrat
behavioral1/files/0x0009000000012287-67.dat	asyncrat
behavioral1/memory/2388-68-0x0000000001210000-0x0000000001222000-memory.dmp	asyncrat
behavioral1/memory/2388-69-0x0000000000980000-0x0000000000A00000-memory.dmp	asyncrat

Executes dropped EXE 1 IoCs

pid	Process
2388	microsafta.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1760	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
1964	timeout.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2136	119665A19AE82240EC86094AA.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2136	119665A19AE82240EC86094AA.exe
Token: SeDebugPrivilege	2388	microsafta.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 2136 wrote to memory of 3012	2136	119665A19AE82240EC86094AA.exe	29
PID 2136 wrote to memory of 3012	2136	119665A19AE82240EC86094AA.exe	29
PID 2136 wrote to memory of 3012	2136	119665A19AE82240EC86094AA.exe	29
PID 2136 wrote to memory of 1220	2136	119665A19AE82240EC86094AA.exe	31
PID 2136 wrote to memory of 1220	2136	119665A19AE82240EC86094AA.exe	31
PID 2136 wrote to memory of 1220	2136	119665A19AE82240EC86094AA.exe	31
PID 3012 wrote to memory of 1760	3012	cmd.exe	33
PID 3012 wrote to memory of 1760	3012	cmd.exe	33
PID 3012 wrote to memory of 1760	3012	cmd.exe	33
PID 1220 wrote to memory of 1964	1220	cmd.exe	34
PID 1220 wrote to memory of 1964	1220	cmd.exe	34
PID 1220 wrote to memory of 1964	1220	cmd.exe	34
PID 1220 wrote to memory of 2388	1220	cmd.exe	35
PID 1220 wrote to memory of 2388	1220	cmd.exe	35
PID 1220 wrote to memory of 2388	1220	cmd.exe	35

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\119665A19AE82240EC86094AA.exe
"C:\Users\Admin\AppData\Local\Temp\119665A19AE82240EC86094AA.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2136
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /ru system /rl highest /tn 119665A19AE82240EC86094AA /tr '"C:\Users\Admin\AppData\Roaming\microsafta.exe"' & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3012
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc onlogon /ru system /rl highest /tn 119665A19AE82240EC86094AA /tr '"C:\Users\Admin\AppData\Roaming\microsafta.exe"'
    3⤵
    - Creates scheduled task(s)
    PID:1760
- C:\Windows\system32\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp58AC.tmp.bat""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1220
- - C:\Windows\system32\timeout.exe
    timeout 3
    3⤵
    - Delays execution with timeout.exe
    PID:1964
- - C:\Users\Admin\AppData\Roaming\microsafta.exe
    "C:\Users\Admin\AppData\Roaming\microsafta.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:2388

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\CabA0A6.tmp

Filesize
62KB

MD5
3ac860860707baaf32469fa7cc7c0192

SHA1
c33c2acdaba0e6fa41fd2f00f186804722477639

SHA256
d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

SHA512
d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp58AC.tmp.bat

Filesize
154B

MD5
bc3dcec939fcbed7db4aaad3c1e54d56

SHA1
b51c0895258ba8b63820680ff5f22c20ae076965

SHA256
ea7d7f29e472f727c9ae9ad32f56aa42eebee7bba157971bedda2f46d0dc5a33

SHA512
d6816bc680c61d6ff1aa60d43ec0787b46b7033e03d3e2a6c60eccf6308804ba0ec0b55acb5af6a3629d300cb05eae3bb9626fcccc836545ac0e2cfb8a6902f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp58AC.tmp.bat

Filesize
154B

MD5
bc3dcec939fcbed7db4aaad3c1e54d56

SHA1
b51c0895258ba8b63820680ff5f22c20ae076965

SHA256
ea7d7f29e472f727c9ae9ad32f56aa42eebee7bba157971bedda2f46d0dc5a33

SHA512
d6816bc680c61d6ff1aa60d43ec0787b46b7033e03d3e2a6c60eccf6308804ba0ec0b55acb5af6a3629d300cb05eae3bb9626fcccc836545ac0e2cfb8a6902f7

Download Submit
C:\Users\Admin\AppData\Roaming\microsafta.exe

Filesize
48KB

MD5
47317851e54b34394181c9d05b936256

SHA1
4da8b0fcda1836d903d0c210ae8c27be27d8383e

SHA256
119665a19ae82240ec86094aa58935708e081dea15b03da7574f342a0e96d153

SHA512
550aaf26d3722718a4608d38ef124f09486a2b44ecc5d919b21fae32176d03143eb166526d505713d32e1d8abfc17c594317b9d2b195f863aec87dd36db5d418

Download Submit
C:\Users\Admin\AppData\Roaming\microsafta.exe

Filesize
48KB

MD5
47317851e54b34394181c9d05b936256

SHA1
4da8b0fcda1836d903d0c210ae8c27be27d8383e

SHA256
119665a19ae82240ec86094aa58935708e081dea15b03da7574f342a0e96d153

SHA512
550aaf26d3722718a4608d38ef124f09486a2b44ecc5d919b21fae32176d03143eb166526d505713d32e1d8abfc17c594317b9d2b195f863aec87dd36db5d418

Download Submit
memory/2136-54-0x0000000000F70000-0x0000000000F82000-memory.dmp

Filesize
72KB

Download
memory/2136-55-0x00000000004B0000-0x0000000000530000-memory.dmp

Filesize
512KB

Download
memory/2388-68-0x0000000001210000-0x0000000001222000-memory.dmp

Filesize
72KB

Download
memory/2388-69-0x0000000000980000-0x0000000000A00000-memory.dmp

Filesize
512KB

Download
memory/2388-86-0x0000000000980000-0x0000000000A00000-memory.dmp

Filesize
512KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads