asyncrat | 87623be8ea7155f32f333a9a165f7fd5249a5d3b4be7c4fbf3293303b4698899

Analysis

max time kernel
145s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
22/08/2023, 02:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

fa113db48017bf0f7f3d2d34afb8001a1451714986141b003657e799ef9e9324.exe
Size

48KB
MD5

e390b2bca53a5f3cccb7c9d88649be28
SHA1

08dd4fefc9fa9fbdfa18501d1940c7364cb67d6b
SHA256

fa113db48017bf0f7f3d2d34afb8001a1451714986141b003657e799ef9e9324
SHA512

b037241c781989108520e04b75ef0348b1c3b6868458b0152725b6e0565c0ad942a5f5ee8d2d9403ac6c5f7862413b952992a9bf94e5ecd7dc5926d59e4f9f8f
SSDEEP

768:R0K0ILGCqb+DiuLFxh632Oii8YbXgeaO5Lim+dIvEgK/Jj5Vc6KN:R0pTuRxkFzbwUJ+dInkJj5VclN

Score

10^/10

asyncrat default rat

Malware Config

Extracted

Family

asyncrat

Version

1.0.7

Botnet

Default

127.0.0.1:8848

127.0.0.1:8858

127.0.0.1:8989

thwit.ddns.net:8848

thwit.ddns.net:8858

thwit.ddns.net:8989

Mutex

DcRatMutex_qwqdnachun

Attributes

delay
1
install
true
install_file
..\..\..\..\tmp\svchost.exe
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral2/memory/4928-133-0x0000000000890000-0x00000000008A2000-memory.dmp	asyncrat

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
4648	schtasks.exe

Suspicious behavior: EnumeratesProcesses 23 IoCs

pid	Process
4928	fa113db48017bf0f7f3d2d34afb8001a1451714986141b003657e799ef9e9324.exe
4928	fa113db48017bf0f7f3d2d34afb8001a1451714986141b003657e799ef9e9324.exe
4928	fa113db48017bf0f7f3d2d34afb8001a1451714986141b003657e799ef9e9324.exe
4928	fa113db48017bf0f7f3d2d34afb8001a1451714986141b003657e799ef9e9324.exe
4928	fa113db48017bf0f7f3d2d34afb8001a1451714986141b003657e799ef9e9324.exe
4928	fa113db48017bf0f7f3d2d34afb8001a1451714986141b003657e799ef9e9324.exe
4928	fa113db48017bf0f7f3d2d34afb8001a1451714986141b003657e799ef9e9324.exe
4928	fa113db48017bf0f7f3d2d34afb8001a1451714986141b003657e799ef9e9324.exe
4928	fa113db48017bf0f7f3d2d34afb8001a1451714986141b003657e799ef9e9324.exe
4928	fa113db48017bf0f7f3d2d34afb8001a1451714986141b003657e799ef9e9324.exe
4928	fa113db48017bf0f7f3d2d34afb8001a1451714986141b003657e799ef9e9324.exe
4928	fa113db48017bf0f7f3d2d34afb8001a1451714986141b003657e799ef9e9324.exe
4928	fa113db48017bf0f7f3d2d34afb8001a1451714986141b003657e799ef9e9324.exe
4928	fa113db48017bf0f7f3d2d34afb8001a1451714986141b003657e799ef9e9324.exe
4928	fa113db48017bf0f7f3d2d34afb8001a1451714986141b003657e799ef9e9324.exe
4928	fa113db48017bf0f7f3d2d34afb8001a1451714986141b003657e799ef9e9324.exe
4928	fa113db48017bf0f7f3d2d34afb8001a1451714986141b003657e799ef9e9324.exe
4928	fa113db48017bf0f7f3d2d34afb8001a1451714986141b003657e799ef9e9324.exe
4928	fa113db48017bf0f7f3d2d34afb8001a1451714986141b003657e799ef9e9324.exe
4928	fa113db48017bf0f7f3d2d34afb8001a1451714986141b003657e799ef9e9324.exe
4928	fa113db48017bf0f7f3d2d34afb8001a1451714986141b003657e799ef9e9324.exe
4928	fa113db48017bf0f7f3d2d34afb8001a1451714986141b003657e799ef9e9324.exe
4928	fa113db48017bf0f7f3d2d34afb8001a1451714986141b003657e799ef9e9324.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4928	fa113db48017bf0f7f3d2d34afb8001a1451714986141b003657e799ef9e9324.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4928 wrote to memory of 2344	4928	fa113db48017bf0f7f3d2d34afb8001a1451714986141b003657e799ef9e9324.exe	83
PID 4928 wrote to memory of 2344	4928	fa113db48017bf0f7f3d2d34afb8001a1451714986141b003657e799ef9e9324.exe	83
PID 2344 wrote to memory of 4648	2344	cmd.exe	85
PID 2344 wrote to memory of 4648	2344	cmd.exe	85

C:\Users\Admin\AppData\Local\Temp\fa113db48017bf0f7f3d2d34afb8001a1451714986141b003657e799ef9e9324.exe
"C:\Users\Admin\AppData\Local\Temp\fa113db48017bf0f7f3d2d34afb8001a1451714986141b003657e799ef9e9324.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4928
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\tmp\svchost.exe"' & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2344
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\tmp\svchost.exe"'
    3⤵
    - Creates scheduled task(s)
    PID:4648

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4928-133-0x0000000000890000-0x00000000008A2000-memory.dmp

Filesize
72KB

Download
memory/4928-134-0x00007FFF4C5B0000-0x00007FFF4D071000-memory.dmp

Filesize
10.8MB

Download
memory/4928-135-0x0000000002A50000-0x0000000002A60000-memory.dmp

Filesize
64KB

Download
memory/4928-136-0x00007FFF4C5B0000-0x00007FFF4D071000-memory.dmp

Filesize
10.8MB

Download
memory/4928-137-0x0000000002A50000-0x0000000002A60000-memory.dmp

Filesize
64KB

Download