asyncrat | 1a9ad5f2a8a4cc93a5244200d46288948daec3ae9387d5fc66799d52d77a587c

General

Target

1a9ad5f2a8a4cc93a5244200d46288948daec3ae9387d5fc66799d52d77a587c.exe
Size

68KB
MD5

f9391638fc3c6dec9b7319d1c8adeebb
SHA1

84e442eee76140490409219f0419dd58d2ea4820
SHA256

1a9ad5f2a8a4cc93a5244200d46288948daec3ae9387d5fc66799d52d77a587c
SHA512

38419ba8ce831a63a831a6ca1c27028a5a1b432be61fae885e684d5affa436413145dd1c5f07eb2e66ee3d26d8228878ed8608551f1a05de3ccd89e97e0e4a4e
SSDEEP

1536:fJWnX1QHsrLhSBjCeeiIVrGbbXw+39wG5/FpqKmY7:fJWnX1QHsrLqjbeXGbbX739J/+z

Score

10^/10

asyncrat venom clients rat

Malware Config

Extracted

Family

asyncrat

Version

5.0.5

Botnet

Venom Clients

C2

138.197.66.62:22256

Mutex

Venom_RAT_HVNC_Mutex_Venom RAT_HVNC

Attributes

delay
1
install
true
install_file
Match-Ventures.exe
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 3 IoCs

rat

resource	yara_rule
behavioral1/memory/4256-0-0x00000000005B0000-0x00000000005C8000-memory.dmp	asyncrat
behavioral1/files/0x000800000001af33-12.dat	asyncrat
behavioral1/files/0x000800000001af33-13.dat	asyncrat

Executes dropped EXE 1 IoCs

pid	Process
3392	Match-Ventures.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
5052	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
4704	timeout.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4256	1a9ad5f2a8a4cc93a5244200d46288948daec3ae9387d5fc66799d52d77a587c.exe
4256	1a9ad5f2a8a4cc93a5244200d46288948daec3ae9387d5fc66799d52d77a587c.exe
4256	1a9ad5f2a8a4cc93a5244200d46288948daec3ae9387d5fc66799d52d77a587c.exe
4256	1a9ad5f2a8a4cc93a5244200d46288948daec3ae9387d5fc66799d52d77a587c.exe
4256	1a9ad5f2a8a4cc93a5244200d46288948daec3ae9387d5fc66799d52d77a587c.exe
4256	1a9ad5f2a8a4cc93a5244200d46288948daec3ae9387d5fc66799d52d77a587c.exe
4256	1a9ad5f2a8a4cc93a5244200d46288948daec3ae9387d5fc66799d52d77a587c.exe
4256	1a9ad5f2a8a4cc93a5244200d46288948daec3ae9387d5fc66799d52d77a587c.exe
4256	1a9ad5f2a8a4cc93a5244200d46288948daec3ae9387d5fc66799d52d77a587c.exe
4256	1a9ad5f2a8a4cc93a5244200d46288948daec3ae9387d5fc66799d52d77a587c.exe
4256	1a9ad5f2a8a4cc93a5244200d46288948daec3ae9387d5fc66799d52d77a587c.exe
4256	1a9ad5f2a8a4cc93a5244200d46288948daec3ae9387d5fc66799d52d77a587c.exe
4256	1a9ad5f2a8a4cc93a5244200d46288948daec3ae9387d5fc66799d52d77a587c.exe
4256	1a9ad5f2a8a4cc93a5244200d46288948daec3ae9387d5fc66799d52d77a587c.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4256	1a9ad5f2a8a4cc93a5244200d46288948daec3ae9387d5fc66799d52d77a587c.exe
Token: SeDebugPrivilege	3392	Match-Ventures.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4256 wrote to memory of 792	4256	1a9ad5f2a8a4cc93a5244200d46288948daec3ae9387d5fc66799d52d77a587c.exe	69
PID 4256 wrote to memory of 792	4256	1a9ad5f2a8a4cc93a5244200d46288948daec3ae9387d5fc66799d52d77a587c.exe	69
PID 4256 wrote to memory of 4812	4256	1a9ad5f2a8a4cc93a5244200d46288948daec3ae9387d5fc66799d52d77a587c.exe	71
PID 4256 wrote to memory of 4812	4256	1a9ad5f2a8a4cc93a5244200d46288948daec3ae9387d5fc66799d52d77a587c.exe	71
PID 792 wrote to memory of 5052	792	cmd.exe	73
PID 792 wrote to memory of 5052	792	cmd.exe	73
PID 4812 wrote to memory of 4704	4812	cmd.exe	74
PID 4812 wrote to memory of 4704	4812	cmd.exe	74
PID 4812 wrote to memory of 3392	4812	cmd.exe	75
PID 4812 wrote to memory of 3392	4812	cmd.exe	75

C:\Users\Admin\AppData\Local\Temp\1a9ad5f2a8a4cc93a5244200d46288948daec3ae9387d5fc66799d52d77a587c.exe
"C:\Users\Admin\AppData\Local\Temp\1a9ad5f2a8a4cc93a5244200d46288948daec3ae9387d5fc66799d52d77a587c.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4256
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Match-Ventures" /tr '"C:\Users\Admin\AppData\Roaming\Match-Ventures.exe"' & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:792
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc onlogon /rl highest /tn "Match-Ventures" /tr '"C:\Users\Admin\AppData\Roaming\Match-Ventures.exe"'
    3⤵
    - Creates scheduled task(s)
    PID:5052
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpA4EB.tmp.bat""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4812
- - C:\Windows\system32\timeout.exe
    timeout 3
    3⤵
    - Delays execution with timeout.exe
    PID:4704
- - C:\Users\Admin\AppData\Roaming\Match-Ventures.exe
    "C:\Users\Admin\AppData\Roaming\Match-Ventures.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:3392

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpA4EB.tmp.bat

Filesize
158B

MD5
94028bad855207466053794f7ce87d83

SHA1
a6b288c3b316ff8cbd45ecdf7f0511aa413a75e6

SHA256
9208eb6a99da9490ec56c1b39128b195e296a7cfb36e271273aba0be51ec7473

SHA512
6958a258d80707879f7bd26dcbb71b5227ced6291e45dff193c04148e9684d6ff355b457c96ed5c8644ec1441aa0115988a8431193b571ec18484b8f06bbf5ed

Download Submit
C:\Users\Admin\AppData\Roaming\Match-Ventures.exe

Filesize
68KB

MD5
f9391638fc3c6dec9b7319d1c8adeebb

SHA1
84e442eee76140490409219f0419dd58d2ea4820

SHA256
1a9ad5f2a8a4cc93a5244200d46288948daec3ae9387d5fc66799d52d77a587c

SHA512
38419ba8ce831a63a831a6ca1c27028a5a1b432be61fae885e684d5affa436413145dd1c5f07eb2e66ee3d26d8228878ed8608551f1a05de3ccd89e97e0e4a4e

Download Submit
C:\Users\Admin\AppData\Roaming\Match-Ventures.exe

Filesize
68KB

MD5
f9391638fc3c6dec9b7319d1c8adeebb

SHA1
84e442eee76140490409219f0419dd58d2ea4820

SHA256
1a9ad5f2a8a4cc93a5244200d46288948daec3ae9387d5fc66799d52d77a587c

SHA512
38419ba8ce831a63a831a6ca1c27028a5a1b432be61fae885e684d5affa436413145dd1c5f07eb2e66ee3d26d8228878ed8608551f1a05de3ccd89e97e0e4a4e

Download Submit
memory/3392-14-0x00007FF8C9930000-0x00007FF8CA31C000-memory.dmp

Filesize
9.9MB

Download
memory/3392-19-0x00007FF8E5180000-0x00007FF8E535B000-memory.dmp

Filesize
1.9MB

Download
memory/3392-18-0x00000000011F0000-0x0000000001200000-memory.dmp

Filesize
64KB

Download
memory/3392-17-0x00007FF8C9930000-0x00007FF8CA31C000-memory.dmp

Filesize
9.9MB

Download
memory/3392-16-0x00007FF8E5180000-0x00007FF8E535B000-memory.dmp

Filesize
1.9MB

Download
memory/3392-15-0x00000000011F0000-0x0000000001200000-memory.dmp

Filesize
64KB

Download
memory/4256-3-0x00007FF8E5180000-0x00007FF8E535B000-memory.dmp

Filesize
1.9MB

Download
memory/4256-10-0x00007FF8E5180000-0x00007FF8E535B000-memory.dmp

Filesize
1.9MB

Download
memory/4256-9-0x00007FF8C9930000-0x00007FF8CA31C000-memory.dmp

Filesize
9.9MB

Download
memory/4256-0-0x00000000005B0000-0x00000000005C8000-memory.dmp

Filesize
96KB

Download
memory/4256-2-0x000000001B220000-0x000000001B230000-memory.dmp

Filesize
64KB

Download
memory/4256-1-0x00007FF8C9930000-0x00007FF8CA31C000-memory.dmp

Filesize
9.9MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads