asyncrat | 1a9ad5f2a8a4cc93a5244200d46288948daec3ae9387d5fc66799d52d77a587c

General

Target

f9391638fc3c6dec9b7319d1c8adeebb.exe
Size

68KB
MD5

f9391638fc3c6dec9b7319d1c8adeebb
SHA1

84e442eee76140490409219f0419dd58d2ea4820
SHA256

1a9ad5f2a8a4cc93a5244200d46288948daec3ae9387d5fc66799d52d77a587c
SHA512

38419ba8ce831a63a831a6ca1c27028a5a1b432be61fae885e684d5affa436413145dd1c5f07eb2e66ee3d26d8228878ed8608551f1a05de3ccd89e97e0e4a4e
SSDEEP

1536:fJWnX1QHsrLhSBjCeeiIVrGbbXw+39wG5/FpqKmY7:fJWnX1QHsrLqjbeXGbbX739J/+z

Score

10^/10

asyncrat venom clients rat

Malware Config

Extracted

Family

asyncrat

Version

5.0.5

Botnet

Venom Clients

C2

138.197.66.62:22256

Mutex

Venom_RAT_HVNC_Mutex_Venom RAT_HVNC

Attributes

delay
1
install
true
install_file
Match-Ventures.exe
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 5 IoCs

rat

resource	yara_rule
behavioral1/memory/2000-0-0x0000000001360000-0x0000000001378000-memory.dmp	asyncrat
behavioral1/files/0x00070000000120ed-17.dat	asyncrat
behavioral1/memory/2116-18-0x0000000000190000-0x00000000001A8000-memory.dmp	asyncrat
behavioral1/files/0x00070000000120ed-16.dat	asyncrat
behavioral1/memory/2116-20-0x00000000001E0000-0x0000000000260000-memory.dmp	asyncrat

Executes dropped EXE 1 IoCs

pid	Process
2116	Match-Ventures.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2352	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
2420	timeout.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2000	f9391638fc3c6dec9b7319d1c8adeebb.exe
2000	f9391638fc3c6dec9b7319d1c8adeebb.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2000	f9391638fc3c6dec9b7319d1c8adeebb.exe
Token: SeDebugPrivilege	2116	Match-Ventures.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 2000 wrote to memory of 1876	2000	f9391638fc3c6dec9b7319d1c8adeebb.exe	28
PID 2000 wrote to memory of 1876	2000	f9391638fc3c6dec9b7319d1c8adeebb.exe	28
PID 2000 wrote to memory of 1876	2000	f9391638fc3c6dec9b7319d1c8adeebb.exe	28
PID 2000 wrote to memory of 1672	2000	f9391638fc3c6dec9b7319d1c8adeebb.exe	30
PID 2000 wrote to memory of 1672	2000	f9391638fc3c6dec9b7319d1c8adeebb.exe	30
PID 2000 wrote to memory of 1672	2000	f9391638fc3c6dec9b7319d1c8adeebb.exe	30
PID 1672 wrote to memory of 2420	1672	cmd.exe	32
PID 1672 wrote to memory of 2420	1672	cmd.exe	32
PID 1672 wrote to memory of 2420	1672	cmd.exe	32
PID 1876 wrote to memory of 2352	1876	cmd.exe	33
PID 1876 wrote to memory of 2352	1876	cmd.exe	33
PID 1876 wrote to memory of 2352	1876	cmd.exe	33
PID 1672 wrote to memory of 2116	1672	cmd.exe	34
PID 1672 wrote to memory of 2116	1672	cmd.exe	34
PID 1672 wrote to memory of 2116	1672	cmd.exe	34

C:\Users\Admin\AppData\Local\Temp\f9391638fc3c6dec9b7319d1c8adeebb.exe
"C:\Users\Admin\AppData\Local\Temp\f9391638fc3c6dec9b7319d1c8adeebb.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2000
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Match-Ventures" /tr '"C:\Users\Admin\AppData\Roaming\Match-Ventures.exe"' & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1876
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc onlogon /rl highest /tn "Match-Ventures" /tr '"C:\Users\Admin\AppData\Roaming\Match-Ventures.exe"'
    3⤵
    - Creates scheduled task(s)
    PID:2352
- C:\Windows\system32\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpB145.tmp.bat""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1672
- - C:\Windows\system32\timeout.exe
    timeout 3
    3⤵
    - Delays execution with timeout.exe
    PID:2420
- - C:\Users\Admin\AppData\Roaming\Match-Ventures.exe
    "C:\Users\Admin\AppData\Roaming\Match-Ventures.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:2116

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpB145.tmp.bat

Filesize
158B

MD5
b539a4d72d54054c4406d48e212e6b62

SHA1
68f6a73369962fa622ea26170d0f67f0294225bf

SHA256
96fefda830a5f94173211bca9b5b1fc63918794db0dbcc4680f6e376553dd15e

SHA512
6a3a362c117f72b4745d62379767069f0290365ea4240827ed352628e8e758032b7d316a48d784b2620142d1129708b2f7a8fa754a4f7d60855898cc99ab9624

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpB145.tmp.bat

Filesize
158B

MD5
b539a4d72d54054c4406d48e212e6b62

SHA1
68f6a73369962fa622ea26170d0f67f0294225bf

SHA256
96fefda830a5f94173211bca9b5b1fc63918794db0dbcc4680f6e376553dd15e

SHA512
6a3a362c117f72b4745d62379767069f0290365ea4240827ed352628e8e758032b7d316a48d784b2620142d1129708b2f7a8fa754a4f7d60855898cc99ab9624

Download Submit
C:\Users\Admin\AppData\Roaming\Match-Ventures.exe

Filesize
68KB

MD5
f9391638fc3c6dec9b7319d1c8adeebb

SHA1
84e442eee76140490409219f0419dd58d2ea4820

SHA256
1a9ad5f2a8a4cc93a5244200d46288948daec3ae9387d5fc66799d52d77a587c

SHA512
38419ba8ce831a63a831a6ca1c27028a5a1b432be61fae885e684d5affa436413145dd1c5f07eb2e66ee3d26d8228878ed8608551f1a05de3ccd89e97e0e4a4e

Download Submit
C:\Users\Admin\AppData\Roaming\Match-Ventures.exe

Filesize
68KB

MD5
f9391638fc3c6dec9b7319d1c8adeebb

SHA1
84e442eee76140490409219f0419dd58d2ea4820

SHA256
1a9ad5f2a8a4cc93a5244200d46288948daec3ae9387d5fc66799d52d77a587c

SHA512
38419ba8ce831a63a831a6ca1c27028a5a1b432be61fae885e684d5affa436413145dd1c5f07eb2e66ee3d26d8228878ed8608551f1a05de3ccd89e97e0e4a4e

Download Submit
memory/2000-1-0x000007FEF5C50000-0x000007FEF663C000-memory.dmp

Filesize
9.9MB

Download
memory/2000-2-0x000000001B190000-0x000000001B210000-memory.dmp

Filesize
512KB

Download
memory/2000-13-0x000007FEF5C50000-0x000007FEF663C000-memory.dmp

Filesize
9.9MB

Download
memory/2000-14-0x00000000775F0000-0x0000000077799000-memory.dmp

Filesize
1.7MB

Download
memory/2000-0-0x0000000001360000-0x0000000001378000-memory.dmp

Filesize
96KB

Download
memory/2000-3-0x00000000775F0000-0x0000000077799000-memory.dmp

Filesize
1.7MB

Download
memory/2116-18-0x0000000000190000-0x00000000001A8000-memory.dmp

Filesize
96KB

Download
memory/2116-19-0x000007FEF5260000-0x000007FEF5C4C000-memory.dmp

Filesize
9.9MB

Download
memory/2116-20-0x00000000001E0000-0x0000000000260000-memory.dmp

Filesize
512KB

Download
memory/2116-21-0x00000000775F0000-0x0000000077799000-memory.dmp

Filesize
1.7MB

Download
memory/2116-22-0x000007FEF5260000-0x000007FEF5C4C000-memory.dmp

Filesize
9.9MB

Download
memory/2116-23-0x00000000001E0000-0x0000000000260000-memory.dmp

Filesize
512KB

Download
memory/2116-24-0x00000000775F0000-0x0000000077799000-memory.dmp

Filesize
1.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads