asyncrat | b79806822076221e3337325d2822d6e7b87b9a781dd22659f86157d7239a96c6

General

Target

b79806822076221e3337325d2822d6e7b87b9a781dd22659f86157d7239a96c6.exe
Size

1.5MB
MD5

4a0c109685f96e28d58cec6de029c90f
SHA1

d3db248232a07177f445d47a00cc2916ce4ae5e4
SHA256

b79806822076221e3337325d2822d6e7b87b9a781dd22659f86157d7239a96c6
SHA512

7795466bf0f3e2c308eac1debb714d11d8e1e48df36a58d83b88a2b5505ea7e40cbae3426d93e3d8b75fffcbe02d5aba92c3458737f75299734b1612b9be8a5e
SSDEEP

49152:uyWIUOkqL4nXl3eYegYQ7JXbZqg/DpXenFE3350wplxg9R+l3:oIUOkHnV3eYegYQ7JXb88pXenwJdplxX

Score

10^/10

asyncrat default discovery rat

Malware Config

Extracted

Family

asyncrat

Version

Venom RAT + HVNC + Stealer + Grabber v6.0.3

Botnet

Default

C2

113.207.105.229:7302

Mutex

muwxyalvhydrtjh

Attributes

delay
1
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/2864-19-0x00000000023B0000-0x00000000023C8000-memory.dmp	asyncrat
behavioral1/memory/2864-82-0x00000000049F0000-0x0000000004A30000-memory.dmp	asyncrat

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious behavior: EnumeratesProcesses 25 IoCs

Processes:

b79806822076221e3337325d2822d6e7b87b9a781dd22659f86157d7239a96c6.exe

pid	process
2864	b79806822076221e3337325d2822d6e7b87b9a781dd22659f86157d7239a96c6.exe
2864	b79806822076221e3337325d2822d6e7b87b9a781dd22659f86157d7239a96c6.exe
2864	b79806822076221e3337325d2822d6e7b87b9a781dd22659f86157d7239a96c6.exe
2864	b79806822076221e3337325d2822d6e7b87b9a781dd22659f86157d7239a96c6.exe
2864	b79806822076221e3337325d2822d6e7b87b9a781dd22659f86157d7239a96c6.exe
2864	b79806822076221e3337325d2822d6e7b87b9a781dd22659f86157d7239a96c6.exe
2864	b79806822076221e3337325d2822d6e7b87b9a781dd22659f86157d7239a96c6.exe
2864	b79806822076221e3337325d2822d6e7b87b9a781dd22659f86157d7239a96c6.exe
2864	b79806822076221e3337325d2822d6e7b87b9a781dd22659f86157d7239a96c6.exe
2864	b79806822076221e3337325d2822d6e7b87b9a781dd22659f86157d7239a96c6.exe
2864	b79806822076221e3337325d2822d6e7b87b9a781dd22659f86157d7239a96c6.exe
2864	b79806822076221e3337325d2822d6e7b87b9a781dd22659f86157d7239a96c6.exe
2864	b79806822076221e3337325d2822d6e7b87b9a781dd22659f86157d7239a96c6.exe
2864	b79806822076221e3337325d2822d6e7b87b9a781dd22659f86157d7239a96c6.exe
2864	b79806822076221e3337325d2822d6e7b87b9a781dd22659f86157d7239a96c6.exe
2864	b79806822076221e3337325d2822d6e7b87b9a781dd22659f86157d7239a96c6.exe
2864	b79806822076221e3337325d2822d6e7b87b9a781dd22659f86157d7239a96c6.exe
2864	b79806822076221e3337325d2822d6e7b87b9a781dd22659f86157d7239a96c6.exe
2864	b79806822076221e3337325d2822d6e7b87b9a781dd22659f86157d7239a96c6.exe
2864	b79806822076221e3337325d2822d6e7b87b9a781dd22659f86157d7239a96c6.exe
2864	b79806822076221e3337325d2822d6e7b87b9a781dd22659f86157d7239a96c6.exe
2864	b79806822076221e3337325d2822d6e7b87b9a781dd22659f86157d7239a96c6.exe
2864	b79806822076221e3337325d2822d6e7b87b9a781dd22659f86157d7239a96c6.exe
2864	b79806822076221e3337325d2822d6e7b87b9a781dd22659f86157d7239a96c6.exe
2864	b79806822076221e3337325d2822d6e7b87b9a781dd22659f86157d7239a96c6.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

b79806822076221e3337325d2822d6e7b87b9a781dd22659f86157d7239a96c6.exe

description pid process

Token: SeDebugPrivilege 2864 b79806822076221e3337325d2822d6e7b87b9a781dd22659f86157d7239a96c6.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

b79806822076221e3337325d2822d6e7b87b9a781dd22659f86157d7239a96c6.exe

pid process

2864 b79806822076221e3337325d2822d6e7b87b9a781dd22659f86157d7239a96c6.exe

description	pid	process
Token: SeDebugPrivilege	2864	b79806822076221e3337325d2822d6e7b87b9a781dd22659f86157d7239a96c6.exe

C:\Users\Admin\AppData\Local\Temp\b79806822076221e3337325d2822d6e7b87b9a781dd22659f86157d7239a96c6.exe
"C:\Users\Admin\AppData\Local\Temp\b79806822076221e3337325d2822d6e7b87b9a781dd22659f86157d7239a96c6.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2864

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize
242B

MD5
0fa7c50d76daa379523170797943b730

SHA1
ef89893a468154a41c904044865b39c55c271976

SHA256
32912c510dffe8f034c6b6e0a6bb817f8f618cff5de8fe9a69c07d7ea477ee26

SHA512
ca30cfde5b128f13df8ba7f2ebf86c4f15ac626b3127227dfb5c59e97817ccca443d806c366514a1b660081d74f9ac791d4f819185d7ac7f1698f7c4812f6de2

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabECC1.tmp
Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar586.tmp
Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
memory/2864-16-0x0000000000590000-0x00000000005AC000-memory.dmp

Filesize
112KB

Download
memory/2864-17-0x0000000072E90000-0x000000007357E000-memory.dmp

Filesize
6.9MB

Download
memory/2864-18-0x00000000049F0000-0x0000000004A30000-memory.dmp

Filesize
256KB

Download
memory/2864-19-0x00000000023B0000-0x00000000023C8000-memory.dmp

Filesize
96KB

Download
memory/2864-21-0x0000000077120000-0x0000000077121000-memory.dmp

Filesize
4KB

Download
memory/2864-81-0x0000000072E90000-0x000000007357E000-memory.dmp

Filesize
6.9MB

Download
memory/2864-82-0x00000000049F0000-0x0000000004A30000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing