asyncrat | 0e4914efb724d77aef2ea3af050b77c069fc248803274e4604df68263994cf9d

General

Target

0e4914efb724d77aef2ea3af050b77c069fc248803274e4604df68263994cf9d.exe
Size

1.4MB
MD5

0af5640c10a01123e3045cf90427cbf9
SHA1

0085341bf889e67d391cfb60e14bf90d4e34deb0
SHA256

0e4914efb724d77aef2ea3af050b77c069fc248803274e4604df68263994cf9d
SHA512

f0ad3bad2cf8ad633c9f88af1467b1de42a0b6f4f536a9c6499d0ca1625197a2e6c944c6ca25b7c70f5c000a319bab4bacf62f0625008ba9f643e622146d1921
SSDEEP

24576:mlVP4iQzePuruuXj/co135PXs0YVfX6zWEGFEzPQ+fmU2ZOScgCe:UWBj/caVXCVvJQnSPCe

Score

10^/10

asyncrat default persistence rat upx

Malware Config

Extracted

Family

asyncrat

Botnet

Default

C2

1.err.line.pm:4449

Mutex

glzznzesxsoyn

Attributes

delay
1
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/3364-20-0x00000000059E0000-0x00000000059F8000-memory.dmp	asyncrat

Executes dropped EXE 2 IoCs

Processes:

sg.tmpsvchost.exe

pid process

4004 sg.tmp
3364 svchost.exe
Loads dropped DLL 1 IoCs

Processes:

svchost.exe

pid process

3364 svchost.exe

pid	process
4004	sg.tmp
3364	svchost.exe

pid	process
3364	svchost.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/2536-0-0x0000000000400000-0x0000000000583000-memory.dmp	upx
behavioral2/memory/2536-24-0x0000000000400000-0x0000000000583000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

svchost.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-423100829-2271632622-1028104103-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MyDLLStartup = "C:\\Program Files (x86)\\demo\\svchost.exe"	svchost.exe

Drops file in Program Files directory 6 IoCs

Processes:

sg.tmp

description	ioc	process
File opened for modification	C:\Program Files (x86)\demo\svchost.exe	sg.tmp
File created	C:\Program Files (x86)\demo\Office.txt	sg.tmp
File opened for modification	C:\Program Files (x86)\demo\Office.txt	sg.tmp
File created	C:\Program Files (x86)\demo\msedge_elf.dll	sg.tmp
File opened for modification	C:\Program Files (x86)\demo\msedge_elf.dll	sg.tmp
File created	C:\Program Files (x86)\demo\svchost.exe	sg.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

svchost.exe

pid process

3364 svchost.exe
3364 svchost.exe
3364 svchost.exe
3364 svchost.exe
3364 svchost.exe
3364 svchost.exe
3364 svchost.exe
3364 svchost.exe

pid	process
3364	svchost.exe
3364	svchost.exe
3364	svchost.exe
3364	svchost.exe
3364	svchost.exe
3364	svchost.exe
3364	svchost.exe
3364	svchost.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

Processes:

0e4914efb724d77aef2ea3af050b77c069fc248803274e4604df68263994cf9d.exesg.tmpsvchost.exe

description	pid	process
Token: SeBackupPrivilege	2536	0e4914efb724d77aef2ea3af050b77c069fc248803274e4604df68263994cf9d.exe
Token: SeRestorePrivilege	2536	0e4914efb724d77aef2ea3af050b77c069fc248803274e4604df68263994cf9d.exe
Token: 33	2536	0e4914efb724d77aef2ea3af050b77c069fc248803274e4604df68263994cf9d.exe
Token: SeIncBasePriorityPrivilege	2536	0e4914efb724d77aef2ea3af050b77c069fc248803274e4604df68263994cf9d.exe
Token: SeCreateGlobalPrivilege	2536	0e4914efb724d77aef2ea3af050b77c069fc248803274e4604df68263994cf9d.exe
Token: 33	2536	0e4914efb724d77aef2ea3af050b77c069fc248803274e4604df68263994cf9d.exe
Token: SeIncBasePriorityPrivilege	2536	0e4914efb724d77aef2ea3af050b77c069fc248803274e4604df68263994cf9d.exe
Token: 33	2536	0e4914efb724d77aef2ea3af050b77c069fc248803274e4604df68263994cf9d.exe
Token: SeIncBasePriorityPrivilege	2536	0e4914efb724d77aef2ea3af050b77c069fc248803274e4604df68263994cf9d.exe
Token: SeRestorePrivilege	4004	sg.tmp
Token: 35	4004	sg.tmp
Token: SeSecurityPrivilege	4004	sg.tmp
Token: SeSecurityPrivilege	4004	sg.tmp
Token: SeDebugPrivilege	3364	svchost.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

svchost.exe

pid process

3364 svchost.exe

pid	process
3364	svchost.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

0e4914efb724d77aef2ea3af050b77c069fc248803274e4604df68263994cf9d.exe

description	pid	process	target process
PID 2536 wrote to memory of 4840	2536	0e4914efb724d77aef2ea3af050b77c069fc248803274e4604df68263994cf9d.exe	cmd.exe
PID 2536 wrote to memory of 4840	2536	0e4914efb724d77aef2ea3af050b77c069fc248803274e4604df68263994cf9d.exe	cmd.exe
PID 2536 wrote to memory of 4004	2536	0e4914efb724d77aef2ea3af050b77c069fc248803274e4604df68263994cf9d.exe	sg.tmp
PID 2536 wrote to memory of 4004	2536	0e4914efb724d77aef2ea3af050b77c069fc248803274e4604df68263994cf9d.exe	sg.tmp
PID 2536 wrote to memory of 4004	2536	0e4914efb724d77aef2ea3af050b77c069fc248803274e4604df68263994cf9d.exe	sg.tmp
PID 2536 wrote to memory of 3364	2536	0e4914efb724d77aef2ea3af050b77c069fc248803274e4604df68263994cf9d.exe	svchost.exe
PID 2536 wrote to memory of 3364	2536	0e4914efb724d77aef2ea3af050b77c069fc248803274e4604df68263994cf9d.exe	svchost.exe
PID 2536 wrote to memory of 3364	2536	0e4914efb724d77aef2ea3af050b77c069fc248803274e4604df68263994cf9d.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\0e4914efb724d77aef2ea3af050b77c069fc248803274e4604df68263994cf9d.exe
"C:\Users\Admin\AppData\Local\Temp\0e4914efb724d77aef2ea3af050b77c069fc248803274e4604df68263994cf9d.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2536

C:\Windows\SYSTEM32\cmd.exe
cmd.exe /c set
2⤵
PID:4840

C:\Users\Admin\AppData\Local\Temp\~2774414141855635660~\sg.tmp
7zG_exe x "C:\Users\Admin\AppData\Local\Temp\0e4914efb724d77aef2ea3af050b77c069fc248803274e4604df68263994cf9d.exe" -y -aos -o"C:\Program Files (x86)\demo" -p5dgdfg345
2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:4004

C:\Program Files (x86)\demo\svchost.exe
"C:\Program Files (x86)\demo\svchost.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3364

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\demo\Office.txt

Filesize
111KB

MD5
52a1fc2e368b7367f762959a594fd94e

SHA1
3718fcd1679443258d472b0ef8b18b2ac00ff916

SHA256
52bea881a027370e60282ec9af9e4dde33ba723ca1b6236019e32c87deeb438e

SHA512
50944c91beeedecbd48ddab847332cd20a804197cd3afdeab1b9f340224be11df770d7a82b5ded1790d945f23c24c0abc21b74585586af274b73ba4f2dc01378

Download Submit
C:\Program Files (x86)\demo\msedge_elf.dll

Filesize
25KB

MD5
1a3aa41d55722984100122bed0a8696a

SHA1
f241a7c829970aeacf983eef1e1727181b042706

SHA256
4f1070e8e8d9660973a8f8b7f36464574b5f16c3ed58fce046282c31bb6be689

SHA512
8974ebe5834458abc48ab5c31ca4bfb404fc87fefa360728e3306c0fc110aa0d70e5fae6910229b74f715bc8a102f811b0aea8aa97d2529030bfd5db13ed93fc

Download Submit
C:\Program Files (x86)\demo\msedge_elf.dll

Filesize
25KB

MD5
1a3aa41d55722984100122bed0a8696a

SHA1
f241a7c829970aeacf983eef1e1727181b042706

SHA256
4f1070e8e8d9660973a8f8b7f36464574b5f16c3ed58fce046282c31bb6be689

SHA512
8974ebe5834458abc48ab5c31ca4bfb404fc87fefa360728e3306c0fc110aa0d70e5fae6910229b74f715bc8a102f811b0aea8aa97d2529030bfd5db13ed93fc

Download Submit
C:\Program Files (x86)\demo\svchost.exe

Filesize
833KB

MD5
9a25c9f4ae1ae0206d0ac670fc26bfb0

SHA1
ab9e4e3c92a722d0ccec78a5843d99b29d5a65e5

SHA256
7e78f5183d1539b90445356a7069b0f610d9b8c69c2be228e5952fe807d1791b

SHA512
ed7c65b387f8a3aeb06a3e06ed6444a928bdaff816391220a633dbbc18b6d8db65e86889ed1ba9e48d8e88dbb3cae4867a7c3a1ff12f473f36f03639a5b711d1

Download Submit
C:\Program Files (x86)\demo\svchost.exe

Filesize
833KB

MD5
9a25c9f4ae1ae0206d0ac670fc26bfb0

SHA1
ab9e4e3c92a722d0ccec78a5843d99b29d5a65e5

SHA256
7e78f5183d1539b90445356a7069b0f610d9b8c69c2be228e5952fe807d1791b

SHA512
ed7c65b387f8a3aeb06a3e06ed6444a928bdaff816391220a633dbbc18b6d8db65e86889ed1ba9e48d8e88dbb3cae4867a7c3a1ff12f473f36f03639a5b711d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\~2774414141855635660~\sg.tmp

Filesize
715KB

MD5
7c4718943bd3f66ebdb47ccca72c7b1e

SHA1
f9edfaa7adb8fa528b2e61b2b251f18da10a6969

SHA256
4cc32d00338fc7b206a7c052297acf9ac304ae7de9d61a2475a116959c1524fc

SHA512
e18c40d646fa4948f90f7471da55489df431f255041ebb6dcef86346f91078c9b27894e27216a4b2fe2a1c5e501c7953c77893cf696930123d28a322d49e1516

Download Submit
memory/2536-0-0x0000000000400000-0x0000000000583000-memory.dmp

Filesize
1.5MB

Download
memory/2536-24-0x0000000000400000-0x0000000000583000-memory.dmp

Filesize
1.5MB

Download
memory/3364-21-0x00000000730C0000-0x0000000073870000-memory.dmp

Filesize
7.7MB

Download
memory/3364-20-0x00000000059E0000-0x00000000059F8000-memory.dmp

Filesize
96KB

Download
memory/3364-22-0x00000000061E0000-0x0000000006784000-memory.dmp

Filesize
5.6MB

Download
memory/3364-19-0x0000000002EA0000-0x0000000002EBC000-memory.dmp

Filesize
112KB

Download
memory/3364-26-0x0000000076F01000-0x0000000076F02000-memory.dmp

Filesize
4KB

Download
memory/3364-25-0x0000000006000000-0x0000000006092000-memory.dmp

Filesize
584KB

Download
memory/3364-27-0x0000000005FD0000-0x0000000005FDA000-memory.dmp

Filesize
40KB

Download
memory/3364-28-0x00000000730C0000-0x0000000073870000-memory.dmp

Filesize
7.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads