asyncrat | e91997ede0af6498cdec211340fc59fcb814a9bbaf47115149d1e17126b8088a

General

Target

25a499f71d8652bf3f9800057412e31e.exe
Size

2.7MB
MD5

25a499f71d8652bf3f9800057412e31e
SHA1

b74b638471e2dafec4d98d3e790920be500b3318
SHA256

e91997ede0af6498cdec211340fc59fcb814a9bbaf47115149d1e17126b8088a
SHA512

4911f395a3d2f296344dcd5869c65b3ad9e10bb749a9e0cb6cd4ff96ee643555a8c0a99258cc4123ba81dc1ec969d2caf3b2152eb123a34bbc8bfbeaa5ee0b0a
SSDEEP

24576:c4abEjzQIEjzQIEjzQIEjzQIEjzQIEjzQIEjzQIEjzQIEjzQ9EjzQIEjzQ911EjR:YccccccccxcZ/cccc1goPBy

Score

10^/10

asyncrat default rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.6D

Botnet

Default

C2

milla.publicvm.com:6606

milla.publicvm.com:7707

milla.publicvm.com:8808

Mutex

hzizmtfuyizxxugkf

Attributes

delay
8
install
true
install_file
mincrafte.exe
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 2 IoCs

rat

resource	yara_rule
behavioral1/memory/2168-3-0x00000000002E0000-0x00000000002F2000-memory.dmp	asyncrat
behavioral1/memory/2888-20-0x0000000000530000-0x0000000000542000-memory.dmp	asyncrat

Executes dropped EXE 1 IoCs

pid	Process
2888	mincrafte.exe

Loads dropped DLL 1 IoCs

pid	Process
2760	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2836	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
2904	timeout.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2168	25a499f71d8652bf3f9800057412e31e.exe
2168	25a499f71d8652bf3f9800057412e31e.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2168	25a499f71d8652bf3f9800057412e31e.exe
Token: SeDebugPrivilege	2888	mincrafte.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2168 wrote to memory of 2800	2168	25a499f71d8652bf3f9800057412e31e.exe	33
PID 2168 wrote to memory of 2800	2168	25a499f71d8652bf3f9800057412e31e.exe	33
PID 2168 wrote to memory of 2800	2168	25a499f71d8652bf3f9800057412e31e.exe	33
PID 2168 wrote to memory of 2800	2168	25a499f71d8652bf3f9800057412e31e.exe	33
PID 2168 wrote to memory of 2760	2168	25a499f71d8652bf3f9800057412e31e.exe	31
PID 2168 wrote to memory of 2760	2168	25a499f71d8652bf3f9800057412e31e.exe	31
PID 2168 wrote to memory of 2760	2168	25a499f71d8652bf3f9800057412e31e.exe	31
PID 2168 wrote to memory of 2760	2168	25a499f71d8652bf3f9800057412e31e.exe	31
PID 2800 wrote to memory of 2836	2800	cmd.exe	29
PID 2800 wrote to memory of 2836	2800	cmd.exe	29
PID 2800 wrote to memory of 2836	2800	cmd.exe	29
PID 2800 wrote to memory of 2836	2800	cmd.exe	29
PID 2760 wrote to memory of 2904	2760	cmd.exe	28
PID 2760 wrote to memory of 2904	2760	cmd.exe	28
PID 2760 wrote to memory of 2904	2760	cmd.exe	28
PID 2760 wrote to memory of 2904	2760	cmd.exe	28
PID 2760 wrote to memory of 2888	2760	cmd.exe	34
PID 2760 wrote to memory of 2888	2760	cmd.exe	34
PID 2760 wrote to memory of 2888	2760	cmd.exe	34
PID 2760 wrote to memory of 2888	2760	cmd.exe	34

C:\Users\Admin\AppData\Local\Temp\25a499f71d8652bf3f9800057412e31e.exe
"C:\Users\Admin\AppData\Local\Temp\25a499f71d8652bf3f9800057412e31e.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2168
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp337F.tmp.bat""
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2760
- - C:\Users\Admin\AppData\Roaming\mincrafte.exe
    "C:\Users\Admin\AppData\Roaming\mincrafte.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:2888
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /ru system /rl highest /tn 25a499f71d8652bf3f9800057412e31e /tr '"C:\Users\Admin\AppData\Roaming\mincrafte.exe"' & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2800

C:\Windows\SysWOW64\timeout.exe
timeout 3
1⤵
- Delays execution with timeout.exe
PID:2904

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /f /sc onlogon /ru system /rl highest /tn 25a499f71d8652bf3f9800057412e31e /tr '"C:\Users\Admin\AppData\Roaming\mincrafte.exe"'
1⤵
- Creates scheduled task(s)
PID:2836

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp337F.tmp.bat

Filesize
153B

MD5
f92c29f123ec05bc37efffac4327090c

SHA1
d639d32602d075ed0d193e6c386ac0be0ea28189

SHA256
af96081ae14b9b46cb5ece2eff8b9d92460f7c081ceb64844cf12e26fa61696c

SHA512
b13dfef0f38db3ef4ee00dab513055dbcb5f79a178e2bbefec424bca266f21c892430c715ece9a8bb14949c905b8b490909cdd3af33cb2aac8b63ed792fd6210

Download Submit
\Users\Admin\AppData\Roaming\mincrafte.exe

Filesize
92KB

MD5
e18a7435fca373ad4bef3ee4c0a507f4

SHA1
a96ee209a4cb23075e192d8d25d621f974e472db

SHA256
89cba7046af52dccf302675121d78d22d3a3080609289bab582d82966e137534

SHA512
4c0d234146e3b57d55d010c69e1d9f0afdb3c8f616b80a3c4c8e2cda70d73143fcd6c6b74f960833782b2b3e62baa94ed7735a81e837a3b3246ca9fe3685b16a

Download Submit
memory/2168-0-0x00000000002F0000-0x000000000059E000-memory.dmp

Filesize
2.7MB

Download
memory/2168-2-0x0000000005030000-0x0000000005070000-memory.dmp

Filesize
256KB

Download
memory/2168-3-0x00000000002E0000-0x00000000002F2000-memory.dmp

Filesize
72KB

Download
memory/2168-13-0x0000000074D50000-0x000000007543E000-memory.dmp

Filesize
6.9MB

Download
memory/2168-1-0x0000000074D50000-0x000000007543E000-memory.dmp

Filesize
6.9MB

Download
memory/2888-18-0x0000000074D90000-0x000000007547E000-memory.dmp

Filesize
6.9MB

Download
memory/2888-17-0x0000000000270000-0x000000000051E000-memory.dmp

Filesize
2.7MB

Download
memory/2888-19-0x0000000004F50000-0x0000000004F90000-memory.dmp

Filesize
256KB

Download
memory/2888-20-0x0000000000530000-0x0000000000542000-memory.dmp

Filesize
72KB

Download
memory/2888-21-0x0000000074D90000-0x000000007547E000-memory.dmp

Filesize
6.9MB

Download
memory/2888-22-0x0000000004F50000-0x0000000004F90000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads