asyncrat | 86554e71ff91b337355f749b101dccf1d3d0bd06967425e702cadc69ba6148e1

General

Target

ed1516e205dd17247784774d2743ea36da0a590f9fb811b1e347bce7adc86836.exe
Size

490KB
MD5

98b95177a6e3021b8c4e705dae0325b3
SHA1

365621df45abcf55323e5070beed5355cbea76fa
SHA256

ed1516e205dd17247784774d2743ea36da0a590f9fb811b1e347bce7adc86836
SHA512

a0efe7474236aff935267724e7f70677c0acb592c44240d1ea41c4b64a0e7ac0b75f17b77f35f3dd2fce1f43baca5628206f5935ee493c71b6f0d7b0f5dedf93
SSDEEP

6144:3Vv7ycSFCbmEfGWY+mHk8c7fsv/WmqxHcf27TGGoodt+J5K7Qzpfimlfrp:BhSFCbmY7Y+r9sv/WjW2BxYK7QzpKmX

Score

10^/10

asyncrat fud rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

FUD

C2

127.0.0.1:6606

127.0.0.1:7707

127.0.0.1:8808

127.0.0.1:3173

Mutex

AsyncMutex_6SI8OkPnk

Attributes

delay
3
install
true
install_file
WindowsSt.exe
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/3540-5-0x0000000002A10000-0x0000000002A3A000-memory.dmp	asyncrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

ed1516e205dd17247784774d2743ea36da0a590f9fb811b1e347bce7adc86836.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation	ed1516e205dd17247784774d2743ea36da0a590f9fb811b1e347bce7adc86836.exe

Executes dropped EXE 1 IoCs

Processes:

WindowsSt.exe

pid process

4100 WindowsSt.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

4776 schtasks.exe
Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

4404 timeout.exe

pid	process
4100	WindowsSt.exe

pid	process
4776	schtasks.exe

pid	process
4404	timeout.exe

Suspicious behavior: EnumeratesProcesses 21 IoCs

Processes:

ed1516e205dd17247784774d2743ea36da0a590f9fb811b1e347bce7adc86836.exe

pid	process
3540	ed1516e205dd17247784774d2743ea36da0a590f9fb811b1e347bce7adc86836.exe
3540	ed1516e205dd17247784774d2743ea36da0a590f9fb811b1e347bce7adc86836.exe
3540	ed1516e205dd17247784774d2743ea36da0a590f9fb811b1e347bce7adc86836.exe
3540	ed1516e205dd17247784774d2743ea36da0a590f9fb811b1e347bce7adc86836.exe
3540	ed1516e205dd17247784774d2743ea36da0a590f9fb811b1e347bce7adc86836.exe
3540	ed1516e205dd17247784774d2743ea36da0a590f9fb811b1e347bce7adc86836.exe
3540	ed1516e205dd17247784774d2743ea36da0a590f9fb811b1e347bce7adc86836.exe
3540	ed1516e205dd17247784774d2743ea36da0a590f9fb811b1e347bce7adc86836.exe
3540	ed1516e205dd17247784774d2743ea36da0a590f9fb811b1e347bce7adc86836.exe
3540	ed1516e205dd17247784774d2743ea36da0a590f9fb811b1e347bce7adc86836.exe
3540	ed1516e205dd17247784774d2743ea36da0a590f9fb811b1e347bce7adc86836.exe
3540	ed1516e205dd17247784774d2743ea36da0a590f9fb811b1e347bce7adc86836.exe
3540	ed1516e205dd17247784774d2743ea36da0a590f9fb811b1e347bce7adc86836.exe
3540	ed1516e205dd17247784774d2743ea36da0a590f9fb811b1e347bce7adc86836.exe
3540	ed1516e205dd17247784774d2743ea36da0a590f9fb811b1e347bce7adc86836.exe
3540	ed1516e205dd17247784774d2743ea36da0a590f9fb811b1e347bce7adc86836.exe
3540	ed1516e205dd17247784774d2743ea36da0a590f9fb811b1e347bce7adc86836.exe
3540	ed1516e205dd17247784774d2743ea36da0a590f9fb811b1e347bce7adc86836.exe
3540	ed1516e205dd17247784774d2743ea36da0a590f9fb811b1e347bce7adc86836.exe
3540	ed1516e205dd17247784774d2743ea36da0a590f9fb811b1e347bce7adc86836.exe
3540	ed1516e205dd17247784774d2743ea36da0a590f9fb811b1e347bce7adc86836.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

ed1516e205dd17247784774d2743ea36da0a590f9fb811b1e347bce7adc86836.exeWindowsSt.exe

description	pid	process
Token: SeDebugPrivilege	3540	ed1516e205dd17247784774d2743ea36da0a590f9fb811b1e347bce7adc86836.exe
Token: SeDebugPrivilege	4100	WindowsSt.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

ed1516e205dd17247784774d2743ea36da0a590f9fb811b1e347bce7adc86836.execmd.execmd.exe

description	pid	process	target process
PID 3540 wrote to memory of 2540	3540	ed1516e205dd17247784774d2743ea36da0a590f9fb811b1e347bce7adc86836.exe	cmd.exe
PID 3540 wrote to memory of 2540	3540	ed1516e205dd17247784774d2743ea36da0a590f9fb811b1e347bce7adc86836.exe	cmd.exe
PID 3540 wrote to memory of 2696	3540	ed1516e205dd17247784774d2743ea36da0a590f9fb811b1e347bce7adc86836.exe	cmd.exe
PID 3540 wrote to memory of 2696	3540	ed1516e205dd17247784774d2743ea36da0a590f9fb811b1e347bce7adc86836.exe	cmd.exe
PID 2696 wrote to memory of 4404	2696	cmd.exe	timeout.exe
PID 2696 wrote to memory of 4404	2696	cmd.exe	timeout.exe
PID 2540 wrote to memory of 4776	2540	cmd.exe	schtasks.exe
PID 2540 wrote to memory of 4776	2540	cmd.exe	schtasks.exe
PID 2696 wrote to memory of 4100	2696	cmd.exe	WindowsSt.exe
PID 2696 wrote to memory of 4100	2696	cmd.exe	WindowsSt.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\ed1516e205dd17247784774d2743ea36da0a590f9fb811b1e347bce7adc86836.exe
"C:\Users\Admin\AppData\Local\Temp\ed1516e205dd17247784774d2743ea36da0a590f9fb811b1e347bce7adc86836.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3540

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "WindowsSt" /tr '"C:\Users\Admin\AppData\Roaming\WindowsSt.exe"' & exit
2⤵
- Suspicious use of WriteProcessMemory
PID:2540

C:\Windows\system32\schtasks.exe
schtasks /create /f /sc onlogon /rl highest /tn "WindowsSt" /tr '"C:\Users\Admin\AppData\Roaming\WindowsSt.exe"'
3⤵
- Creates scheduled task(s)
PID:4776

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpA5FF.tmp.bat""
2⤵
- Suspicious use of WriteProcessMemory
PID:2696

C:\Windows\system32\timeout.exe
timeout 3
3⤵
- Delays execution with timeout.exe
PID:4404

C:\Users\Admin\AppData\Roaming\WindowsSt.exe
"C:\Users\Admin\AppData\Roaming\WindowsSt.exe"
3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4100

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpA5FF.tmp.bat
Filesize
153B

MD5
9060b87de92cbac29c0004950b706ec7

SHA1
726572ee368a1e29704141ba533c2ef420abb18c

SHA256
833a9cbda2f41b711ef52e567b94ef268206c326401dd8b0beb5047a9500cdab

SHA512
691b58c01d1761bd851e2e954f4c82db1dbc698f91866a47deaa6b37e418b94f3bcfbd8cc783832f0fbdf4dbc1a67514a0947b8555d992ea3d5d715b8bc3008b

Download Submit
C:\Users\Admin\AppData\Roaming\WindowsSt.exe
Filesize
490KB

MD5
98b95177a6e3021b8c4e705dae0325b3

SHA1
365621df45abcf55323e5070beed5355cbea76fa

SHA256
ed1516e205dd17247784774d2743ea36da0a590f9fb811b1e347bce7adc86836

SHA512
a0efe7474236aff935267724e7f70677c0acb592c44240d1ea41c4b64a0e7ac0b75f17b77f35f3dd2fce1f43baca5628206f5935ee493c71b6f0d7b0f5dedf93

Download Submit
memory/3540-3-0x0000000000F30000-0x0000000000F36000-memory.dmp

Filesize
24KB

Download
memory/3540-0-0x0000000000810000-0x0000000000888000-memory.dmp

Filesize
480KB

Download
memory/3540-4-0x000000001B550000-0x000000001B560000-memory.dmp

Filesize
64KB

Download
memory/3540-5-0x0000000002A10000-0x0000000002A3A000-memory.dmp

Filesize
168KB

Download
memory/3540-6-0x00007FFB68410000-0x00007FFB68ED1000-memory.dmp

Filesize
10.8MB

Download
memory/3540-11-0x00007FFB68410000-0x00007FFB68ED1000-memory.dmp

Filesize
10.8MB

Download
memory/3540-2-0x00007FFB68410000-0x00007FFB68ED1000-memory.dmp

Filesize
10.8MB

Download
memory/3540-1-0x0000000002BA0000-0x0000000002C2E000-memory.dmp

Filesize
568KB

Download
memory/4100-16-0x00007FFB684C0000-0x00007FFB68F81000-memory.dmp

Filesize
10.8MB

Download
memory/4100-17-0x000000001B720000-0x000000001B730000-memory.dmp

Filesize
64KB

Download
memory/4100-18-0x00007FFB684C0000-0x00007FFB68F81000-memory.dmp

Filesize
10.8MB

Download
memory/4100-19-0x000000001B720000-0x000000001B730000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads