asyncrat | 58a07549993c34caf8617e6cb341b44ceca162106b501fee09629936bad7bb51

Analysis

max time kernel
150s
max time network
129s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
13/01/2024, 11:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

58d9e7016bb1ceef2c36ede58202d170.exe
Size

491KB
MD5

58d9e7016bb1ceef2c36ede58202d170
SHA1

95c9defb36b6ba08c78ad6068a2766dad1e33512
SHA256

58a07549993c34caf8617e6cb341b44ceca162106b501fee09629936bad7bb51
SHA512

aa688b35cd42d915d4503b1078535dc14bcfcbe7d30b8874dbc173cfc662685cc07a5d256b8452c1d113fdcebe77e074f60fb2d789d664ff401a94444a162e95
SSDEEP

12288:vLDAIDCETPv7rrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrUrrrrrrrrrrrrrrrf:YIDCETPzrrrrrrrrrrrrrrrrrrrrrrrg

Score

10^/10

asyncrat default persistence rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

Default

127.0.0.1:6606

127.0.0.1:7707

127.0.0.1:8808

Mutex

AsyncMutex_6SI8OkPnk

Attributes

delay
3
install
true
install_file
svchost.exe
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 9 IoCs

rat

resource	yara_rule
behavioral1/memory/1688-10-0x0000000000400000-0x0000000000446000-memory.dmp	asyncrat
behavioral1/memory/1688-12-0x0000000000400000-0x0000000000446000-memory.dmp	asyncrat
behavioral1/memory/1688-15-0x0000000000400000-0x0000000000446000-memory.dmp	asyncrat
behavioral1/memory/1688-7-0x0000000000400000-0x0000000000446000-memory.dmp	asyncrat
behavioral1/memory/1688-6-0x0000000000400000-0x0000000000446000-memory.dmp	asyncrat
behavioral1/memory/1556-46-0x0000000000400000-0x0000000000446000-memory.dmp	asyncrat
behavioral1/memory/1556-49-0x0000000000400000-0x0000000000446000-memory.dmp	asyncrat
behavioral1/memory/1556-51-0x0000000004CF0000-0x0000000004D30000-memory.dmp	asyncrat
behavioral1/memory/1556-53-0x0000000004CF0000-0x0000000004D30000-memory.dmp	asyncrat

Executes dropped EXE 2 IoCs

pid	Process
2384	svchost.exe
1556	svchost.exe

Loads dropped DLL 1 IoCs

pid	Process
2700	cmd.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Windows Services = "C:\\Users\\Admin\\AppData\\Roaming\\Windows Update Folder\\Windows Update.exe"	58d9e7016bb1ceef2c36ede58202d170.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1236 set thread context of 1688	1236	58d9e7016bb1ceef2c36ede58202d170.exe	28
PID 2384 set thread context of 1556	2384	svchost.exe	36

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2556	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
2560	timeout.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1688	58d9e7016bb1ceef2c36ede58202d170.exe
1688	58d9e7016bb1ceef2c36ede58202d170.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1688	58d9e7016bb1ceef2c36ede58202d170.exe
Token: SeDebugPrivilege	1556	svchost.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 1236 wrote to memory of 1688	1236	58d9e7016bb1ceef2c36ede58202d170.exe	28
PID 1236 wrote to memory of 1688	1236	58d9e7016bb1ceef2c36ede58202d170.exe	28
PID 1236 wrote to memory of 1688	1236	58d9e7016bb1ceef2c36ede58202d170.exe	28
PID 1236 wrote to memory of 1688	1236	58d9e7016bb1ceef2c36ede58202d170.exe	28
PID 1236 wrote to memory of 1688	1236	58d9e7016bb1ceef2c36ede58202d170.exe	28
PID 1236 wrote to memory of 1688	1236	58d9e7016bb1ceef2c36ede58202d170.exe	28
PID 1236 wrote to memory of 1688	1236	58d9e7016bb1ceef2c36ede58202d170.exe	28
PID 1236 wrote to memory of 1688	1236	58d9e7016bb1ceef2c36ede58202d170.exe	28
PID 1236 wrote to memory of 1688	1236	58d9e7016bb1ceef2c36ede58202d170.exe	28
PID 1688 wrote to memory of 2788	1688	58d9e7016bb1ceef2c36ede58202d170.exe	29
PID 1688 wrote to memory of 2788	1688	58d9e7016bb1ceef2c36ede58202d170.exe	29
PID 1688 wrote to memory of 2788	1688	58d9e7016bb1ceef2c36ede58202d170.exe	29
PID 1688 wrote to memory of 2788	1688	58d9e7016bb1ceef2c36ede58202d170.exe	29
PID 1688 wrote to memory of 2700	1688	58d9e7016bb1ceef2c36ede58202d170.exe	31
PID 1688 wrote to memory of 2700	1688	58d9e7016bb1ceef2c36ede58202d170.exe	31
PID 1688 wrote to memory of 2700	1688	58d9e7016bb1ceef2c36ede58202d170.exe	31
PID 1688 wrote to memory of 2700	1688	58d9e7016bb1ceef2c36ede58202d170.exe	31
PID 2788 wrote to memory of 2556	2788	cmd.exe	33
PID 2788 wrote to memory of 2556	2788	cmd.exe	33
PID 2788 wrote to memory of 2556	2788	cmd.exe	33
PID 2788 wrote to memory of 2556	2788	cmd.exe	33
PID 2700 wrote to memory of 2560	2700	cmd.exe	34
PID 2700 wrote to memory of 2560	2700	cmd.exe	34
PID 2700 wrote to memory of 2560	2700	cmd.exe	34
PID 2700 wrote to memory of 2560	2700	cmd.exe	34
PID 2700 wrote to memory of 2384	2700	cmd.exe	35
PID 2700 wrote to memory of 2384	2700	cmd.exe	35
PID 2700 wrote to memory of 2384	2700	cmd.exe	35
PID 2700 wrote to memory of 2384	2700	cmd.exe	35
PID 2384 wrote to memory of 1556	2384	svchost.exe	36
PID 2384 wrote to memory of 1556	2384	svchost.exe	36
PID 2384 wrote to memory of 1556	2384	svchost.exe	36
PID 2384 wrote to memory of 1556	2384	svchost.exe	36
PID 2384 wrote to memory of 1556	2384	svchost.exe	36
PID 2384 wrote to memory of 1556	2384	svchost.exe	36
PID 2384 wrote to memory of 1556	2384	svchost.exe	36
PID 2384 wrote to memory of 1556	2384	svchost.exe	36
PID 2384 wrote to memory of 1556	2384	svchost.exe	36

C:\Users\Admin\AppData\Local\Temp\58d9e7016bb1ceef2c36ede58202d170.exe
"C:\Users\Admin\AppData\Local\Temp\58d9e7016bb1ceef2c36ede58202d170.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1236
- C:\Users\Admin\AppData\Local\Temp\58d9e7016bb1ceef2c36ede58202d170.exe
  "C:\Users\Admin\AppData\Local\Temp\58d9e7016bb1ceef2c36ede58202d170.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1688
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\Admin\AppData\Roaming\svchost.exe"' & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2788
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\Admin\AppData\Roaming\svchost.exe"'
      4⤵
      Creates scheduled task(s)
      PID:2556
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp9D87.tmp.bat""
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2700
  - - C:\Windows\SysWOW64\timeout.exe
      timeout 3
      4⤵
      Delays execution with timeout.exe
      PID:2560
  - - C:\Users\Admin\AppData\Roaming\svchost.exe
      "C:\Users\Admin\AppData\Roaming\svchost.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of WriteProcessMemory
      PID:2384
    - - C:\Users\Admin\AppData\Roaming\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1556

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp9D87.tmp.bat

Filesize
151B

MD5
210d4f0514c43ef94643c10f72509b93

SHA1
04454b5144faf1f7d3dcba502ef2b74e5bc6e27c

SHA256
5c6d3de849db94997474c3c082665ac5bed411825c1a6fcd556093eb85ad0649

SHA512
73cf64a16cae5f1490560e438d83fa3d447ff72433643afa95494cfe05bea08c48d4762422b78a1fafb9689760b29b9611dbb5bd4d27aac7e30f9ad0e1849e1a

Download Submit
\Users\Admin\AppData\Roaming\svchost.exe

Filesize
491KB

MD5
58d9e7016bb1ceef2c36ede58202d170

SHA1
95c9defb36b6ba08c78ad6068a2766dad1e33512

SHA256
58a07549993c34caf8617e6cb341b44ceca162106b501fee09629936bad7bb51

SHA512
aa688b35cd42d915d4503b1078535dc14bcfcbe7d30b8874dbc173cfc662685cc07a5d256b8452c1d113fdcebe77e074f60fb2d789d664ff401a94444a162e95

Download Submit
memory/1236-1-0x0000000073FD0000-0x00000000746BE000-memory.dmp

Filesize
6.9MB

Download
memory/1236-3-0x00000000003A0000-0x00000000003AA000-memory.dmp

Filesize
40KB

Download
memory/1236-0-0x0000000000A20000-0x0000000000AA0000-memory.dmp

Filesize
512KB

Download
memory/1236-13-0x0000000073FD0000-0x00000000746BE000-memory.dmp

Filesize
6.9MB

Download
memory/1556-50-0x0000000073FD0000-0x00000000746BE000-memory.dmp

Filesize
6.9MB

Download
memory/1556-51-0x0000000004CF0000-0x0000000004D30000-memory.dmp

Filesize
256KB

Download
memory/1556-49-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/1556-46-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/1556-41-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1556-52-0x0000000073FD0000-0x00000000746BE000-memory.dmp

Filesize
6.9MB

Download
memory/1556-53-0x0000000004CF0000-0x0000000004D30000-memory.dmp

Filesize
256KB

Download
memory/1688-5-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/1688-8-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1688-26-0x00000000738E0000-0x0000000073FCE000-memory.dmp

Filesize
6.9MB

Download
memory/1688-6-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/1688-4-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/1688-10-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/1688-16-0x00000000738E0000-0x0000000073FCE000-memory.dmp

Filesize
6.9MB

Download
memory/1688-7-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/1688-12-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/1688-15-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/1688-17-0x00000000009C0000-0x0000000000A00000-memory.dmp

Filesize
256KB

Download
memory/2384-47-0x0000000073FD0000-0x00000000746BE000-memory.dmp

Filesize
6.9MB

Download
memory/2384-31-0x0000000001130000-0x00000000011B0000-memory.dmp

Filesize
512KB

Download
memory/2384-32-0x0000000073FD0000-0x00000000746BE000-memory.dmp

Filesize
6.9MB

Download