asyncrat | 201d93bf0cba57d6bf22201311f082c11dde20bf1269d5275539df14fd502398

General

Target

d224b20b8c858da3bac1c5fb9cd1c33b.exe
Size

310KB
MD5

d224b20b8c858da3bac1c5fb9cd1c33b
SHA1

e1d256a961662b1b45c23a2bfc4e4edf2d30b177
SHA256

201d93bf0cba57d6bf22201311f082c11dde20bf1269d5275539df14fd502398
SHA512

e281343bc2e0d197c21bc442aefb27526515807e3279f8fd9636aea19b6fbc1dd5a5be3038615c513d60568e0ea821ea6c080efce43d059e30032a93cc1190ba
SSDEEP

6144:BbiQqdJ052x8C2adFIYI906jqGFPkoh7Y0gJamWKw7eMT129ZW5sNdaYmOdhzStP:BbiQz52aC1sP906mG53h7c/RQ1p5C4LP

Score

10^/10

asyncrat zgrat default rat spyware stealer

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

C2

127.0.0.1:4217

146.70.161.85:4217

Mutex

dkhXL7HeeLRM

Attributes

delay
3
install
true
install_file
Colours.exe
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Detect ZGRat V1 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1344-37-0x0000000006B50000-0x0000000006BEC000-memory.dmp	family_zgrat_v1

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

Async RAT payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/2376-11-0x0000000000730000-0x0000000000742000-memory.dmp	asyncrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

d224b20b8c858da3bac1c5fb9cd1c33b.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\Control Panel\International\Geo\Nation	d224b20b8c858da3bac1c5fb9cd1c33b.exe

Executes dropped EXE 2 IoCs

Processes:

Colours.exeColours.exe

pid process

4496 Colours.exe
1344 Colours.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

pid	process
4496	Colours.exe
1344	Colours.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

d224b20b8c858da3bac1c5fb9cd1c33b.exeColours.exe

description	pid	process	target process
PID 4792 set thread context of 2376	4792	d224b20b8c858da3bac1c5fb9cd1c33b.exe	d224b20b8c858da3bac1c5fb9cd1c33b.exe
PID 4496 set thread context of 1344	4496	Colours.exe	Colours.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

5052 schtasks.exe
Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

4624 timeout.exe

pid	process
5052	schtasks.exe

pid	process
4624	timeout.exe

Suspicious behavior: EnumeratesProcesses 23 IoCs

Processes:

d224b20b8c858da3bac1c5fb9cd1c33b.exe

pid	process
2376	d224b20b8c858da3bac1c5fb9cd1c33b.exe
2376	d224b20b8c858da3bac1c5fb9cd1c33b.exe
2376	d224b20b8c858da3bac1c5fb9cd1c33b.exe
2376	d224b20b8c858da3bac1c5fb9cd1c33b.exe
2376	d224b20b8c858da3bac1c5fb9cd1c33b.exe
2376	d224b20b8c858da3bac1c5fb9cd1c33b.exe
2376	d224b20b8c858da3bac1c5fb9cd1c33b.exe
2376	d224b20b8c858da3bac1c5fb9cd1c33b.exe
2376	d224b20b8c858da3bac1c5fb9cd1c33b.exe
2376	d224b20b8c858da3bac1c5fb9cd1c33b.exe
2376	d224b20b8c858da3bac1c5fb9cd1c33b.exe
2376	d224b20b8c858da3bac1c5fb9cd1c33b.exe
2376	d224b20b8c858da3bac1c5fb9cd1c33b.exe
2376	d224b20b8c858da3bac1c5fb9cd1c33b.exe
2376	d224b20b8c858da3bac1c5fb9cd1c33b.exe
2376	d224b20b8c858da3bac1c5fb9cd1c33b.exe
2376	d224b20b8c858da3bac1c5fb9cd1c33b.exe
2376	d224b20b8c858da3bac1c5fb9cd1c33b.exe
2376	d224b20b8c858da3bac1c5fb9cd1c33b.exe
2376	d224b20b8c858da3bac1c5fb9cd1c33b.exe
2376	d224b20b8c858da3bac1c5fb9cd1c33b.exe
2376	d224b20b8c858da3bac1c5fb9cd1c33b.exe
2376	d224b20b8c858da3bac1c5fb9cd1c33b.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

d224b20b8c858da3bac1c5fb9cd1c33b.exeColours.exe

description pid process

Token: SeDebugPrivilege 2376 d224b20b8c858da3bac1c5fb9cd1c33b.exe
Token: SeDebugPrivilege 1344 Colours.exe

description	pid	process
Token: SeDebugPrivilege	2376	d224b20b8c858da3bac1c5fb9cd1c33b.exe
Token: SeDebugPrivilege	1344	Colours.exe

Suspicious use of WriteProcessMemory 31 IoCs

Processes:

d224b20b8c858da3bac1c5fb9cd1c33b.exed224b20b8c858da3bac1c5fb9cd1c33b.execmd.execmd.exeColours.exe

description	pid	process	target process
PID 4792 wrote to memory of 2376	4792	d224b20b8c858da3bac1c5fb9cd1c33b.exe	d224b20b8c858da3bac1c5fb9cd1c33b.exe
PID 4792 wrote to memory of 2376	4792	d224b20b8c858da3bac1c5fb9cd1c33b.exe	d224b20b8c858da3bac1c5fb9cd1c33b.exe
PID 4792 wrote to memory of 2376	4792	d224b20b8c858da3bac1c5fb9cd1c33b.exe	d224b20b8c858da3bac1c5fb9cd1c33b.exe
PID 4792 wrote to memory of 2376	4792	d224b20b8c858da3bac1c5fb9cd1c33b.exe	d224b20b8c858da3bac1c5fb9cd1c33b.exe
PID 4792 wrote to memory of 2376	4792	d224b20b8c858da3bac1c5fb9cd1c33b.exe	d224b20b8c858da3bac1c5fb9cd1c33b.exe
PID 4792 wrote to memory of 2376	4792	d224b20b8c858da3bac1c5fb9cd1c33b.exe	d224b20b8c858da3bac1c5fb9cd1c33b.exe
PID 4792 wrote to memory of 2376	4792	d224b20b8c858da3bac1c5fb9cd1c33b.exe	d224b20b8c858da3bac1c5fb9cd1c33b.exe
PID 4792 wrote to memory of 2376	4792	d224b20b8c858da3bac1c5fb9cd1c33b.exe	d224b20b8c858da3bac1c5fb9cd1c33b.exe
PID 2376 wrote to memory of 3352	2376	d224b20b8c858da3bac1c5fb9cd1c33b.exe	cmd.exe
PID 2376 wrote to memory of 3352	2376	d224b20b8c858da3bac1c5fb9cd1c33b.exe	cmd.exe
PID 2376 wrote to memory of 3352	2376	d224b20b8c858da3bac1c5fb9cd1c33b.exe	cmd.exe
PID 2376 wrote to memory of 3984	2376	d224b20b8c858da3bac1c5fb9cd1c33b.exe	cmd.exe
PID 2376 wrote to memory of 3984	2376	d224b20b8c858da3bac1c5fb9cd1c33b.exe	cmd.exe
PID 2376 wrote to memory of 3984	2376	d224b20b8c858da3bac1c5fb9cd1c33b.exe	cmd.exe
PID 3984 wrote to memory of 4624	3984	cmd.exe	timeout.exe
PID 3984 wrote to memory of 4624	3984	cmd.exe	timeout.exe
PID 3984 wrote to memory of 4624	3984	cmd.exe	timeout.exe
PID 3352 wrote to memory of 5052	3352	cmd.exe	schtasks.exe
PID 3352 wrote to memory of 5052	3352	cmd.exe	schtasks.exe
PID 3352 wrote to memory of 5052	3352	cmd.exe	schtasks.exe
PID 3984 wrote to memory of 4496	3984	cmd.exe	Colours.exe
PID 3984 wrote to memory of 4496	3984	cmd.exe	Colours.exe
PID 3984 wrote to memory of 4496	3984	cmd.exe	Colours.exe
PID 4496 wrote to memory of 1344	4496	Colours.exe	Colours.exe
PID 4496 wrote to memory of 1344	4496	Colours.exe	Colours.exe
PID 4496 wrote to memory of 1344	4496	Colours.exe	Colours.exe
PID 4496 wrote to memory of 1344	4496	Colours.exe	Colours.exe
PID 4496 wrote to memory of 1344	4496	Colours.exe	Colours.exe
PID 4496 wrote to memory of 1344	4496	Colours.exe	Colours.exe
PID 4496 wrote to memory of 1344	4496	Colours.exe	Colours.exe
PID 4496 wrote to memory of 1344	4496	Colours.exe	Colours.exe

C:\Users\Admin\AppData\Local\Temp\d224b20b8c858da3bac1c5fb9cd1c33b.exe
"C:\Users\Admin\AppData\Local\Temp\d224b20b8c858da3bac1c5fb9cd1c33b.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4792

C:\Users\Admin\AppData\Local\Temp\d224b20b8c858da3bac1c5fb9cd1c33b.exe
"C:\Users\Admin\AppData\Local\Temp\d224b20b8c858da3bac1c5fb9cd1c33b.exe"
2⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2376

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Colours" /tr '"C:\Users\Admin\AppData\Roaming\Colours.exe"' & exit
3⤵
- Suspicious use of WriteProcessMemory
PID:3352

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /f /sc onlogon /rl highest /tn "Colours" /tr '"C:\Users\Admin\AppData\Roaming\Colours.exe"'
4⤵
- Creates scheduled task(s)
PID:5052

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp5C87.tmp.bat""
3⤵
- Suspicious use of WriteProcessMemory
PID:3984

C:\Windows\SysWOW64\timeout.exe
timeout 3
4⤵
- Delays execution with timeout.exe
PID:4624

C:\Users\Admin\AppData\Roaming\Colours.exe
"C:\Users\Admin\AppData\Roaming\Colours.exe"
4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4496

C:\Users\Admin\AppData\Roaming\Colours.exe
"C:\Users\Admin\AppData\Roaming\Colours.exe"
5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1344

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\d224b20b8c858da3bac1c5fb9cd1c33b.exe.log
Filesize
706B

MD5
f8bcaf312de8591707436c1dcebba8e4

SHA1
a1269828e5f644601622f4a7a611aec8f2eda0b2

SHA256
f0f5a90777c70cdceea22bd66b33c1703a318acc45cb012d0b01585a1ac12b29

SHA512
3a714f5950584abbc94a27bbd4623bfc5acb1135c8c9fca4d74e70c8481b71ace7dbc1dfbf101dd07c76a050acfb4852f31dd57fc7ae196382336c5edc9e6413

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp5C87.tmp.bat
Filesize
151B

MD5
4c24f1136988845164182bb2341efcab

SHA1
5c085c0ea2052b8fed4817ba23b26230e41c7240

SHA256
e369b71d9e58cabf1fa02c99b972c4b37545bd3aeb1be52480d4256e4e70d2ac

SHA512
cfa40eabf86a4a0899570c5f597784b981043b4a0be79d8a01bd0ff2ef4cb1af00ed93ffa4220b4efe3b8f5012466c6a6a5fd07835d5e1f67e5daa0ec64edda3

Download Submit
C:\Users\Admin\AppData\Roaming\Colours.exe
Filesize
310KB

MD5
d224b20b8c858da3bac1c5fb9cd1c33b

SHA1
e1d256a961662b1b45c23a2bfc4e4edf2d30b177

SHA256
201d93bf0cba57d6bf22201311f082c11dde20bf1269d5275539df14fd502398

SHA512
e281343bc2e0d197c21bc442aefb27526515807e3279f8fd9636aea19b6fbc1dd5a5be3038615c513d60568e0ea821ea6c080efce43d059e30032a93cc1190ba

Download Submit
C:\Users\Admin\AppData\Roaming\Colours.exe
Filesize
197KB

MD5
feb2c8b0bc44851bb64db4948bf36da1

SHA1
f604ede51f6b09ba18ea9a086feb0de87ea565c3

SHA256
d6bd041d37d184094ef91a9bcc1010dfcfeca544728dfd4ca5edb168e9d191f0

SHA512
0bc8f7cd48382fb29b56d6a99b443b4c58a701aa8a694c10b1773c739cfb32f4079fe8b79df5d525da73c05be607a17d721b7a8ce061519c4d0abc15fdc90da0

Download Submit
memory/1344-31-0x0000000004E10000-0x0000000004E20000-memory.dmp

Filesize
64KB

Download
memory/1344-30-0x00000000748A0000-0x0000000075050000-memory.dmp

Filesize
7.7MB

Download
memory/1344-41-0x0000000004E10000-0x0000000004E20000-memory.dmp

Filesize
64KB

Download
memory/1344-40-0x0000000006C60000-0x0000000006C6A000-memory.dmp

Filesize
40KB

Download
memory/1344-39-0x0000000006C20000-0x0000000006C60000-memory.dmp

Filesize
256KB

Download
memory/1344-38-0x0000000006BF0000-0x0000000006C0E000-memory.dmp

Filesize
120KB

Download
memory/1344-37-0x0000000006B50000-0x0000000006BEC000-memory.dmp

Filesize
624KB

Download
memory/1344-36-0x0000000006AD0000-0x0000000006B46000-memory.dmp

Filesize
472KB

Download
memory/1344-35-0x00000000748A0000-0x0000000075050000-memory.dmp

Filesize
7.7MB

Download
memory/1344-34-0x00000000055B0000-0x0000000005616000-memory.dmp

Filesize
408KB

Download
memory/2376-12-0x00000000748A0000-0x0000000075050000-memory.dmp

Filesize
7.7MB

Download
memory/2376-18-0x00000000748A0000-0x0000000075050000-memory.dmp

Filesize
7.7MB

Download
memory/2376-11-0x0000000000730000-0x0000000000742000-memory.dmp

Filesize
72KB

Download
memory/2376-14-0x0000000004D40000-0x0000000004D50000-memory.dmp

Filesize
64KB

Download
memory/4496-24-0x00000000050E0000-0x00000000050F0000-memory.dmp

Filesize
64KB

Download
memory/4496-23-0x00000000748A0000-0x0000000075050000-memory.dmp

Filesize
7.7MB

Download
memory/4496-29-0x00000000748A0000-0x0000000075050000-memory.dmp

Filesize
7.7MB

Download
memory/4792-0-0x0000000000A60000-0x0000000000AB4000-memory.dmp

Filesize
336KB

Download
memory/4792-2-0x0000000005360000-0x00000000053A0000-memory.dmp

Filesize
256KB

Download
memory/4792-3-0x00000000052E0000-0x00000000052F0000-memory.dmp

Filesize
64KB

Download
memory/4792-4-0x0000000005950000-0x0000000005EF4000-memory.dmp

Filesize
5.6MB

Download
memory/4792-5-0x0000000005480000-0x0000000005512000-memory.dmp

Filesize
584KB

Download
memory/4792-13-0x00000000748A0000-0x0000000075050000-memory.dmp

Filesize
7.7MB

Download
memory/4792-1-0x00000000748A0000-0x0000000075050000-memory.dmp

Filesize
7.7MB

Download
memory/4792-7-0x00000000053F0000-0x00000000053F8000-memory.dmp

Filesize
32KB

Download
memory/4792-6-0x0000000005520000-0x00000000055BC000-memory.dmp

Filesize
624KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads