asyncrat | cc89512cf8710a8005a5c64d9e3bc0c45c3f025eb010892ef08d5da6786b5961

General

Target

dwm.exe
Size

48KB
MD5

7ec9e8a3aa64dd9bd0547ae55d29a79a
SHA1

818e73dd29fabe93d425f3b11ad061b87dab1787
SHA256

cc89512cf8710a8005a5c64d9e3bc0c45c3f025eb010892ef08d5da6786b5961
SHA512

71cc03d084711ac9b9a7d9097dd133405ed09a8c33223c354a2f499c5d38b5d0ff28e510b3e992f09978d9efc48da63a3640456d60c0a8163cc2310089250514
SSDEEP

768:WUkPIL2C6y+DiNbik7U8Yb2g1aVLX6BKvEgK/JbpVc6KN:WU22Uzbp+X1nkJbpVclN

Score

10^/10

asyncrat default rat

Malware Config

Extracted

Family

asyncrat

Version

1.0.7

Botnet

Default

C2

94.124.192.220:8848

Mutex

DcRatMutex_qwqdanchun

Attributes

delay
1
install
true
install_file
Desktop Window Manager.exe
install_folder
%Temp%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral2/files/0x000400000001db3a-10.dat	family_asyncrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Control Panel\International\Geo\Nation	dwm.exe

Executes dropped EXE 1 IoCs

pid	Process
2284	Desktop Window Manager.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
948	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
2480	timeout.exe

Suspicious behavior: EnumeratesProcesses 23 IoCs

pid	Process
1300	dwm.exe
1300	dwm.exe
1300	dwm.exe
1300	dwm.exe
1300	dwm.exe
1300	dwm.exe
1300	dwm.exe
1300	dwm.exe
1300	dwm.exe
1300	dwm.exe
1300	dwm.exe
1300	dwm.exe
1300	dwm.exe
1300	dwm.exe
1300	dwm.exe
1300	dwm.exe
1300	dwm.exe
1300	dwm.exe
1300	dwm.exe
1300	dwm.exe
1300	dwm.exe
1300	dwm.exe
1300	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1300	dwm.exe
Token: SeDebugPrivilege	1300	dwm.exe
Token: SeDebugPrivilege	2284	Desktop Window Manager.exe
Token: SeDebugPrivilege	2284	Desktop Window Manager.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1300 wrote to memory of 2296	1300	dwm.exe	87
PID 1300 wrote to memory of 2296	1300	dwm.exe	87
PID 1300 wrote to memory of 1976	1300	dwm.exe	89
PID 1300 wrote to memory of 1976	1300	dwm.exe	89
PID 1976 wrote to memory of 2480	1976	cmd.exe	92
PID 1976 wrote to memory of 2480	1976	cmd.exe	92
PID 2296 wrote to memory of 948	2296	cmd.exe	91
PID 2296 wrote to memory of 948	2296	cmd.exe	91
PID 1976 wrote to memory of 2284	1976	cmd.exe	93
PID 1976 wrote to memory of 2284	1976	cmd.exe	93

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\dwm.exe
"C:\Users\Admin\AppData\Local\Temp\dwm.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1300
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Desktop Window Manager" /tr '"C:\Users\Admin\AppData\Local\Temp\Desktop Window Manager.exe"' & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2296
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc onlogon /rl highest /tn "Desktop Window Manager" /tr '"C:\Users\Admin\AppData\Local\Temp\Desktop Window Manager.exe"'
    3⤵
    - Creates scheduled task(s)
    PID:948
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp4C0D.tmp.bat""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1976
- - C:\Windows\system32\timeout.exe
    timeout 3
    3⤵
    - Delays execution with timeout.exe
    PID:2480
- - C:\Users\Admin\AppData\Local\Temp\Desktop Window Manager.exe
    "C:\Users\Admin\AppData\Local\Temp\Desktop Window Manager.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:2284

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Desktop Window Manager.exe

Filesize
48KB

MD5
7ec9e8a3aa64dd9bd0547ae55d29a79a

SHA1
818e73dd29fabe93d425f3b11ad061b87dab1787

SHA256
cc89512cf8710a8005a5c64d9e3bc0c45c3f025eb010892ef08d5da6786b5961

SHA512
71cc03d084711ac9b9a7d9097dd133405ed09a8c33223c354a2f499c5d38b5d0ff28e510b3e992f09978d9efc48da63a3640456d60c0a8163cc2310089250514

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp4C0D.tmp.bat

Filesize
169B

MD5
1e171dcb563ce3b93583c65c7fabc6ac

SHA1
a5c179f9faa36495f4f5a7b60e98afec5089f412

SHA256
e3f62ac15bd5d04cd0fb69ffe13b0d3fc8082bcae2a7122733dc3155dcde928d

SHA512
8a636f913b8f3ddc7ceba3472c986bf1e348e8bd4acb2f0c360eba7d821e5e982123d037b86b3236126df69835d975892d8cf1bba251a583335786ab2bef1fe1

Download Submit
memory/1300-0-0x0000000000D00000-0x0000000000D12000-memory.dmp

Filesize
72KB

Download
memory/1300-1-0x00007FFDAC330000-0x00007FFDACDF1000-memory.dmp

Filesize
10.8MB

Download
memory/1300-2-0x000000001B830000-0x000000001B840000-memory.dmp

Filesize
64KB

Download
memory/1300-7-0x00007FFDAC330000-0x00007FFDACDF1000-memory.dmp

Filesize
10.8MB

Download
memory/2284-12-0x00007FFDAC330000-0x00007FFDACDF1000-memory.dmp

Filesize
10.8MB

Download
memory/2284-13-0x000000001B830000-0x000000001B840000-memory.dmp

Filesize
64KB

Download
memory/2284-14-0x00007FFDBA930000-0x00007FFDBA949000-memory.dmp

Filesize
100KB

Download
memory/2284-15-0x00007FFDAC330000-0x00007FFDACDF1000-memory.dmp

Filesize
10.8MB

Download
memory/2284-16-0x000000001B830000-0x000000001B840000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads