asyncrat | f0672721757410417542f5e03ef7e7a61963e4dc65a1c6eaee0698d58ca858aa

Analysis

max time kernel
147s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
01-03-2024 04:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b04a7dfc482d9c482b4ad451981c4877.exe
Size

966KB
MD5

b04a7dfc482d9c482b4ad451981c4877
SHA1

983214617489385f7cef88d5a31243f00ecfe956
SHA256

f0672721757410417542f5e03ef7e7a61963e4dc65a1c6eaee0698d58ca858aa
SHA512

97b735cc0b55418aee5dc172b8ccf7647b6385eb3394fcd6fe4ce6e98618034648069c85a30647ce45d40915df62d5f4f49d6c19afd8067b2a44651295010d9f
SSDEEP

24576:FybH9902UaaqizC57mwRkz2MS9/+/nIBQL:F6dllOC5LRi2R2/nP

Score

10^/10

asyncrat system persistence rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

SYSTEM

UpdateServicer.ignorelist.com:6969

Mutex

AsyncMutex_6SI8OkPnk

Attributes

delay
10
install
true
install_file
svchost.exe
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Drops startup file 1 IoCs

Processes:

b04a7dfc482d9c482b4ad451981c4877.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\System Relog.url	b04a7dfc482d9c482b4ad451981c4877.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

b04a7dfc482d9c482b4ad451981c4877.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System Relog = "C:\\ProgramData\\b04a7dfc482d9c482b4ad451981c4877.exe"	b04a7dfc482d9c482b4ad451981c4877.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3716 1712 WerFault.exe attrib.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

b04a7dfc482d9c482b4ad451981c4877.exe

pid process

3824 b04a7dfc482d9c482b4ad451981c4877.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

b04a7dfc482d9c482b4ad451981c4877.exe

description pid process

Token: SeDebugPrivilege 3824 b04a7dfc482d9c482b4ad451981c4877.exe

pid	pid_target	process	target process
3716	1712	WerFault.exe	attrib.exe

pid	process
3824	b04a7dfc482d9c482b4ad451981c4877.exe

description	pid	process
Token: SeDebugPrivilege	3824	b04a7dfc482d9c482b4ad451981c4877.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

b04a7dfc482d9c482b4ad451981c4877.exe

description	pid	process	target process
PID 3824 wrote to memory of 1712	3824	b04a7dfc482d9c482b4ad451981c4877.exe	attrib.exe
PID 3824 wrote to memory of 1712	3824	b04a7dfc482d9c482b4ad451981c4877.exe	attrib.exe
PID 3824 wrote to memory of 1712	3824	b04a7dfc482d9c482b4ad451981c4877.exe	attrib.exe
PID 3824 wrote to memory of 1712	3824	b04a7dfc482d9c482b4ad451981c4877.exe	attrib.exe
PID 3824 wrote to memory of 1712	3824	b04a7dfc482d9c482b4ad451981c4877.exe	attrib.exe
PID 3824 wrote to memory of 1712	3824	b04a7dfc482d9c482b4ad451981c4877.exe	attrib.exe
PID 3824 wrote to memory of 1712	3824	b04a7dfc482d9c482b4ad451981c4877.exe	attrib.exe
PID 3824 wrote to memory of 1712	3824	b04a7dfc482d9c482b4ad451981c4877.exe	attrib.exe

Views/modifies file attributes 1 TTPs 1 IoCs
evasion

Hidden Files and Directories
T1564.001

Processes:

attrib.exe

pid process

1712 attrib.exe

pid	process
1712	attrib.exe

C:\Users\Admin\AppData\Local\Temp\b04a7dfc482d9c482b4ad451981c4877.exe
"C:\Users\Admin\AppData\Local\Temp\b04a7dfc482d9c482b4ad451981c4877.exe"
1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3824

C:\Windows\SysWOW64\attrib.exe
"C:\Windows\System32\attrib.exe"
2⤵
- Views/modifies file attributes
PID:1712

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1712 -s 192
3⤵
- Program crash
PID:3716

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1712 -ip 1712
1⤵
PID:4960

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1712-9-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/3824-0-0x0000000075280000-0x0000000075A30000-memory.dmp

Filesize
7.7MB

Download
memory/3824-1-0x00000000008C0000-0x00000000009BA000-memory.dmp

Filesize
1000KB

Download
memory/3824-2-0x0000000002B70000-0x0000000002B76000-memory.dmp

Filesize
24KB

Download
memory/3824-3-0x00000000051A0000-0x00000000051B0000-memory.dmp

Filesize
64KB

Download
memory/3824-4-0x0000000007710000-0x00000000077FC000-memory.dmp

Filesize
944KB

Download
memory/3824-5-0x0000000004D20000-0x0000000004D26000-memory.dmp

Filesize
24KB

Download
memory/3824-6-0x0000000007680000-0x00000000076E6000-memory.dmp

Filesize
408KB

Download
memory/3824-10-0x0000000075280000-0x0000000075A30000-memory.dmp

Filesize
7.7MB

Download