asyncrat | 110ac3af0ae9210dccc86e7b9bd14d7274b80c18630e9b0b4b2c1469ba2ddb1d

General

Target

110ac3af0ae9210dccc86e7b9bd14d7274b80c18630e9b0b4b2c1469ba2ddb1d.exe
Size

1.8MB
MD5

a69c199a4f17c1dfd96b64ff2e3651d1
SHA1

3a441d70c00a5535b8ce8cee93dea0d71536c1a5
SHA256

110ac3af0ae9210dccc86e7b9bd14d7274b80c18630e9b0b4b2c1469ba2ddb1d
SHA512

f629c6172172c0fca384a8308d250ad315ddffcdcb1c595b6029aa7c960780177dedb2c1a01895a64d2332a9c1dab1c760a6097fd3387c25624aeae2232e18ec
SSDEEP

49152:Zi39+084E6W4W8+m/ob49aXZmMA88DOKmX:Y+HVb4W8bG49unDfTX

Score

10^/10

asyncrat default persistence rat

Malware Config

Extracted

Family

asyncrat

Botnet

Default

C2

1.err.line.pm:4449

Mutex

glzznzesxsoyn

Attributes

delay
1
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral2/memory/4856-21-0x00000000057D0000-0x00000000057E8000-memory.dmp	family_asyncrat

Executes dropped EXE 2 IoCs

pid	Process
2016	sg.tmp
4856	svchost.exe

Loads dropped DLL 1 IoCs

pid	Process
4856	svchost.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MyDLLStartup = "C:\\Users\\Admin\\AppData\\Local\\Temp\\~2343759080329597842\\svchost.exe"	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
4856	svchost.exe
4856	svchost.exe
4856	svchost.exe
4856	svchost.exe
4856	svchost.exe
4856	svchost.exe
4856	svchost.exe
4856	svchost.exe
4856	svchost.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: SeBackupPrivilege	3132	110ac3af0ae9210dccc86e7b9bd14d7274b80c18630e9b0b4b2c1469ba2ddb1d.exe
Token: SeRestorePrivilege	3132	110ac3af0ae9210dccc86e7b9bd14d7274b80c18630e9b0b4b2c1469ba2ddb1d.exe
Token: 33	3132	110ac3af0ae9210dccc86e7b9bd14d7274b80c18630e9b0b4b2c1469ba2ddb1d.exe
Token: SeIncBasePriorityPrivilege	3132	110ac3af0ae9210dccc86e7b9bd14d7274b80c18630e9b0b4b2c1469ba2ddb1d.exe
Token: SeCreateGlobalPrivilege	3132	110ac3af0ae9210dccc86e7b9bd14d7274b80c18630e9b0b4b2c1469ba2ddb1d.exe
Token: 33	3132	110ac3af0ae9210dccc86e7b9bd14d7274b80c18630e9b0b4b2c1469ba2ddb1d.exe
Token: SeIncBasePriorityPrivilege	3132	110ac3af0ae9210dccc86e7b9bd14d7274b80c18630e9b0b4b2c1469ba2ddb1d.exe
Token: 33	3132	110ac3af0ae9210dccc86e7b9bd14d7274b80c18630e9b0b4b2c1469ba2ddb1d.exe
Token: SeIncBasePriorityPrivilege	3132	110ac3af0ae9210dccc86e7b9bd14d7274b80c18630e9b0b4b2c1469ba2ddb1d.exe
Token: SeRestorePrivilege	2016	sg.tmp
Token: 35	2016	sg.tmp
Token: SeSecurityPrivilege	2016	sg.tmp
Token: SeSecurityPrivilege	2016	sg.tmp
Token: 33	3132	110ac3af0ae9210dccc86e7b9bd14d7274b80c18630e9b0b4b2c1469ba2ddb1d.exe
Token: SeIncBasePriorityPrivilege	3132	110ac3af0ae9210dccc86e7b9bd14d7274b80c18630e9b0b4b2c1469ba2ddb1d.exe
Token: SeDebugPrivilege	4856	svchost.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4856	svchost.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3132 wrote to memory of 716	3132	110ac3af0ae9210dccc86e7b9bd14d7274b80c18630e9b0b4b2c1469ba2ddb1d.exe	88
PID 3132 wrote to memory of 716	3132	110ac3af0ae9210dccc86e7b9bd14d7274b80c18630e9b0b4b2c1469ba2ddb1d.exe	88
PID 3132 wrote to memory of 2016	3132	110ac3af0ae9210dccc86e7b9bd14d7274b80c18630e9b0b4b2c1469ba2ddb1d.exe	92
PID 3132 wrote to memory of 2016	3132	110ac3af0ae9210dccc86e7b9bd14d7274b80c18630e9b0b4b2c1469ba2ddb1d.exe	92
PID 3132 wrote to memory of 2016	3132	110ac3af0ae9210dccc86e7b9bd14d7274b80c18630e9b0b4b2c1469ba2ddb1d.exe	92
PID 3132 wrote to memory of 4856	3132	110ac3af0ae9210dccc86e7b9bd14d7274b80c18630e9b0b4b2c1469ba2ddb1d.exe	95
PID 3132 wrote to memory of 4856	3132	110ac3af0ae9210dccc86e7b9bd14d7274b80c18630e9b0b4b2c1469ba2ddb1d.exe	95
PID 3132 wrote to memory of 4856	3132	110ac3af0ae9210dccc86e7b9bd14d7274b80c18630e9b0b4b2c1469ba2ddb1d.exe	95

C:\Users\Admin\AppData\Local\Temp\110ac3af0ae9210dccc86e7b9bd14d7274b80c18630e9b0b4b2c1469ba2ddb1d.exe
"C:\Users\Admin\AppData\Local\Temp\110ac3af0ae9210dccc86e7b9bd14d7274b80c18630e9b0b4b2c1469ba2ddb1d.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3132
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c set
  2⤵
  PID:716
- C:\Users\Admin\AppData\Local\Temp\~2651095835306569046~\sg.tmp
  7zG_exe x "C:\Users\Admin\AppData\Local\Temp\110ac3af0ae9210dccc86e7b9bd14d7274b80c18630e9b0b4b2c1469ba2ddb1d.exe" -y -aos -o"C:\Users\Admin\AppData\Local\Temp\~2343759080329597842"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2016
- C:\Users\Admin\AppData\Local\Temp\~2343759080329597842\svchost.exe
  "C:\Users\Admin\AppData\Local\Temp\~2343759080329597842\svchost.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:4856

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\~2343759080329597842\Office.txt

Filesize
111KB

MD5
52a1fc2e368b7367f762959a594fd94e

SHA1
3718fcd1679443258d472b0ef8b18b2ac00ff916

SHA256
52bea881a027370e60282ec9af9e4dde33ba723ca1b6236019e32c87deeb438e

SHA512
50944c91beeedecbd48ddab847332cd20a804197cd3afdeab1b9f340224be11df770d7a82b5ded1790d945f23c24c0abc21b74585586af274b73ba4f2dc01378

Download Submit
C:\Users\Admin\AppData\Local\Temp\~2343759080329597842\msedge_elf.dll

Filesize
26KB

MD5
457f1e9754479c07bfa7925fd743bdfa

SHA1
d2c99cca4749da75f5b3dd624943e425205f3828

SHA256
2fa643f7c1a47a1c9423d4602e32bed58aa7adf1a40ee112e0ce8c7767f438c2

SHA512
11b781260b8a76624663053723789c346e97248e5bc0db1a425a73ee5384ec6e78b25d8e95a28c4b2fd48e6b4ae06872e07fd8a47c2dd80224e606504ac65ab9

Download Submit
C:\Users\Admin\AppData\Local\Temp\~2343759080329597842\svchost.exe

Filesize
833KB

MD5
9a25c9f4ae1ae0206d0ac670fc26bfb0

SHA1
ab9e4e3c92a722d0ccec78a5843d99b29d5a65e5

SHA256
7e78f5183d1539b90445356a7069b0f610d9b8c69c2be228e5952fe807d1791b

SHA512
ed7c65b387f8a3aeb06a3e06ed6444a928bdaff816391220a633dbbc18b6d8db65e86889ed1ba9e48d8e88dbb3cae4867a7c3a1ff12f473f36f03639a5b711d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\~2651095835306569046~\sg.tmp

Filesize
715KB

MD5
7c4718943bd3f66ebdb47ccca72c7b1e

SHA1
f9edfaa7adb8fa528b2e61b2b251f18da10a6969

SHA256
4cc32d00338fc7b206a7c052297acf9ac304ae7de9d61a2475a116959c1524fc

SHA512
e18c40d646fa4948f90f7471da55489df431f255041ebb6dcef86346f91078c9b27894e27216a4b2fe2a1c5e501c7953c77893cf696930123d28a322d49e1516

Download Submit
memory/3132-0-0x0000000000400000-0x000000000055F000-memory.dmp

Filesize
1.4MB

Download
memory/4856-22-0x00000000739E0000-0x0000000074190000-memory.dmp

Filesize
7.7MB

Download
memory/4856-20-0x0000000002C90000-0x0000000002CAC000-memory.dmp

Filesize
112KB

Download
memory/4856-21-0x00000000057D0000-0x00000000057E8000-memory.dmp

Filesize
96KB

Download
memory/4856-23-0x0000000005FD0000-0x0000000006574000-memory.dmp

Filesize
5.6MB

Download
memory/4856-26-0x0000000077821000-0x0000000077822000-memory.dmp

Filesize
4KB

Download
memory/4856-25-0x0000000005DF0000-0x0000000005E82000-memory.dmp

Filesize
584KB

Download
memory/4856-27-0x0000000005DC0000-0x0000000005DCA000-memory.dmp

Filesize
40KB

Download
memory/4856-28-0x00000000739E0000-0x0000000074190000-memory.dmp

Filesize
7.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads