asyncrat | d0028f62c1734d9bda0763bde36e31b784cbaa0944595b5300bd6e43c4f168fe

General

Target

d0028f62c1734d9bda0763bde36e31b784cbaa0944595b5300bd6e43c4f168fe.exe
Size

2.3MB
MD5

e9fdcd87b918a3f48a285d4c24de302a
SHA1

6a4f3b2bb64269a531b3e8aca974f6350daeddb0
SHA256

d0028f62c1734d9bda0763bde36e31b784cbaa0944595b5300bd6e43c4f168fe
SHA512

04c3748f9879c2c3900eebe14fad3060dd372ea33ffed525d37bf4b4e978d65aa8f7eabef3bf25fc98c1603039ea010ae58618d04ac21c988513754fe5ef9096
SSDEEP

49152:Zi39+084E6W4W8+m/os49aXZmMA8zUYTDTy1be1rFFv:Y+HVb4W8bx49unD/Oe1b

Score

10^/10

asyncrat default persistence rat

Malware Config

Extracted

Family

asyncrat

Botnet

Default

C2

1.err.line.pm:4449

Mutex

glzznzesxsoyn

Attributes

delay
1
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral2/memory/3452-21-0x0000000005900000-0x0000000005918000-memory.dmp	family_asyncrat

Executes dropped EXE 2 IoCs

pid	Process
216	sg.tmp
3452	svchost.exe

Loads dropped DLL 1 IoCs

pid	Process
3452	svchost.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MyDLLStartup = "C:\\Users\\Admin\\AppData\\Local\\Temp\\~1408226275267100090\\svchost.exe"	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
3452	svchost.exe
3452	svchost.exe
3452	svchost.exe
3452	svchost.exe
3452	svchost.exe
3452	svchost.exe
3452	svchost.exe
3452	svchost.exe
3452	svchost.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: SeBackupPrivilege	3220	d0028f62c1734d9bda0763bde36e31b784cbaa0944595b5300bd6e43c4f168fe.exe
Token: SeRestorePrivilege	3220	d0028f62c1734d9bda0763bde36e31b784cbaa0944595b5300bd6e43c4f168fe.exe
Token: 33	3220	d0028f62c1734d9bda0763bde36e31b784cbaa0944595b5300bd6e43c4f168fe.exe
Token: SeIncBasePriorityPrivilege	3220	d0028f62c1734d9bda0763bde36e31b784cbaa0944595b5300bd6e43c4f168fe.exe
Token: SeCreateGlobalPrivilege	3220	d0028f62c1734d9bda0763bde36e31b784cbaa0944595b5300bd6e43c4f168fe.exe
Token: 33	3220	d0028f62c1734d9bda0763bde36e31b784cbaa0944595b5300bd6e43c4f168fe.exe
Token: SeIncBasePriorityPrivilege	3220	d0028f62c1734d9bda0763bde36e31b784cbaa0944595b5300bd6e43c4f168fe.exe
Token: 33	3220	d0028f62c1734d9bda0763bde36e31b784cbaa0944595b5300bd6e43c4f168fe.exe
Token: SeIncBasePriorityPrivilege	3220	d0028f62c1734d9bda0763bde36e31b784cbaa0944595b5300bd6e43c4f168fe.exe
Token: SeRestorePrivilege	216	sg.tmp
Token: 35	216	sg.tmp
Token: SeSecurityPrivilege	216	sg.tmp
Token: SeSecurityPrivilege	216	sg.tmp
Token: 33	3220	d0028f62c1734d9bda0763bde36e31b784cbaa0944595b5300bd6e43c4f168fe.exe
Token: SeIncBasePriorityPrivilege	3220	d0028f62c1734d9bda0763bde36e31b784cbaa0944595b5300bd6e43c4f168fe.exe
Token: SeDebugPrivilege	3452	svchost.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3452	svchost.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3220 wrote to memory of 64	3220	d0028f62c1734d9bda0763bde36e31b784cbaa0944595b5300bd6e43c4f168fe.exe	89
PID 3220 wrote to memory of 64	3220	d0028f62c1734d9bda0763bde36e31b784cbaa0944595b5300bd6e43c4f168fe.exe	89
PID 3220 wrote to memory of 216	3220	d0028f62c1734d9bda0763bde36e31b784cbaa0944595b5300bd6e43c4f168fe.exe	91
PID 3220 wrote to memory of 216	3220	d0028f62c1734d9bda0763bde36e31b784cbaa0944595b5300bd6e43c4f168fe.exe	91
PID 3220 wrote to memory of 216	3220	d0028f62c1734d9bda0763bde36e31b784cbaa0944595b5300bd6e43c4f168fe.exe	91
PID 3220 wrote to memory of 3452	3220	d0028f62c1734d9bda0763bde36e31b784cbaa0944595b5300bd6e43c4f168fe.exe	95
PID 3220 wrote to memory of 3452	3220	d0028f62c1734d9bda0763bde36e31b784cbaa0944595b5300bd6e43c4f168fe.exe	95
PID 3220 wrote to memory of 3452	3220	d0028f62c1734d9bda0763bde36e31b784cbaa0944595b5300bd6e43c4f168fe.exe	95

C:\Users\Admin\AppData\Local\Temp\d0028f62c1734d9bda0763bde36e31b784cbaa0944595b5300bd6e43c4f168fe.exe
"C:\Users\Admin\AppData\Local\Temp\d0028f62c1734d9bda0763bde36e31b784cbaa0944595b5300bd6e43c4f168fe.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3220
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c set
  2⤵
  PID:64
- C:\Users\Admin\AppData\Local\Temp\~5249388470811703847~\sg.tmp
  7zG_exe x "C:\Users\Admin\AppData\Local\Temp\d0028f62c1734d9bda0763bde36e31b784cbaa0944595b5300bd6e43c4f168fe.exe" -y -aos -o"C:\Users\Admin\AppData\Local\Temp\~1408226275267100090"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:216
- C:\Users\Admin\AppData\Local\Temp\~1408226275267100090\svchost.exe
  "C:\Users\Admin\AppData\Local\Temp\~1408226275267100090\svchost.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:3452

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\~1408226275267100090\Office.txt

Filesize
111KB

MD5
52a1fc2e368b7367f762959a594fd94e

SHA1
3718fcd1679443258d472b0ef8b18b2ac00ff916

SHA256
52bea881a027370e60282ec9af9e4dde33ba723ca1b6236019e32c87deeb438e

SHA512
50944c91beeedecbd48ddab847332cd20a804197cd3afdeab1b9f340224be11df770d7a82b5ded1790d945f23c24c0abc21b74585586af274b73ba4f2dc01378

Download Submit
C:\Users\Admin\AppData\Local\Temp\~1408226275267100090\msedge_elf.dll

Filesize
26KB

MD5
457f1e9754479c07bfa7925fd743bdfa

SHA1
d2c99cca4749da75f5b3dd624943e425205f3828

SHA256
2fa643f7c1a47a1c9423d4602e32bed58aa7adf1a40ee112e0ce8c7767f438c2

SHA512
11b781260b8a76624663053723789c346e97248e5bc0db1a425a73ee5384ec6e78b25d8e95a28c4b2fd48e6b4ae06872e07fd8a47c2dd80224e606504ac65ab9

Download Submit
C:\Users\Admin\AppData\Local\Temp\~1408226275267100090\svchost.exe

Filesize
833KB

MD5
9a25c9f4ae1ae0206d0ac670fc26bfb0

SHA1
ab9e4e3c92a722d0ccec78a5843d99b29d5a65e5

SHA256
7e78f5183d1539b90445356a7069b0f610d9b8c69c2be228e5952fe807d1791b

SHA512
ed7c65b387f8a3aeb06a3e06ed6444a928bdaff816391220a633dbbc18b6d8db65e86889ed1ba9e48d8e88dbb3cae4867a7c3a1ff12f473f36f03639a5b711d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\~5249388470811703847~\sg.tmp

Filesize
715KB

MD5
7c4718943bd3f66ebdb47ccca72c7b1e

SHA1
f9edfaa7adb8fa528b2e61b2b251f18da10a6969

SHA256
4cc32d00338fc7b206a7c052297acf9ac304ae7de9d61a2475a116959c1524fc

SHA512
e18c40d646fa4948f90f7471da55489df431f255041ebb6dcef86346f91078c9b27894e27216a4b2fe2a1c5e501c7953c77893cf696930123d28a322d49e1516

Download Submit
memory/3220-0-0x0000000000400000-0x000000000055F000-memory.dmp

Filesize
1.4MB

Download
memory/3452-21-0x0000000005900000-0x0000000005918000-memory.dmp

Filesize
96KB

Download
memory/3452-20-0x0000000002DC0000-0x0000000002DDC000-memory.dmp

Filesize
112KB

Download
memory/3452-22-0x0000000074010000-0x00000000747C0000-memory.dmp

Filesize
7.7MB

Download
memory/3452-23-0x00000000061B0000-0x0000000006754000-memory.dmp

Filesize
5.6MB

Download
memory/3452-25-0x0000000077E51000-0x0000000077E52000-memory.dmp

Filesize
4KB

Download
memory/3452-26-0x0000000005F30000-0x0000000005FC2000-memory.dmp

Filesize
584KB

Download
memory/3452-27-0x0000000005EF0000-0x0000000005EFA000-memory.dmp

Filesize
40KB

Download
memory/3452-28-0x0000000074010000-0x00000000747C0000-memory.dmp

Filesize
7.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads