asyncrat | c3036f061c756b0279703655c6ccc1f58b0d2d560ba94924599099b1c73ecbf3

General

Target

c3036f061c756b0279703655c6ccc1f58b0d2d560ba94924599099b1c73ecbf3.exe
Size

1.8MB
MD5

63b9d980ce167685f61415d082dc681b
SHA1

603140235d53cef46e3bac28cdddd5206a1c4246
SHA256

c3036f061c756b0279703655c6ccc1f58b0d2d560ba94924599099b1c73ecbf3
SHA512

a4161de9bdd90a7260d086080970c3f06df8a99b8cb2db8339b6d105d5b37b47f6e362b7972a6a562263e7d70dc055d5050d5f4ca12215329146fc3b7ad4e25c
SSDEEP

49152:zi39+084E6W4W8+m/oX49aXZmMA88DOKmX:G+HVb4W8b+49unDfTX

Score

10^/10

asyncrat default persistence rat

Malware Config

Extracted

Family

asyncrat

Botnet

Default

C2

1.err.line.pm:4449

Mutex

glzznzesxsoyn

Attributes

delay
1
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral2/memory/2320-22-0x00000000054A0000-0x00000000054B8000-memory.dmp	family_asyncrat

Executes dropped EXE 2 IoCs

pid	Process
4836	sg.tmp
2320	svchost.exe

Loads dropped DLL 1 IoCs

pid	Process
2320	svchost.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MyDLLStartup = "C:\\Users\\Admin\\AppData\\Local\\Temp\\~3609580389694621222\\svchost.exe"	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
2320	svchost.exe
2320	svchost.exe
2320	svchost.exe
2320	svchost.exe
2320	svchost.exe
2320	svchost.exe
2320	svchost.exe
2320	svchost.exe
2320	svchost.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

description	pid	Process
Token: SeBackupPrivilege	2204	c3036f061c756b0279703655c6ccc1f58b0d2d560ba94924599099b1c73ecbf3.exe
Token: SeRestorePrivilege	2204	c3036f061c756b0279703655c6ccc1f58b0d2d560ba94924599099b1c73ecbf3.exe
Token: 33	2204	c3036f061c756b0279703655c6ccc1f58b0d2d560ba94924599099b1c73ecbf3.exe
Token: SeIncBasePriorityPrivilege	2204	c3036f061c756b0279703655c6ccc1f58b0d2d560ba94924599099b1c73ecbf3.exe
Token: SeCreateGlobalPrivilege	2204	c3036f061c756b0279703655c6ccc1f58b0d2d560ba94924599099b1c73ecbf3.exe
Token: 33	2204	c3036f061c756b0279703655c6ccc1f58b0d2d560ba94924599099b1c73ecbf3.exe
Token: SeIncBasePriorityPrivilege	2204	c3036f061c756b0279703655c6ccc1f58b0d2d560ba94924599099b1c73ecbf3.exe
Token: 33	2204	c3036f061c756b0279703655c6ccc1f58b0d2d560ba94924599099b1c73ecbf3.exe
Token: SeIncBasePriorityPrivilege	2204	c3036f061c756b0279703655c6ccc1f58b0d2d560ba94924599099b1c73ecbf3.exe
Token: SeRestorePrivilege	4836	sg.tmp
Token: 35	4836	sg.tmp
Token: SeSecurityPrivilege	4836	sg.tmp
Token: SeSecurityPrivilege	4836	sg.tmp
Token: SeDebugPrivilege	2320	svchost.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2320	svchost.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2204 wrote to memory of 1648	2204	c3036f061c756b0279703655c6ccc1f58b0d2d560ba94924599099b1c73ecbf3.exe	98
PID 2204 wrote to memory of 1648	2204	c3036f061c756b0279703655c6ccc1f58b0d2d560ba94924599099b1c73ecbf3.exe	98
PID 2204 wrote to memory of 4836	2204	c3036f061c756b0279703655c6ccc1f58b0d2d560ba94924599099b1c73ecbf3.exe	100
PID 2204 wrote to memory of 4836	2204	c3036f061c756b0279703655c6ccc1f58b0d2d560ba94924599099b1c73ecbf3.exe	100
PID 2204 wrote to memory of 4836	2204	c3036f061c756b0279703655c6ccc1f58b0d2d560ba94924599099b1c73ecbf3.exe	100
PID 2204 wrote to memory of 2320	2204	c3036f061c756b0279703655c6ccc1f58b0d2d560ba94924599099b1c73ecbf3.exe	104
PID 2204 wrote to memory of 2320	2204	c3036f061c756b0279703655c6ccc1f58b0d2d560ba94924599099b1c73ecbf3.exe	104
PID 2204 wrote to memory of 2320	2204	c3036f061c756b0279703655c6ccc1f58b0d2d560ba94924599099b1c73ecbf3.exe	104

C:\Users\Admin\AppData\Local\Temp\c3036f061c756b0279703655c6ccc1f58b0d2d560ba94924599099b1c73ecbf3.exe
"C:\Users\Admin\AppData\Local\Temp\c3036f061c756b0279703655c6ccc1f58b0d2d560ba94924599099b1c73ecbf3.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2204
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c set
  2⤵
  PID:1648
- C:\Users\Admin\AppData\Local\Temp\~1847069799749926311~\sg.tmp
  7zG_exe x "C:\Users\Admin\AppData\Local\Temp\c3036f061c756b0279703655c6ccc1f58b0d2d560ba94924599099b1c73ecbf3.exe" -y -aos -o"C:\Users\Admin\AppData\Local\Temp\~3609580389694621222"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:4836
- C:\Users\Admin\AppData\Local\Temp\~3609580389694621222\svchost.exe
  "C:\Users\Admin\AppData\Local\Temp\~3609580389694621222\svchost.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2320

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4068 --field-trial-handle=2248,i,10247514684337323751,15511974759131734137,262144 --variations-seed-version /prefetch:8
1⤵
PID:3620

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\~1847069799749926311~\sg.tmp

Filesize
715KB

MD5
7c4718943bd3f66ebdb47ccca72c7b1e

SHA1
f9edfaa7adb8fa528b2e61b2b251f18da10a6969

SHA256
4cc32d00338fc7b206a7c052297acf9ac304ae7de9d61a2475a116959c1524fc

SHA512
e18c40d646fa4948f90f7471da55489df431f255041ebb6dcef86346f91078c9b27894e27216a4b2fe2a1c5e501c7953c77893cf696930123d28a322d49e1516

Download Submit
C:\Users\Admin\AppData\Local\Temp\~3609580389694621222\Office.txt

Filesize
111KB

MD5
52a1fc2e368b7367f762959a594fd94e

SHA1
3718fcd1679443258d472b0ef8b18b2ac00ff916

SHA256
52bea881a027370e60282ec9af9e4dde33ba723ca1b6236019e32c87deeb438e

SHA512
50944c91beeedecbd48ddab847332cd20a804197cd3afdeab1b9f340224be11df770d7a82b5ded1790d945f23c24c0abc21b74585586af274b73ba4f2dc01378

Download Submit
C:\Users\Admin\AppData\Local\Temp\~3609580389694621222\msedge_elf.dll

Filesize
26KB

MD5
457f1e9754479c07bfa7925fd743bdfa

SHA1
d2c99cca4749da75f5b3dd624943e425205f3828

SHA256
2fa643f7c1a47a1c9423d4602e32bed58aa7adf1a40ee112e0ce8c7767f438c2

SHA512
11b781260b8a76624663053723789c346e97248e5bc0db1a425a73ee5384ec6e78b25d8e95a28c4b2fd48e6b4ae06872e07fd8a47c2dd80224e606504ac65ab9

Download Submit
C:\Users\Admin\AppData\Local\Temp\~3609580389694621222\svchost.exe

Filesize
833KB

MD5
9a25c9f4ae1ae0206d0ac670fc26bfb0

SHA1
ab9e4e3c92a722d0ccec78a5843d99b29d5a65e5

SHA256
7e78f5183d1539b90445356a7069b0f610d9b8c69c2be228e5952fe807d1791b

SHA512
ed7c65b387f8a3aeb06a3e06ed6444a928bdaff816391220a633dbbc18b6d8db65e86889ed1ba9e48d8e88dbb3cae4867a7c3a1ff12f473f36f03639a5b711d1

Download Submit
memory/2204-0-0x0000000000400000-0x000000000055F000-memory.dmp

Filesize
1.4MB

Download
memory/2320-21-0x0000000074E60000-0x0000000075610000-memory.dmp

Filesize
7.7MB

Download
memory/2320-20-0x0000000002960000-0x000000000297C000-memory.dmp

Filesize
112KB

Download
memory/2320-22-0x00000000054A0000-0x00000000054B8000-memory.dmp

Filesize
96KB

Download
memory/2320-23-0x0000000005DB0000-0x0000000006354000-memory.dmp

Filesize
5.6MB

Download
memory/2320-25-0x0000000077941000-0x0000000077942000-memory.dmp

Filesize
4KB

Download
memory/2320-26-0x0000000005CB0000-0x0000000005D42000-memory.dmp

Filesize
584KB

Download
memory/2320-27-0x0000000005C90000-0x0000000005C9A000-memory.dmp

Filesize
40KB

Download
memory/2320-28-0x0000000074E60000-0x0000000075610000-memory.dmp

Filesize
7.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads