asyncrat | 2799308c4b285f662d2954b3d9900951d74ae0cdde04b80ff865221817103f3b

General

Target

2799308c4b285f662d2954b3d9900951d74ae0cdde04b80ff865221817103f3b.exe
Size

649KB
MD5

b9a42052c81229de87b90370c7e8ef56
SHA1

8253ef8fe65f68ea7e0cc11bcdc06ec91c8d3290
SHA256

2799308c4b285f662d2954b3d9900951d74ae0cdde04b80ff865221817103f3b
SHA512

0e6a1b3d66c2401f8b8d5f8b2cae7d4912fa73565faf4c21686caa63a0d81eda952d6070edb57e7577c15c896caff3e52a6671713cfaa13ed21bab7accb86755
SSDEEP

12288:tOSF/ZdMP5WlYj6Fs/HI6C96D7cyTZ33a33S333333dkS9Jy9:tLrMPkDFB6+2NkeO

Score

10^/10

asyncrat purelogstealer default persistence rat stealer

Malware Config

Extracted

Family

asyncrat

Version

Venom RAT + HVNC + Stealer + Grabber v6.0.2

Botnet

Default

C2

5.182.87.154:4449

Mutex

jiqsvporltpvroy

Attributes

delay
1
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
PureLog Stealer
PureLog Stealer is an infostealer written in C#.
stealer purelogstealer

PureLog Stealer payload 2 IoCs

resource	yara_rule
behavioral1/memory/2796-1-0x00000000002C0000-0x000000000030C000-memory.dmp	family_purelog_stealer
behavioral1/memory/2796-3-0x000000001AE30000-0x000000001AEB0000-memory.dmp	family_purelog_stealer

Detects executables attemping to enumerate video devices using WMI 2 IoCs

resource	yara_rule
behavioral1/memory/2216-12-0x0000000000400000-0x0000000000416000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice
behavioral1/memory/2216-16-0x0000000000400000-0x0000000000416000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice

Detects executables packed with SmartAssembly 1 IoCs

resource	yara_rule
behavioral1/memory/2796-1-0x00000000002C0000-0x000000000030C000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\Dzodxh = "C:\\Users\\Admin\\AppData\\Roaming\\Dzodxh.exe"	2799308c4b285f662d2954b3d9900951d74ae0cdde04b80ff865221817103f3b.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2796 set thread context of 2216	2796	2799308c4b285f662d2954b3d9900951d74ae0cdde04b80ff865221817103f3b.exe	28

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2796	2799308c4b285f662d2954b3d9900951d74ae0cdde04b80ff865221817103f3b.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2796 wrote to memory of 2216	2796	2799308c4b285f662d2954b3d9900951d74ae0cdde04b80ff865221817103f3b.exe	28
PID 2796 wrote to memory of 2216	2796	2799308c4b285f662d2954b3d9900951d74ae0cdde04b80ff865221817103f3b.exe	28
PID 2796 wrote to memory of 2216	2796	2799308c4b285f662d2954b3d9900951d74ae0cdde04b80ff865221817103f3b.exe	28
PID 2796 wrote to memory of 2216	2796	2799308c4b285f662d2954b3d9900951d74ae0cdde04b80ff865221817103f3b.exe	28
PID 2796 wrote to memory of 2216	2796	2799308c4b285f662d2954b3d9900951d74ae0cdde04b80ff865221817103f3b.exe	28
PID 2796 wrote to memory of 2216	2796	2799308c4b285f662d2954b3d9900951d74ae0cdde04b80ff865221817103f3b.exe	28
PID 2796 wrote to memory of 2216	2796	2799308c4b285f662d2954b3d9900951d74ae0cdde04b80ff865221817103f3b.exe	28

C:\Users\Admin\AppData\Local\Temp\2799308c4b285f662d2954b3d9900951d74ae0cdde04b80ff865221817103f3b.exe
"C:\Users\Admin\AppData\Local\Temp\2799308c4b285f662d2954b3d9900951d74ae0cdde04b80ff865221817103f3b.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2796
- C:\Users\Admin\AppData\Local\Temp\2799308c4b285f662d2954b3d9900951d74ae0cdde04b80ff865221817103f3b.exe
  C:\Users\Admin\AppData\Local\Temp\2799308c4b285f662d2954b3d9900951d74ae0cdde04b80ff865221817103f3b.exe
  2⤵
  PID:2216

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2216-8-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/2216-22-0x000007FEF4E40000-0x000007FEF582C000-memory.dmp

Filesize
9.9MB

Download
memory/2216-16-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/2216-14-0x000007FFFFFDF000-0x000007FFFFFE0000-memory.dmp

Filesize
4KB

Download
memory/2216-12-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/2216-10-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/2796-3-0x000000001AE30000-0x000000001AEB0000-memory.dmp

Filesize
512KB

Download
memory/2796-6-0x0000000000460000-0x00000000004AC000-memory.dmp

Filesize
304KB

Download
memory/2796-5-0x0000000000360000-0x0000000000394000-memory.dmp

Filesize
208KB

Download
memory/2796-4-0x0000000000330000-0x0000000000364000-memory.dmp

Filesize
208KB

Download
memory/2796-0-0x00000000003B0000-0x0000000000458000-memory.dmp

Filesize
672KB

Download
memory/2796-18-0x000007FEF5830000-0x000007FEF621C000-memory.dmp

Filesize
9.9MB

Download
memory/2796-1-0x00000000002C0000-0x000000000030C000-memory.dmp

Filesize
304KB

Download
memory/2796-2-0x000007FEF5830000-0x000007FEF621C000-memory.dmp

Filesize
9.9MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads