asyncrat | 2799308c4b285f662d2954b3d9900951d74ae0cdde04b80ff865221817103f3b

General

Target

2799308c4b285f662d2954b3d9900951d74ae0cdde04b80ff865221817103f3b.exe
Size

649KB
MD5

b9a42052c81229de87b90370c7e8ef56
SHA1

8253ef8fe65f68ea7e0cc11bcdc06ec91c8d3290
SHA256

2799308c4b285f662d2954b3d9900951d74ae0cdde04b80ff865221817103f3b
SHA512

0e6a1b3d66c2401f8b8d5f8b2cae7d4912fa73565faf4c21686caa63a0d81eda952d6070edb57e7577c15c896caff3e52a6671713cfaa13ed21bab7accb86755
SSDEEP

12288:tOSF/ZdMP5WlYj6Fs/HI6C96D7cyTZ33a33S333333dkS9Jy9:tLrMPkDFB6+2NkeO

Score

10^/10

asyncrat purelogstealer default persistence rat stealer

Malware Config

Extracted

Family

asyncrat

Version

Venom RAT + HVNC + Stealer + Grabber v6.0.2

Botnet

Default

C2

5.182.87.154:4449

Mutex

jiqsvporltpvroy

Attributes

delay
1
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
PureLog Stealer
PureLog Stealer is an infostealer written in C#.
stealer purelogstealer

PureLog Stealer payload 1 IoCs

resource	yara_rule
behavioral2/memory/4280-1-0x000001BF17170000-0x000001BF171BC000-memory.dmp	family_purelog_stealer

Detects executables attemping to enumerate video devices using WMI 1 IoCs

resource	yara_rule
behavioral2/memory/2580-8-0x0000000000400000-0x0000000000416000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice

Detects executables packed with SmartAssembly 1 IoCs

resource	yara_rule
behavioral2/memory/4280-1-0x000001BF17170000-0x000001BF171BC000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Dzodxh = "C:\\Users\\Admin\\AppData\\Roaming\\Dzodxh.exe"	2799308c4b285f662d2954b3d9900951d74ae0cdde04b80ff865221817103f3b.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4280 set thread context of 2580	4280	2799308c4b285f662d2954b3d9900951d74ae0cdde04b80ff865221817103f3b.exe	88

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
2580	2799308c4b285f662d2954b3d9900951d74ae0cdde04b80ff865221817103f3b.exe
2580	2799308c4b285f662d2954b3d9900951d74ae0cdde04b80ff865221817103f3b.exe
2580	2799308c4b285f662d2954b3d9900951d74ae0cdde04b80ff865221817103f3b.exe
2580	2799308c4b285f662d2954b3d9900951d74ae0cdde04b80ff865221817103f3b.exe
2580	2799308c4b285f662d2954b3d9900951d74ae0cdde04b80ff865221817103f3b.exe
2580	2799308c4b285f662d2954b3d9900951d74ae0cdde04b80ff865221817103f3b.exe
2580	2799308c4b285f662d2954b3d9900951d74ae0cdde04b80ff865221817103f3b.exe
2580	2799308c4b285f662d2954b3d9900951d74ae0cdde04b80ff865221817103f3b.exe
2580	2799308c4b285f662d2954b3d9900951d74ae0cdde04b80ff865221817103f3b.exe
2580	2799308c4b285f662d2954b3d9900951d74ae0cdde04b80ff865221817103f3b.exe
2580	2799308c4b285f662d2954b3d9900951d74ae0cdde04b80ff865221817103f3b.exe
2580	2799308c4b285f662d2954b3d9900951d74ae0cdde04b80ff865221817103f3b.exe
2580	2799308c4b285f662d2954b3d9900951d74ae0cdde04b80ff865221817103f3b.exe
2580	2799308c4b285f662d2954b3d9900951d74ae0cdde04b80ff865221817103f3b.exe
2580	2799308c4b285f662d2954b3d9900951d74ae0cdde04b80ff865221817103f3b.exe
2580	2799308c4b285f662d2954b3d9900951d74ae0cdde04b80ff865221817103f3b.exe
2580	2799308c4b285f662d2954b3d9900951d74ae0cdde04b80ff865221817103f3b.exe
2580	2799308c4b285f662d2954b3d9900951d74ae0cdde04b80ff865221817103f3b.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4280	2799308c4b285f662d2954b3d9900951d74ae0cdde04b80ff865221817103f3b.exe
Token: SeDebugPrivilege	2580	2799308c4b285f662d2954b3d9900951d74ae0cdde04b80ff865221817103f3b.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2580	2799308c4b285f662d2954b3d9900951d74ae0cdde04b80ff865221817103f3b.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4280 wrote to memory of 2580	4280	2799308c4b285f662d2954b3d9900951d74ae0cdde04b80ff865221817103f3b.exe	88
PID 4280 wrote to memory of 2580	4280	2799308c4b285f662d2954b3d9900951d74ae0cdde04b80ff865221817103f3b.exe	88
PID 4280 wrote to memory of 2580	4280	2799308c4b285f662d2954b3d9900951d74ae0cdde04b80ff865221817103f3b.exe	88
PID 4280 wrote to memory of 2580	4280	2799308c4b285f662d2954b3d9900951d74ae0cdde04b80ff865221817103f3b.exe	88
PID 4280 wrote to memory of 2580	4280	2799308c4b285f662d2954b3d9900951d74ae0cdde04b80ff865221817103f3b.exe	88
PID 4280 wrote to memory of 2580	4280	2799308c4b285f662d2954b3d9900951d74ae0cdde04b80ff865221817103f3b.exe	88

C:\Users\Admin\AppData\Local\Temp\2799308c4b285f662d2954b3d9900951d74ae0cdde04b80ff865221817103f3b.exe
"C:\Users\Admin\AppData\Local\Temp\2799308c4b285f662d2954b3d9900951d74ae0cdde04b80ff865221817103f3b.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4280
- C:\Users\Admin\AppData\Local\Temp\2799308c4b285f662d2954b3d9900951d74ae0cdde04b80ff865221817103f3b.exe
  C:\Users\Admin\AppData\Local\Temp\2799308c4b285f662d2954b3d9900951d74ae0cdde04b80ff865221817103f3b.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2580

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\2799308c4b285f662d2954b3d9900951d74ae0cdde04b80ff865221817103f3b.exe.log

Filesize
1KB

MD5
9f5d0107d96d176b1ffcd5c7e7a42dc9

SHA1
de83788e2f18629555c42a3e6fada12f70457141

SHA256
d0630b8466cebaaf92533826f6547b6f36a3c480848dc38d650acd52b522a097

SHA512
86cfaa3327b59a976ddd4a5915f3fe8c938481344fcbd10e7533b4c5003673d078756e62435940471658a03504c3bc30603204d6a133727a3f36c96d08714c61

Download Submit
memory/2580-8-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/2580-16-0x0000018407680000-0x0000018407690000-memory.dmp

Filesize
64KB

Download
memory/2580-15-0x00007FFE83B30000-0x00007FFE845F1000-memory.dmp

Filesize
10.8MB

Download
memory/2580-14-0x0000018407680000-0x0000018407690000-memory.dmp

Filesize
64KB

Download
memory/2580-13-0x00007FFE83B30000-0x00007FFE845F1000-memory.dmp

Filesize
10.8MB

Download
memory/4280-6-0x000001BF312C0000-0x000001BF3130C000-memory.dmp

Filesize
304KB

Download
memory/4280-0-0x000001BF16D00000-0x000001BF16DA8000-memory.dmp

Filesize
672KB

Download
memory/4280-5-0x000001BF31290000-0x000001BF312C4000-memory.dmp

Filesize
208KB

Download
memory/4280-12-0x00007FFE83B30000-0x00007FFE845F1000-memory.dmp

Filesize
10.8MB

Download
memory/4280-4-0x000001BF313B0000-0x000001BF313C0000-memory.dmp

Filesize
64KB

Download
memory/4280-3-0x00007FFE83B30000-0x00007FFE845F1000-memory.dmp

Filesize
10.8MB

Download
memory/4280-2-0x000001BF171E0000-0x000001BF17214000-memory.dmp

Filesize
208KB

Download
memory/4280-1-0x000001BF17170000-0x000001BF171BC000-memory.dmp

Filesize
304KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads