asyncrat | c6f12f257c2f60ae52265ebc64e97b60662c89ec70bb1c5276365ca69218043a

General

Target

1744-69-0x0000000008FF0000-0x0000000009006000-memory.exe
Size

88KB
MD5

432629bf35ba0002c9521e92a3d74a45
SHA1

9f084badb89a311dfa4482613d87602fc86b3491
SHA256

c6f12f257c2f60ae52265ebc64e97b60662c89ec70bb1c5276365ca69218043a
SHA512

01c16779932c96051e4d2f98124ede3d2249478da52c0c229001318d81088a933d42ce18b8ed40a78fbd0573b56f6447bcce40957587edf170b4a58ad613cbe0
SSDEEP

1536:CZyvHdF4s6OJaGr1eeiIVrGbbXwIHxen1GeDpqKmY7:CZyvHdF4s6ONrIeXGbbX3qgz

Score

10^/10

asyncrat venom clients rat

Malware Config

Extracted

Family

asyncrat

Version

5.0.5

Botnet

Venom Clients

C2

127.0.0.1:4489

Mutex

Venom_RAT_HVNC_Mutex_Venom RAT_HVNC

Attributes

delay
1
install
true
install_file
se.exe
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral1/files/0x000c000000012320-16.dat	family_asyncrat

Executes dropped EXE 1 IoCs

pid	Process
2748	se.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2724	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
2604	timeout.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2204	1744-69-0x0000000008FF0000-0x0000000009006000-memory.exe
2204	1744-69-0x0000000008FF0000-0x0000000009006000-memory.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2204	1744-69-0x0000000008FF0000-0x0000000009006000-memory.exe
Token: SeDebugPrivilege	2748	se.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 2204 wrote to memory of 2052	2204	1744-69-0x0000000008FF0000-0x0000000009006000-memory.exe	28
PID 2204 wrote to memory of 2052	2204	1744-69-0x0000000008FF0000-0x0000000009006000-memory.exe	28
PID 2204 wrote to memory of 2052	2204	1744-69-0x0000000008FF0000-0x0000000009006000-memory.exe	28
PID 2204 wrote to memory of 2628	2204	1744-69-0x0000000008FF0000-0x0000000009006000-memory.exe	30
PID 2204 wrote to memory of 2628	2204	1744-69-0x0000000008FF0000-0x0000000009006000-memory.exe	30
PID 2204 wrote to memory of 2628	2204	1744-69-0x0000000008FF0000-0x0000000009006000-memory.exe	30
PID 2052 wrote to memory of 2724	2052	cmd.exe	32
PID 2052 wrote to memory of 2724	2052	cmd.exe	32
PID 2052 wrote to memory of 2724	2052	cmd.exe	32
PID 2628 wrote to memory of 2604	2628	cmd.exe	33
PID 2628 wrote to memory of 2604	2628	cmd.exe	33
PID 2628 wrote to memory of 2604	2628	cmd.exe	33
PID 2628 wrote to memory of 2748	2628	cmd.exe	34
PID 2628 wrote to memory of 2748	2628	cmd.exe	34
PID 2628 wrote to memory of 2748	2628	cmd.exe	34

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\1744-69-0x0000000008FF0000-0x0000000009006000-memory.exe
"C:\Users\Admin\AppData\Local\Temp\1744-69-0x0000000008FF0000-0x0000000009006000-memory.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2204
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "se" /tr '"C:\Users\Admin\AppData\Roaming\se.exe"' & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2052
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc onlogon /rl highest /tn "se" /tr '"C:\Users\Admin\AppData\Roaming\se.exe"'
    3⤵
    - Creates scheduled task(s)
    PID:2724
- C:\Windows\system32\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp1564.tmp.bat""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2628
- - C:\Windows\system32\timeout.exe
    timeout 3
    3⤵
    - Delays execution with timeout.exe
    PID:2604
- - C:\Users\Admin\AppData\Roaming\se.exe
    "C:\Users\Admin\AppData\Roaming\se.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:2748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp1564.tmp.bat

Filesize
146B

MD5
4297d8b9e45028d3a06d745ddc13723e

SHA1
b4066ca0fc03f7f737db6f5c31ddd50538048fe8

SHA256
1544d40c1ce757c6e100bdc00cba5726993801b928a6055b8b2a6809d54ca7cc

SHA512
56b2f1e2bdcfbf31ef3cbfd00e5f9a31536e0ceabf7d41d423550c3a6ecae977461af9a7b147ed2b15a30670bbb125a74f855595131e308261ef6d45bf80d1dd

Download Submit
C:\Users\Admin\AppData\Roaming\se.exe

Filesize
88KB

MD5
432629bf35ba0002c9521e92a3d74a45

SHA1
9f084badb89a311dfa4482613d87602fc86b3491

SHA256
c6f12f257c2f60ae52265ebc64e97b60662c89ec70bb1c5276365ca69218043a

SHA512
01c16779932c96051e4d2f98124ede3d2249478da52c0c229001318d81088a933d42ce18b8ed40a78fbd0573b56f6447bcce40957587edf170b4a58ad613cbe0

Download Submit
memory/2204-13-0x000007FEF56B0000-0x000007FEF609C000-memory.dmp

Filesize
9.9MB

Download
memory/2204-3-0x0000000077070000-0x0000000077219000-memory.dmp

Filesize
1.7MB

Download
memory/2204-2-0x0000000002090000-0x0000000002110000-memory.dmp

Filesize
512KB

Download
memory/2204-14-0x0000000077070000-0x0000000077219000-memory.dmp

Filesize
1.7MB

Download
memory/2204-0-0x0000000000A10000-0x0000000000A26000-memory.dmp

Filesize
88KB

Download
memory/2204-1-0x000007FEF56B0000-0x000007FEF609C000-memory.dmp

Filesize
9.9MB

Download
memory/2748-18-0x0000000000150000-0x0000000000166000-memory.dmp

Filesize
88KB

Download
memory/2748-19-0x000007FEF4CC0000-0x000007FEF56AC000-memory.dmp

Filesize
9.9MB

Download
memory/2748-20-0x000000001AB80000-0x000000001AC00000-memory.dmp

Filesize
512KB

Download
memory/2748-21-0x0000000077070000-0x0000000077219000-memory.dmp

Filesize
1.7MB

Download
memory/2748-22-0x000007FEF4CC0000-0x000007FEF56AC000-memory.dmp

Filesize
9.9MB

Download
memory/2748-23-0x0000000077070000-0x0000000077219000-memory.dmp

Filesize
1.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads