asyncrat | 2799308c4b285f662d2954b3d9900951d74ae0cdde04b80ff865221817103f3b

General

Target

2799308c4b285f662d2954b3d9900951d74ae0cdde04b80ff865221817103f3b.exe
Size

649KB
MD5

b9a42052c81229de87b90370c7e8ef56
SHA1

8253ef8fe65f68ea7e0cc11bcdc06ec91c8d3290
SHA256

2799308c4b285f662d2954b3d9900951d74ae0cdde04b80ff865221817103f3b
SHA512

0e6a1b3d66c2401f8b8d5f8b2cae7d4912fa73565faf4c21686caa63a0d81eda952d6070edb57e7577c15c896caff3e52a6671713cfaa13ed21bab7accb86755
SSDEEP

12288:tOSF/ZdMP5WlYj6Fs/HI6C96D7cyTZ33a33S333333dkS9Jy9:tLrMPkDFB6+2NkeO

Score

10^/10

asyncrat purelogstealer default persistence rat stealer

Malware Config

Extracted

Family

asyncrat

Version

Venom RAT + HVNC + Stealer + Grabber v6.0.2

Botnet

Default

C2

5.182.87.154:4449

Mutex

jiqsvporltpvroy

Attributes

delay
1
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
PureLog Stealer
PureLog Stealer is an infostealer written in C#.
stealer purelogstealer

PureLog Stealer payload 1 IoCs

resource	yara_rule
behavioral1/memory/1848-1-0x00000172E9AE0000-0x00000172E9B2C000-memory.dmp	family_purelog_stealer

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Dzodxh = "C:\\Users\\Admin\\AppData\\Roaming\\Dzodxh.exe"	2799308c4b285f662d2954b3d9900951d74ae0cdde04b80ff865221817103f3b.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1848 set thread context of 4284	1848	2799308c4b285f662d2954b3d9900951d74ae0cdde04b80ff865221817103f3b.exe	88

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
4284	2799308c4b285f662d2954b3d9900951d74ae0cdde04b80ff865221817103f3b.exe
4284	2799308c4b285f662d2954b3d9900951d74ae0cdde04b80ff865221817103f3b.exe
4284	2799308c4b285f662d2954b3d9900951d74ae0cdde04b80ff865221817103f3b.exe
4284	2799308c4b285f662d2954b3d9900951d74ae0cdde04b80ff865221817103f3b.exe
4284	2799308c4b285f662d2954b3d9900951d74ae0cdde04b80ff865221817103f3b.exe
4284	2799308c4b285f662d2954b3d9900951d74ae0cdde04b80ff865221817103f3b.exe
4284	2799308c4b285f662d2954b3d9900951d74ae0cdde04b80ff865221817103f3b.exe
4284	2799308c4b285f662d2954b3d9900951d74ae0cdde04b80ff865221817103f3b.exe
4284	2799308c4b285f662d2954b3d9900951d74ae0cdde04b80ff865221817103f3b.exe
4284	2799308c4b285f662d2954b3d9900951d74ae0cdde04b80ff865221817103f3b.exe
4284	2799308c4b285f662d2954b3d9900951d74ae0cdde04b80ff865221817103f3b.exe
4284	2799308c4b285f662d2954b3d9900951d74ae0cdde04b80ff865221817103f3b.exe
4284	2799308c4b285f662d2954b3d9900951d74ae0cdde04b80ff865221817103f3b.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1848	2799308c4b285f662d2954b3d9900951d74ae0cdde04b80ff865221817103f3b.exe
Token: SeDebugPrivilege	4284	2799308c4b285f662d2954b3d9900951d74ae0cdde04b80ff865221817103f3b.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4284	2799308c4b285f662d2954b3d9900951d74ae0cdde04b80ff865221817103f3b.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1848 wrote to memory of 4284	1848	2799308c4b285f662d2954b3d9900951d74ae0cdde04b80ff865221817103f3b.exe	88
PID 1848 wrote to memory of 4284	1848	2799308c4b285f662d2954b3d9900951d74ae0cdde04b80ff865221817103f3b.exe	88
PID 1848 wrote to memory of 4284	1848	2799308c4b285f662d2954b3d9900951d74ae0cdde04b80ff865221817103f3b.exe	88
PID 1848 wrote to memory of 4284	1848	2799308c4b285f662d2954b3d9900951d74ae0cdde04b80ff865221817103f3b.exe	88
PID 1848 wrote to memory of 4284	1848	2799308c4b285f662d2954b3d9900951d74ae0cdde04b80ff865221817103f3b.exe	88
PID 1848 wrote to memory of 4284	1848	2799308c4b285f662d2954b3d9900951d74ae0cdde04b80ff865221817103f3b.exe	88

C:\Users\Admin\AppData\Local\Temp\2799308c4b285f662d2954b3d9900951d74ae0cdde04b80ff865221817103f3b.exe
"C:\Users\Admin\AppData\Local\Temp\2799308c4b285f662d2954b3d9900951d74ae0cdde04b80ff865221817103f3b.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1848
- C:\Users\Admin\AppData\Local\Temp\2799308c4b285f662d2954b3d9900951d74ae0cdde04b80ff865221817103f3b.exe
  C:\Users\Admin\AppData\Local\Temp\2799308c4b285f662d2954b3d9900951d74ae0cdde04b80ff865221817103f3b.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:4284

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\2799308c4b285f662d2954b3d9900951d74ae0cdde04b80ff865221817103f3b.exe.log

Filesize
1KB

MD5
9f5d0107d96d176b1ffcd5c7e7a42dc9

SHA1
de83788e2f18629555c42a3e6fada12f70457141

SHA256
d0630b8466cebaaf92533826f6547b6f36a3c480848dc38d650acd52b522a097

SHA512
86cfaa3327b59a976ddd4a5915f3fe8c938481344fcbd10e7533b4c5003673d078756e62435940471658a03504c3bc30603204d6a133727a3f36c96d08714c61

Download Submit
memory/1848-3-0x00007FF962FE0000-0x00007FF963AA1000-memory.dmp

Filesize
10.8MB

Download
memory/1848-0-0x00000172E9690000-0x00000172E9738000-memory.dmp

Filesize
672KB

Download
memory/1848-4-0x00000172E9BA0000-0x00000172E9BD4000-memory.dmp

Filesize
208KB

Download
memory/1848-6-0x00000172EBC20000-0x00000172EBC6C000-memory.dmp

Filesize
304KB

Download
memory/1848-5-0x00000172E9BD0000-0x00000172E9BE0000-memory.dmp

Filesize
64KB

Download
memory/1848-1-0x00000172E9AE0000-0x00000172E9B2C000-memory.dmp

Filesize
304KB

Download
memory/1848-2-0x00000172E9B70000-0x00000172E9BA4000-memory.dmp

Filesize
208KB

Download
memory/1848-11-0x00007FF962FE0000-0x00007FF963AA1000-memory.dmp

Filesize
10.8MB

Download
memory/4284-8-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/4284-12-0x00007FF962FE0000-0x00007FF963AA1000-memory.dmp

Filesize
10.8MB

Download
memory/4284-14-0x0000014F4F9A0000-0x0000014F4F9B0000-memory.dmp

Filesize
64KB

Download
memory/4284-15-0x00007FF962FE0000-0x00007FF963AA1000-memory.dmp

Filesize
10.8MB

Download
memory/4284-16-0x0000014F4F9A0000-0x0000014F4F9B0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads