asyncrat | 2799308c4b285f662d2954b3d9900951d74ae0cdde04b80ff865221817103f3b

General

Target

2799308c4b285f662d2954b3d9900951d74ae0cdde04b80ff865221817103f3b.exe
Size

649KB
MD5

b9a42052c81229de87b90370c7e8ef56
SHA1

8253ef8fe65f68ea7e0cc11bcdc06ec91c8d3290
SHA256

2799308c4b285f662d2954b3d9900951d74ae0cdde04b80ff865221817103f3b
SHA512

0e6a1b3d66c2401f8b8d5f8b2cae7d4912fa73565faf4c21686caa63a0d81eda952d6070edb57e7577c15c896caff3e52a6671713cfaa13ed21bab7accb86755
SSDEEP

12288:tOSF/ZdMP5WlYj6Fs/HI6C96D7cyTZ33a33S333333dkS9Jy9:tLrMPkDFB6+2NkeO

Score

10^/10

asyncrat purelogstealer default persistence rat stealer

Malware Config

Extracted

Family

asyncrat

Version

Venom RAT + HVNC + Stealer + Grabber v6.0.2

Botnet

Default

C2

5.182.87.154:4449

Mutex

jiqsvporltpvroy

Attributes

delay
1
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
PureLog Stealer
PureLog Stealer is an infostealer written in C#.
stealer purelogstealer

PureLog Stealer payload 1 IoCs

resource	yara_rule
behavioral2/memory/3004-1-0x00000243D2090000-0x00000243D20DC000-memory.dmp	family_purelog_stealer

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-160263616-143223877-1356318919-1000\Software\Microsoft\Windows\CurrentVersion\Run\Dzodxh = "C:\\Users\\Admin\\AppData\\Roaming\\Dzodxh.exe"	2799308c4b285f662d2954b3d9900951d74ae0cdde04b80ff865221817103f3b.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3004 set thread context of 932	3004	2799308c4b285f662d2954b3d9900951d74ae0cdde04b80ff865221817103f3b.exe	80

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
932	2799308c4b285f662d2954b3d9900951d74ae0cdde04b80ff865221817103f3b.exe
932	2799308c4b285f662d2954b3d9900951d74ae0cdde04b80ff865221817103f3b.exe
932	2799308c4b285f662d2954b3d9900951d74ae0cdde04b80ff865221817103f3b.exe
932	2799308c4b285f662d2954b3d9900951d74ae0cdde04b80ff865221817103f3b.exe
932	2799308c4b285f662d2954b3d9900951d74ae0cdde04b80ff865221817103f3b.exe
932	2799308c4b285f662d2954b3d9900951d74ae0cdde04b80ff865221817103f3b.exe
932	2799308c4b285f662d2954b3d9900951d74ae0cdde04b80ff865221817103f3b.exe
932	2799308c4b285f662d2954b3d9900951d74ae0cdde04b80ff865221817103f3b.exe
932	2799308c4b285f662d2954b3d9900951d74ae0cdde04b80ff865221817103f3b.exe
932	2799308c4b285f662d2954b3d9900951d74ae0cdde04b80ff865221817103f3b.exe
932	2799308c4b285f662d2954b3d9900951d74ae0cdde04b80ff865221817103f3b.exe
932	2799308c4b285f662d2954b3d9900951d74ae0cdde04b80ff865221817103f3b.exe
932	2799308c4b285f662d2954b3d9900951d74ae0cdde04b80ff865221817103f3b.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3004	2799308c4b285f662d2954b3d9900951d74ae0cdde04b80ff865221817103f3b.exe
Token: SeDebugPrivilege	932	2799308c4b285f662d2954b3d9900951d74ae0cdde04b80ff865221817103f3b.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
932	2799308c4b285f662d2954b3d9900951d74ae0cdde04b80ff865221817103f3b.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3004 wrote to memory of 932	3004	2799308c4b285f662d2954b3d9900951d74ae0cdde04b80ff865221817103f3b.exe	80
PID 3004 wrote to memory of 932	3004	2799308c4b285f662d2954b3d9900951d74ae0cdde04b80ff865221817103f3b.exe	80
PID 3004 wrote to memory of 932	3004	2799308c4b285f662d2954b3d9900951d74ae0cdde04b80ff865221817103f3b.exe	80
PID 3004 wrote to memory of 932	3004	2799308c4b285f662d2954b3d9900951d74ae0cdde04b80ff865221817103f3b.exe	80
PID 3004 wrote to memory of 932	3004	2799308c4b285f662d2954b3d9900951d74ae0cdde04b80ff865221817103f3b.exe	80
PID 3004 wrote to memory of 932	3004	2799308c4b285f662d2954b3d9900951d74ae0cdde04b80ff865221817103f3b.exe	80

C:\Users\Admin\AppData\Local\Temp\2799308c4b285f662d2954b3d9900951d74ae0cdde04b80ff865221817103f3b.exe
"C:\Users\Admin\AppData\Local\Temp\2799308c4b285f662d2954b3d9900951d74ae0cdde04b80ff865221817103f3b.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3004
- C:\Users\Admin\AppData\Local\Temp\2799308c4b285f662d2954b3d9900951d74ae0cdde04b80ff865221817103f3b.exe
  C:\Users\Admin\AppData\Local\Temp\2799308c4b285f662d2954b3d9900951d74ae0cdde04b80ff865221817103f3b.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:932

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\2799308c4b285f662d2954b3d9900951d74ae0cdde04b80ff865221817103f3b.exe.log

Filesize
1KB

MD5
6766a7cc8b7039bf7f32b9e4a63b7f4d

SHA1
8eb95e170a3dc512589a12ec936989d7d3bb86e4

SHA256
14c0bf2c6febb71441fe2b1a04934a00d49aeee1bf2d9f21452cba57ade2fd0a

SHA512
636e1091399f101f8494936489fb605ae91d542639b4704d5f541a64dffb320960c676c730bca2a835ab70c9feed517b87efa9390f7cb06c73fde50d7a75d331

Download Submit
memory/932-15-0x00007FF8D49C0000-0x00007FF8D4BC9000-memory.dmp

Filesize
2.0MB

Download
memory/932-8-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/932-18-0x00007FF8D49C0000-0x00007FF8D4BC9000-memory.dmp

Filesize
2.0MB

Download
memory/932-17-0x00000244FDE50000-0x00000244FDE60000-memory.dmp

Filesize
64KB

Download
memory/932-16-0x00007FF8B3960000-0x00007FF8B4422000-memory.dmp

Filesize
10.8MB

Download
memory/932-14-0x00000244FDE50000-0x00000244FDE60000-memory.dmp

Filesize
64KB

Download
memory/932-12-0x00007FF8B3960000-0x00007FF8B4422000-memory.dmp

Filesize
10.8MB

Download
memory/3004-5-0x00000243D2150000-0x00000243D2160000-memory.dmp

Filesize
64KB

Download
memory/3004-11-0x00007FF8B3960000-0x00007FF8B4422000-memory.dmp

Filesize
10.8MB

Download
memory/3004-2-0x00000243D20E0000-0x00000243D2114000-memory.dmp

Filesize
208KB

Download
memory/3004-6-0x00000243EB2E0000-0x00000243EB32C000-memory.dmp

Filesize
304KB

Download
memory/3004-0-0x00000243D0270000-0x00000243D0318000-memory.dmp

Filesize
672KB

Download
memory/3004-1-0x00000243D2090000-0x00000243D20DC000-memory.dmp

Filesize
304KB

Download
memory/3004-4-0x00000243D2160000-0x00000243D2194000-memory.dmp

Filesize
208KB

Download
memory/3004-3-0x00007FF8B3960000-0x00007FF8B4422000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads