asyncrat | c817c175070f5d501ac185291f2958735fe806b01f5772793907385990c220a4

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
27/03/2024, 12:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c817c175070f5d501ac185291f2958735fe806b01f5772793907385990c220a4.exe
Size 212KB
Sample240327-pt5ymacb72
SHA256 c817c175070f5d501ac185291f2958735fe806b01f5772793907385990c220a4
MD5 c61fe6e77660e4c4849127930b2e971c
SHA1 965763a1be92900f0292fe4c0ef99de91499376f
SHA512 8f24edc224b97ed06f907593a539a30d997d04e797e14f981c3e9e06e10738d294d6505da1c11e6b0554bc665cd7a41147412ba392b6855cedba053fc85951b0
SSDEEP 1536:9uGFuTQaI28ifQ3OnbTlrktI66YAEzZdt5mCV89jj9fUkPlg:9uGkTQaI21fQ3OnbTlr5nYAaN81vlg
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

asyncrat default rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

tech22.ddns.net:9119

Mutex

6Z78JEoSSfQX

Attributes

delay
3
install
true
install_file
system-update.exe
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral2/files/0x000600000002a72f-11.dat	family_asyncrat

Executes dropped EXE 1 IoCs

pid	Process
4824	system-update.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2352	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
4932	timeout.exe

Suspicious behavior: EnumeratesProcesses 15 IoCs

pid	Process
4276	c817c175070f5d501ac185291f2958735fe806b01f5772793907385990c220a4.exe
4276	c817c175070f5d501ac185291f2958735fe806b01f5772793907385990c220a4.exe
4276	c817c175070f5d501ac185291f2958735fe806b01f5772793907385990c220a4.exe
4276	c817c175070f5d501ac185291f2958735fe806b01f5772793907385990c220a4.exe
4276	c817c175070f5d501ac185291f2958735fe806b01f5772793907385990c220a4.exe
4276	c817c175070f5d501ac185291f2958735fe806b01f5772793907385990c220a4.exe
4276	c817c175070f5d501ac185291f2958735fe806b01f5772793907385990c220a4.exe
4276	c817c175070f5d501ac185291f2958735fe806b01f5772793907385990c220a4.exe
4276	c817c175070f5d501ac185291f2958735fe806b01f5772793907385990c220a4.exe
4276	c817c175070f5d501ac185291f2958735fe806b01f5772793907385990c220a4.exe
4276	c817c175070f5d501ac185291f2958735fe806b01f5772793907385990c220a4.exe
4276	c817c175070f5d501ac185291f2958735fe806b01f5772793907385990c220a4.exe
4276	c817c175070f5d501ac185291f2958735fe806b01f5772793907385990c220a4.exe
4276	c817c175070f5d501ac185291f2958735fe806b01f5772793907385990c220a4.exe
4276	c817c175070f5d501ac185291f2958735fe806b01f5772793907385990c220a4.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4276	c817c175070f5d501ac185291f2958735fe806b01f5772793907385990c220a4.exe
Token: SeDebugPrivilege	4824	system-update.exe
Token: SeDebugPrivilege	4824	system-update.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 4276 wrote to memory of 3092	4276	c817c175070f5d501ac185291f2958735fe806b01f5772793907385990c220a4.exe	76
PID 4276 wrote to memory of 3092	4276	c817c175070f5d501ac185291f2958735fe806b01f5772793907385990c220a4.exe	76
PID 4276 wrote to memory of 3092	4276	c817c175070f5d501ac185291f2958735fe806b01f5772793907385990c220a4.exe	76
PID 4276 wrote to memory of 3336	4276	c817c175070f5d501ac185291f2958735fe806b01f5772793907385990c220a4.exe	78
PID 4276 wrote to memory of 3336	4276	c817c175070f5d501ac185291f2958735fe806b01f5772793907385990c220a4.exe	78
PID 4276 wrote to memory of 3336	4276	c817c175070f5d501ac185291f2958735fe806b01f5772793907385990c220a4.exe	78
PID 3336 wrote to memory of 4932	3336	cmd.exe	80
PID 3336 wrote to memory of 4932	3336	cmd.exe	80
PID 3336 wrote to memory of 4932	3336	cmd.exe	80
PID 3092 wrote to memory of 2352	3092	cmd.exe	81
PID 3092 wrote to memory of 2352	3092	cmd.exe	81
PID 3092 wrote to memory of 2352	3092	cmd.exe	81
PID 3336 wrote to memory of 4824	3336	cmd.exe	82
PID 3336 wrote to memory of 4824	3336	cmd.exe	82
PID 3336 wrote to memory of 4824	3336	cmd.exe	82

C:\Users\Admin\AppData\Local\Temp\c817c175070f5d501ac185291f2958735fe806b01f5772793907385990c220a4.exe
"C:\Users\Admin\AppData\Local\Temp\c817c175070f5d501ac185291f2958735fe806b01f5772793907385990c220a4.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4276
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "system-update" /tr '"C:\Users\Admin\AppData\Roaming\system-update.exe"' & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3092
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /f /sc onlogon /rl highest /tn "system-update" /tr '"C:\Users\Admin\AppData\Roaming\system-update.exe"'
    3⤵
    - Creates scheduled task(s)
    PID:2352
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp7F32.tmp.bat""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3336
- - C:\Windows\SysWOW64\timeout.exe
    timeout 3
    3⤵
    - Delays execution with timeout.exe
    PID:4932
- - C:\Users\Admin\AppData\Roaming\system-update.exe
    "C:\Users\Admin\AppData\Roaming\system-update.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:4824

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmp7F32.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmp7F32.tmp.bat
Size 157B
SHA256 70ee4c04f17fc10a64aab2de1ac29856de402cd757fe39e4e10ddef54f936259
MD5 1c4ebdf03241b47e6e1c49cc6ad1fa96
SHA1 19394ae8ef71027f98a7914d64abab96f7700f77
SHA512 557ac4cb1695d045007c73dfd1110164483592cfd6f71d2f0500eab5732c5c826c725a3ab5f7a7ff984d86d9bea54d8e2610d8fa700cae63267f0526bc41b020
MD5 SHA1 SHA512

Submit Download

system-update.exe

Path C:\Users\Admin\AppData\Roaming\system-update.exe
Size 212KB
SHA256 c817c175070f5d501ac185291f2958735fe806b01f5772793907385990c220a4
MD5 c61fe6e77660e4c4849127930b2e971c
SHA1 965763a1be92900f0292fe4c0ef99de91499376f
SHA512 8f24edc224b97ed06f907593a539a30d997d04e797e14f981c3e9e06e10738d294d6505da1c11e6b0554bc665cd7a41147412ba392b6855cedba053fc85951b0
SSDEEP 1536:9uGFuTQaI28ifQ3OnbTlrktI66YAEzZdt5mCV89jj9fUkPlg:9uGkTQaI21fQ3OnbTlr5nYAaN81vlg
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4276-0-0x00000000002E0000-0x000000000031A000-memory.dmp

Download

memory/4276-1-0x00000000749D0000-0x0000000075181000-memory.dmp

Download

memory/4276-2-0x0000000004BD0000-0x0000000004BE0000-memory.dmp

Download

memory/4276-3-0x0000000004C80000-0x0000000004D1C000-memory.dmp

Download

memory/4276-8-0x00000000749D0000-0x0000000075181000-memory.dmp

Download

memory/4824-13-0x0000000074930000-0x00000000750E1000-memory.dmp

Download

memory/4824-14-0x0000000002690000-0x00000000026A0000-memory.dmp

Download

memory/4824-15-0x0000000074930000-0x00000000750E1000-memory.dmp

Download

memory/4824-16-0x0000000002690000-0x00000000026A0000-memory.dmp

Download