asyncrat | 1063342a4b01665860de63007e264aab2fc7e4399de6ce3d3146ff4ced1701e8

General

Target

e1b34d64a5765a02ae949b36ec895606.exe
Size

562KB
MD5

e1b34d64a5765a02ae949b36ec895606
SHA1

0e50f0f10b68149a78a1843d61b75a29930c4ddb
SHA256

1063342a4b01665860de63007e264aab2fc7e4399de6ce3d3146ff4ced1701e8
SHA512

cfe876bac1844c227de2619d09ed7deeecb20a5150affbc618152451b6728cdbca500a24025f1401038c88f74f8b2722741f077e61dc31805649635c1ff78741
SSDEEP

12288:9vRw11rKHESl9YELkhjXEIrsO5Cqt0w/2J8mZ4Ft:xIrKLKykjdUq0wC8me

Score

10^/10

asyncrat rat

Malware Config

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral2/files/0x000a0000000230e3-14.dat	family_asyncrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\Control Panel\International\Geo\Nation	e1b34d64a5765a02ae949b36ec895606.exe

Executes dropped EXE 1 IoCs

pid	Process
2744	Windows DeepSea.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
552	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
4496	timeout.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
1740	e1b34d64a5765a02ae949b36ec895606.exe
1740	e1b34d64a5765a02ae949b36ec895606.exe
1740	e1b34d64a5765a02ae949b36ec895606.exe
1740	e1b34d64a5765a02ae949b36ec895606.exe
1740	e1b34d64a5765a02ae949b36ec895606.exe
1740	e1b34d64a5765a02ae949b36ec895606.exe
1740	e1b34d64a5765a02ae949b36ec895606.exe
1740	e1b34d64a5765a02ae949b36ec895606.exe
1740	e1b34d64a5765a02ae949b36ec895606.exe
1740	e1b34d64a5765a02ae949b36ec895606.exe
1740	e1b34d64a5765a02ae949b36ec895606.exe
1740	e1b34d64a5765a02ae949b36ec895606.exe
1740	e1b34d64a5765a02ae949b36ec895606.exe
1740	e1b34d64a5765a02ae949b36ec895606.exe
1740	e1b34d64a5765a02ae949b36ec895606.exe
1740	e1b34d64a5765a02ae949b36ec895606.exe
1740	e1b34d64a5765a02ae949b36ec895606.exe
1740	e1b34d64a5765a02ae949b36ec895606.exe
1740	e1b34d64a5765a02ae949b36ec895606.exe
1740	e1b34d64a5765a02ae949b36ec895606.exe
1740	e1b34d64a5765a02ae949b36ec895606.exe
1740	e1b34d64a5765a02ae949b36ec895606.exe
1740	e1b34d64a5765a02ae949b36ec895606.exe
1740	e1b34d64a5765a02ae949b36ec895606.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1740	e1b34d64a5765a02ae949b36ec895606.exe
Token: SeDebugPrivilege	2744	Windows DeepSea.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 1740 wrote to memory of 3304	1740	e1b34d64a5765a02ae949b36ec895606.exe	98
PID 1740 wrote to memory of 3304	1740	e1b34d64a5765a02ae949b36ec895606.exe	98
PID 1740 wrote to memory of 3304	1740	e1b34d64a5765a02ae949b36ec895606.exe	98
PID 1740 wrote to memory of 1808	1740	e1b34d64a5765a02ae949b36ec895606.exe	100
PID 1740 wrote to memory of 1808	1740	e1b34d64a5765a02ae949b36ec895606.exe	100
PID 1740 wrote to memory of 1808	1740	e1b34d64a5765a02ae949b36ec895606.exe	100
PID 3304 wrote to memory of 552	3304	cmd.exe	102
PID 3304 wrote to memory of 552	3304	cmd.exe	102
PID 3304 wrote to memory of 552	3304	cmd.exe	102
PID 1808 wrote to memory of 4496	1808	cmd.exe	103
PID 1808 wrote to memory of 4496	1808	cmd.exe	103
PID 1808 wrote to memory of 4496	1808	cmd.exe	103
PID 1808 wrote to memory of 2744	1808	cmd.exe	106
PID 1808 wrote to memory of 2744	1808	cmd.exe	106
PID 1808 wrote to memory of 2744	1808	cmd.exe	106

C:\Users\Admin\AppData\Local\Temp\e1b34d64a5765a02ae949b36ec895606.exe
"C:\Users\Admin\AppData\Local\Temp\e1b34d64a5765a02ae949b36ec895606.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1740
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Windows DeepSea" /tr '"C:\Users\Admin\AppData\Roaming\Windows DeepSea.exe"' & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3304
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /f /sc onlogon /rl highest /tn "Windows DeepSea" /tr '"C:\Users\Admin\AppData\Roaming\Windows DeepSea.exe"'
    3⤵
    - Creates scheduled task(s)
    PID:552
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp88C7.tmp.bat""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1808
- - C:\Windows\SysWOW64\timeout.exe
    timeout 3
    3⤵
    - Delays execution with timeout.exe
    PID:4496
- - C:\Users\Admin\AppData\Roaming\Windows DeepSea.exe
    "C:\Users\Admin\AppData\Roaming\Windows DeepSea.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:2744

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4004 --field-trial-handle=2272,i,11831746627654527593,10138103687018060346,262144 --variations-seed-version /prefetch:8
1⤵
PID:1980

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp88C7.tmp.bat

Filesize
159B

MD5
973115f03ef40205b58b81ab040b9c31

SHA1
0a713322d7e2d24992477a8ce502b92d87b5c22e

SHA256
cec38f9ce68e258e79e0c710b67350196175b1b817bc376663e439b4f37a7841

SHA512
0940c7f1dc43509606f5aa3a3c69b2ad1edfec06e4619c19d3039e432dbf6b900a5a90967a77cc74659f125e29bbb0eb363e095aa135feb61ad8fb5a6fef6dd4

Download Submit
C:\Users\Admin\AppData\Roaming\Windows DeepSea.exe

Filesize
562KB

MD5
e1b34d64a5765a02ae949b36ec895606

SHA1
0e50f0f10b68149a78a1843d61b75a29930c4ddb

SHA256
1063342a4b01665860de63007e264aab2fc7e4399de6ce3d3146ff4ced1701e8

SHA512
cfe876bac1844c227de2619d09ed7deeecb20a5150affbc618152451b6728cdbca500a24025f1401038c88f74f8b2722741f077e61dc31805649635c1ff78741

Download Submit
memory/1740-3-0x00000000057D0000-0x000000000586C000-memory.dmp

Filesize
624KB

Download
memory/1740-1-0x0000000000CB0000-0x0000000000D42000-memory.dmp

Filesize
584KB

Download
memory/1740-4-0x0000000005870000-0x0000000005902000-memory.dmp

Filesize
584KB

Download
memory/1740-5-0x0000000005A90000-0x0000000005AA0000-memory.dmp

Filesize
64KB

Download
memory/1740-6-0x0000000006050000-0x00000000065F4000-memory.dmp

Filesize
5.6MB

Download
memory/1740-11-0x0000000075330000-0x0000000075AE0000-memory.dmp

Filesize
7.7MB

Download
memory/1740-2-0x00000000056C0000-0x0000000005726000-memory.dmp

Filesize
408KB

Download
memory/1740-0-0x0000000075330000-0x0000000075AE0000-memory.dmp

Filesize
7.7MB

Download
memory/2744-16-0x0000000075290000-0x0000000075A40000-memory.dmp

Filesize
7.7MB

Download
memory/2744-17-0x0000000004CD0000-0x0000000004CE0000-memory.dmp

Filesize
64KB

Download
memory/2744-18-0x0000000075290000-0x0000000075A40000-memory.dmp

Filesize
7.7MB

Download
memory/2744-19-0x0000000004CD0000-0x0000000004CE0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads