asyncrat | 5f2ff12584a99c9720d27bf219ec4691f80ea258d71e391ca28f4590f360a775

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
19/04/2024, 00:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
$PLUGINSDIR/vzjtdshtcu.dll
Size 29KB
Sample240419-a7hypacg3y
SHA256 5d362cfb794eebda011289c7ffaf328b9537e87dca13e79d60508773b538f6c6
MD5 433747be519bda968dfcb35f6970fa5b
SHA1 faaea3969400d0302544ad4fd9cb031b7637936f
SHA512 6a97c1f265546f71910bad5465c767314ed97e2246363e25077471db1a5cfdd92a56b1da02e8620775fdbc8a231636f147c6e66c781b38f03fe05b3da256530a
SSDEEP 768:M2TzWszi/+6IQBM9x22OgNDiSn1n4RT1:MmnzvPQBM9x2ZSnKR
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

asyncrat default rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

Default

tinrinrin.kozow.com:9091

Mutex

AsyncMutex_6SI8OkPnk

Attributes

delay
3
install
true
install_file
Edge.exe
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral3/memory/2620-10-0x00000000001F0000-0x0000000000202000-memory.dmp	family_asyncrat

Executes dropped EXE 1 IoCs

pid	Process
2668	Edge.exe

Loads dropped DLL 1 IoCs

pid	Process
2364	cmd.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1752 set thread context of 2620	1752	rundll32.exe	29

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2552	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
2652	timeout.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2620	rundll32.exe
2620	rundll32.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2620	rundll32.exe

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 1336 wrote to memory of 1752	1336	rundll32.exe	28
PID 1336 wrote to memory of 1752	1336	rundll32.exe	28
PID 1336 wrote to memory of 1752	1336	rundll32.exe	28
PID 1336 wrote to memory of 1752	1336	rundll32.exe	28
PID 1336 wrote to memory of 1752	1336	rundll32.exe	28
PID 1336 wrote to memory of 1752	1336	rundll32.exe	28
PID 1336 wrote to memory of 1752	1336	rundll32.exe	28
PID 1752 wrote to memory of 2620	1752	rundll32.exe	29
PID 1752 wrote to memory of 2620	1752	rundll32.exe	29
PID 1752 wrote to memory of 2620	1752	rundll32.exe	29
PID 1752 wrote to memory of 2620	1752	rundll32.exe	29
PID 1752 wrote to memory of 2620	1752	rundll32.exe	29
PID 1752 wrote to memory of 2620	1752	rundll32.exe	29
PID 1752 wrote to memory of 2620	1752	rundll32.exe	29
PID 1752 wrote to memory of 2620	1752	rundll32.exe	29
PID 1752 wrote to memory of 2620	1752	rundll32.exe	29
PID 1752 wrote to memory of 2620	1752	rundll32.exe	29
PID 1752 wrote to memory of 2620	1752	rundll32.exe	29
PID 1752 wrote to memory of 2620	1752	rundll32.exe	29
PID 1752 wrote to memory of 2620	1752	rundll32.exe	29
PID 1752 wrote to memory of 2620	1752	rundll32.exe	29
PID 2620 wrote to memory of 2604	2620	rundll32.exe	30
PID 2620 wrote to memory of 2604	2620	rundll32.exe	30
PID 2620 wrote to memory of 2604	2620	rundll32.exe	30
PID 2620 wrote to memory of 2604	2620	rundll32.exe	30
PID 2620 wrote to memory of 2364	2620	rundll32.exe	32
PID 2620 wrote to memory of 2364	2620	rundll32.exe	32
PID 2620 wrote to memory of 2364	2620	rundll32.exe	32
PID 2620 wrote to memory of 2364	2620	rundll32.exe	32
PID 2604 wrote to memory of 2552	2604	cmd.exe	34
PID 2604 wrote to memory of 2552	2604	cmd.exe	34
PID 2604 wrote to memory of 2552	2604	cmd.exe	34
PID 2604 wrote to memory of 2552	2604	cmd.exe	34
PID 2364 wrote to memory of 2652	2364	cmd.exe	35
PID 2364 wrote to memory of 2652	2364	cmd.exe	35
PID 2364 wrote to memory of 2652	2364	cmd.exe	35
PID 2364 wrote to memory of 2652	2364	cmd.exe	35
PID 2364 wrote to memory of 2668	2364	cmd.exe	36
PID 2364 wrote to memory of 2668	2364	cmd.exe	36
PID 2364 wrote to memory of 2668	2364	cmd.exe	36
PID 2364 wrote to memory of 2668	2364	cmd.exe	36

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\vzjtdshtcu.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1336
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\vzjtdshtcu.dll,#1
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1752
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\vzjtdshtcu.dll,#1
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2620
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Edge" /tr '"C:\Users\Admin\AppData\Roaming\Edge.exe"' & exit
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2604
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "Edge" /tr '"C:\Users\Admin\AppData\Roaming\Edge.exe"'
        5⤵
        Creates scheduled task(s)
        
        PID:2552
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpAA63.tmp.bat""
      4⤵
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:2364
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout 3
        5⤵
        Delays execution with timeout.exe
        
        PID:2652
    - - C:\Users\Admin\AppData\Roaming\Edge.exe
        
        "C:\Users\Admin\AppData\Roaming\Edge.exe"
        5⤵
        Executes dropped EXE
        
        PID:2668

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmpAA63.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmpAA63.tmp.bat
Size 148B
SHA256 af84a47038199603abefb5f265bb3bfea92fd7fede32a218e6e34262c6a965aa
MD5 ec53e73a3c28aa74733e251301331bcd
SHA1 b27fce60a7a9e90233fb24f2d573e21b9f5a68df
SHA512 77b46bc21b2b03fe766f28e151842e5586a6739b06f3146dcd366ac914cd32b02c169a12f68d29d380325807743727700d00e123ddca2d6cc859dace0e6a6ae8
MD5 SHA1 SHA512

Submit Download

Edge.exe

Path \Users\Admin\AppData\Roaming\Edge.exe
Size 43KB
SHA256 5ad3c37e6f2b9db3ee8b5aeedc474645de90c66e3d95f8620c48102f1eba4124
MD5 51138beea3e2c21ec44d0932c71762a8
SHA1 8939cf35447b22dd2c6e6f443446acc1bf986d58
SHA512 794f30fe452117ff2a26dc9d7086aaf82b639c2632ac2e381a81f5239caaec7c96922ba5d2d90bfd8d74f0a6cd4f79fbda63e14c6b779e5cf6834c13e4e45e7d
SSDEEP 768:mD+ellQvZSazSRqbSEln5IyYpamDjobj8SpM:E+QWvZhSRqln5IUmDjoXV
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1752-0-0x0000000075270000-0x000000007527B000-memory.dmp

Download

memory/1752-1-0x0000000075270000-0x000000007527B000-memory.dmp

Download

memory/1752-2-0x0000000075030000-0x000000007503B000-memory.dmp

Download

memory/1752-4-0x0000000075270000-0x000000007527B000-memory.dmp

Download

memory/1752-6-0x0000000075030000-0x000000007503B000-memory.dmp

Download

memory/2620-11-0x0000000074830000-0x0000000074F1E000-memory.dmp

Download

memory/2620-9-0x0000000000400000-0x000000000044B000-memory.dmp

Download

memory/2620-12-0x0000000004440000-0x0000000004480000-memory.dmp

Download

memory/2620-10-0x00000000001F0000-0x0000000000202000-memory.dmp

Download

memory/2620-13-0x0000000004440000-0x0000000004480000-memory.dmp

Download

memory/2620-14-0x0000000004440000-0x0000000004480000-memory.dmp

Download

memory/2620-7-0x0000000000400000-0x000000000044B000-memory.dmp

Download

memory/2620-24-0x0000000074830000-0x0000000074F1E000-memory.dmp

Download

memory/2620-3-0x0000000000400000-0x000000000044B000-memory.dmp

Download