asyncrat | e86ff967ff444d50d892200880556b56a66262b4a0fe2a22dee45127d3df6a7f

General

Target

3fcf99f1e0d9dc0a7286728d20bc7580_NEIKI.exe
Size

997KB
MD5

3fcf99f1e0d9dc0a7286728d20bc7580
SHA1

c4bee57583397289f759e7262b6e0ab9eb4d3129
SHA256

e86ff967ff444d50d892200880556b56a66262b4a0fe2a22dee45127d3df6a7f
SHA512

afbbe4cba3fd8b92d9223d69c05665dfad3df0251c691b33372ec4b3759af565ab6ddb1cbbeccf2124ecb072a4ba32a820dad7867a271f7b14892d65b9929978
SSDEEP

12288:IdJTcoZzrQlJ88LdyODyoOwpghwS72CJ5ZDlN7k:IdJxzr8685y49327ZpN7k

Score

10^/10

asyncrat zgrat rat

Malware Config

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Detect ZGRat V1 3 IoCs

resource	yara_rule
behavioral1/memory/1632-1-0x0000000000A10000-0x0000000000B0E000-memory.dmp	family_zgrat_v1
behavioral1/files/0x0007000000014726-21.dat	family_zgrat_v1
behavioral1/memory/2672-23-0x0000000001060000-0x000000000115E000-memory.dmp	family_zgrat_v1

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral1/files/0x0007000000014726-21.dat	family_asyncrat

Executes dropped EXE 1 IoCs

pid	Process
2672	AnyDesk60.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2660	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
2712	timeout.exe

Modifies registry class 22 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\CID\{7288C72C}\5824905E	3fcf99f1e0d9dc0a7286728d20bc7580_NEIKI.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\CID\{7288C72C}\5824905E\0 = "238156161186008171033027102243037020090194102007"	3fcf99f1e0d9dc0a7286728d20bc7580_NEIKI.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\CID\{A3358E75-826A3-31A5-2C1E-14A484D53571}\5824905E\2 = "238156161186008171033027102243037020090194102007"	3fcf99f1e0d9dc0a7286728d20bc7580_NEIKI.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\CID\{7288C72C}\5824905E\3 = "246087206208176072158153005148068255072109058117"	AnyDesk60.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\CID\{D3558E25-821F3-72C3-8A52-54A482A54739}\5824905E\2 = "184247108017042164043138105196050007165060111131"	AnyDesk60.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\CID\{B1159E65-821C3-21C5-CE21-34A484D54444}\5824905E\1 = "238156161186008171033027102243037020090194102007"	3fcf99f1e0d9dc0a7286728d20bc7580_NEIKI.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\CID\{7288C72C}	3fcf99f1e0d9dc0a7286728d20bc7580_NEIKI.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\CID\{A3358E75-826A3-31A5-2C1E-14A484D53571}	3fcf99f1e0d9dc0a7286728d20bc7580_NEIKI.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\CID\{7288C72C}\5824905E\1 = "238156161186008171033027102243037020090194102007"	AnyDesk60.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\CID\{A3358E75-826A3-31A5-2C1E-14A484D53571}\5824905E\2 = "238156161186008171033027102243037020090194102007"	AnyDesk60.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\CID	3fcf99f1e0d9dc0a7286728d20bc7580_NEIKI.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\CID\{B1159E65-821C3-21C5-CE21-34A484D54444}	3fcf99f1e0d9dc0a7286728d20bc7580_NEIKI.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\CID\{D3558E25-821F3-72C3-8A52-54A482A54739}	3fcf99f1e0d9dc0a7286728d20bc7580_NEIKI.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\CID\{D3558E25-821F3-72C3-8A52-54A482A54739}\5824905E\2 = "159021122206117200165108097018043012143072010113"	3fcf99f1e0d9dc0a7286728d20bc7580_NEIKI.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\CID\{B1159E65-821C3-21C5-CE21-34A484D54444}\5824905E	3fcf99f1e0d9dc0a7286728d20bc7580_NEIKI.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\CID\{B1159E65-821C3-21C5-CE21-34A484D54444}\5824905E\3 = "246087206208176072158153005148068255072109058117"	3fcf99f1e0d9dc0a7286728d20bc7580_NEIKI.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\CID\{7288C72C}\5824905E\1 = "238156161186008171033027102243037020090194102007"	3fcf99f1e0d9dc0a7286728d20bc7580_NEIKI.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\CID\{7288C72C}\5824905E\3 = "246087206208176072158153005148068255072109058117"	3fcf99f1e0d9dc0a7286728d20bc7580_NEIKI.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\CID\{A3358E75-826A3-31A5-2C1E-14A484D53571}\5824905E	3fcf99f1e0d9dc0a7286728d20bc7580_NEIKI.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\CID\{D3558E25-821F3-72C3-8A52-54A482A54739}\5824905E	3fcf99f1e0d9dc0a7286728d20bc7580_NEIKI.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\CID\{7288C72C}\5824905E\0 = "238156161186008171033027102243037020090194102007"	AnyDesk60.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\CID\{B1159E65-821C3-21C5-CE21-34A484D54444}\5824905E\0 = "238156161186008171033027102243037020090194102007"	3fcf99f1e0d9dc0a7286728d20bc7580_NEIKI.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
1632	3fcf99f1e0d9dc0a7286728d20bc7580_NEIKI.exe
1632	3fcf99f1e0d9dc0a7286728d20bc7580_NEIKI.exe
1632	3fcf99f1e0d9dc0a7286728d20bc7580_NEIKI.exe
1632	3fcf99f1e0d9dc0a7286728d20bc7580_NEIKI.exe
1632	3fcf99f1e0d9dc0a7286728d20bc7580_NEIKI.exe
1632	3fcf99f1e0d9dc0a7286728d20bc7580_NEIKI.exe
1632	3fcf99f1e0d9dc0a7286728d20bc7580_NEIKI.exe
2672	AnyDesk60.exe
2672	AnyDesk60.exe
2672	AnyDesk60.exe
2672	AnyDesk60.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1632	3fcf99f1e0d9dc0a7286728d20bc7580_NEIKI.exe
Token: SeDebugPrivilege	2672	AnyDesk60.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 1632 wrote to memory of 2652	1632	3fcf99f1e0d9dc0a7286728d20bc7580_NEIKI.exe	29
PID 1632 wrote to memory of 2652	1632	3fcf99f1e0d9dc0a7286728d20bc7580_NEIKI.exe	29
PID 1632 wrote to memory of 2652	1632	3fcf99f1e0d9dc0a7286728d20bc7580_NEIKI.exe	29
PID 1632 wrote to memory of 804	1632	3fcf99f1e0d9dc0a7286728d20bc7580_NEIKI.exe	31
PID 1632 wrote to memory of 804	1632	3fcf99f1e0d9dc0a7286728d20bc7580_NEIKI.exe	31
PID 1632 wrote to memory of 804	1632	3fcf99f1e0d9dc0a7286728d20bc7580_NEIKI.exe	31
PID 2652 wrote to memory of 2660	2652	cmd.exe	33
PID 2652 wrote to memory of 2660	2652	cmd.exe	33
PID 2652 wrote to memory of 2660	2652	cmd.exe	33
PID 804 wrote to memory of 2712	804	cmd.exe	34
PID 804 wrote to memory of 2712	804	cmd.exe	34
PID 804 wrote to memory of 2712	804	cmd.exe	34
PID 804 wrote to memory of 2672	804	cmd.exe	35
PID 804 wrote to memory of 2672	804	cmd.exe	35
PID 804 wrote to memory of 2672	804	cmd.exe	35

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\3fcf99f1e0d9dc0a7286728d20bc7580_NEIKI.exe
"C:\Users\Admin\AppData\Local\Temp\3fcf99f1e0d9dc0a7286728d20bc7580_NEIKI.exe"
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1632
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "AnyDesk60" /tr '"C:\Users\Admin\AppData\Roaming\AnyDesk60.exe"' & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2652
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc onlogon /rl highest /tn "AnyDesk60" /tr '"C:\Users\Admin\AppData\Roaming\AnyDesk60.exe"'
    3⤵
    - Creates scheduled task(s)
    PID:2660
- C:\Windows\system32\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp3B0D.tmp.bat""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:804
- - C:\Windows\system32\timeout.exe
    timeout 3
    3⤵
    - Delays execution with timeout.exe
    PID:2712
- - C:\Users\Admin\AppData\Roaming\AnyDesk60.exe
    "C:\Users\Admin\AppData\Roaming\AnyDesk60.exe"
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2672

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Isolated Storage\5824905E\44538E74

Filesize
112B

MD5
91c85adf5883009f0171e62e56f4222c

SHA1
aae28c6a8fd23f1bc96ce288eef34e47fa47c220

SHA256
4cfea7eca82a2585aad6d4eecf60821f3b2edb6a94ff225a0ca66657389f4c46

SHA512
bb6f339eab5cecdae728f06c7d31d7551ee71ea747d91fef211df2a1d3a96b495d6aa9f8c46bad50a0bb646c4e52071401ae49be1ba0d6e2837ec7b1a2e99d7f

Download Submit
C:\ProgramData\Isolated Storage\5824905E\59FD041E

Filesize
320B

MD5
0f944a8bd80c6ffe20a648408388f76e

SHA1
8c493f5c99e9be2e32e7eef0d1d3beb4d524f104

SHA256
bff71c4689ea73c1a229428d9a7e10d15c755d64f58e8fa00fc7806086cda9c2

SHA512
ffe435668bd0af411021bc0055b7893542dbc42845264ef7a1bec70a8009734f90ed9a274e3fca7b37bda27a2d166c7451c3f0f67c181e5898c3111dd013e165

Download Submit
C:\ProgramData\Isolated Storage\5824905E\90424E7E

Filesize
112B

MD5
43358f4a1b59c42d34e80730be18ddf6

SHA1
3d58451bee0190597154740928eadb61245a71ac

SHA256
e831f042b10f3712843ff91e339f63c83630bf73b88c840d905f1f165ad0129a

SHA512
7913a895bbe202e60015f32851ff312d178d2a4d267d94aecd4b5ec26eb3e59e6396f36269d682352c3a265ae8cd12a55ca5d73c0435b23ac3f7519d93f407a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp3B0D.tmp.bat

Filesize
153B

MD5
aeb98b64242f10cf5d324a831af5623a

SHA1
01ed821dc15401444fe1890e702202b31e80e8d0

SHA256
bb1ffa6f27aee41af02bbab98a45c537fd214a2076cd12750b3981893e17ab65

SHA512
249dadf29569e01c9b1fb845b2548c5db388d1bb66e1fea95df7f497aa56120f06d32cd11def53493ae5f6bb2081a3fb5b4d9e8faad38f376bc403710918586b

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk60.exe

Filesize
997KB

MD5
3fcf99f1e0d9dc0a7286728d20bc7580

SHA1
c4bee57583397289f759e7262b6e0ab9eb4d3129

SHA256
e86ff967ff444d50d892200880556b56a66262b4a0fe2a22dee45127d3df6a7f

SHA512
afbbe4cba3fd8b92d9223d69c05665dfad3df0251c691b33372ec4b3759af565ab6ddb1cbbeccf2124ecb072a4ba32a820dad7867a271f7b14892d65b9929978

Download Submit
memory/1632-3-0x0000000000480000-0x000000000048A000-memory.dmp

Filesize
40KB

Download
memory/1632-9-0x000007FEF5870000-0x000007FEF625C000-memory.dmp

Filesize
9.9MB

Download
memory/1632-5-0x000007FEF5870000-0x000007FEF625C000-memory.dmp

Filesize
9.9MB

Download
memory/1632-19-0x000007FEF5870000-0x000007FEF625C000-memory.dmp

Filesize
9.9MB

Download
memory/1632-4-0x000007FEF5870000-0x000007FEF625C000-memory.dmp

Filesize
9.9MB

Download
memory/1632-0-0x000007FEF5873000-0x000007FEF5874000-memory.dmp

Filesize
4KB

Download
memory/1632-2-0x000007FEF5870000-0x000007FEF625C000-memory.dmp

Filesize
9.9MB

Download
memory/1632-1-0x0000000000A10000-0x0000000000B0E000-memory.dmp

Filesize
1016KB

Download
memory/2672-23-0x0000000001060000-0x000000000115E000-memory.dmp

Filesize
1016KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads