asyncrat | 4640247488b055bc4df613532104de671b0c1a4a1d3c2876f108d90efa514321

Analysis

max time kernel
143s
max time network
146s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10/05/2024, 07:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9b6e50c8c2915f239c1f49d286991e20_NeikiAnalytics.exe
Size

3.1MB
MD5

9b6e50c8c2915f239c1f49d286991e20
SHA1

6e6e3e37ce33c0b1da224329147690c8dbe31b9e
SHA256

4640247488b055bc4df613532104de671b0c1a4a1d3c2876f108d90efa514321
SHA512

be94004d0008f3fae13130fb17fb3e3a7a00d064a51729f6b3d9106fb65dccabdff26e2451f124d94fcb8c38f1c1460486f3270ebffdc773248938b3d1acc208
SSDEEP

49152:6VDUTVgM5Jw1FexoMri7tCekuo305DVnqbTWKccGCKCztKq+86jBQDDIk9Yo3pOn:AwwwoMwWQ58TWPc+a8p8HopEOZx

Score

10^/10

asyncrat zgrat zona6vip persistence rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

ZONA6VIP

diegoarmandoarmando.con-ip.com:4041

Mutex

tempcookies

Attributes

delay
3
install
false
install_file
winu32.exe
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Detect ZGRat V1 34 IoCs

resource	yara_rule
behavioral1/memory/2172-4-0x0000000009910000-0x0000000009B30000-memory.dmp	family_zgrat_v1
behavioral1/memory/2172-8-0x0000000009910000-0x0000000009B2B000-memory.dmp	family_zgrat_v1
behavioral1/memory/2172-14-0x0000000009910000-0x0000000009B2B000-memory.dmp	family_zgrat_v1
behavioral1/memory/2172-18-0x0000000009910000-0x0000000009B2B000-memory.dmp	family_zgrat_v1
behavioral1/memory/2172-24-0x0000000009910000-0x0000000009B2B000-memory.dmp	family_zgrat_v1
behavioral1/memory/2172-30-0x0000000009910000-0x0000000009B2B000-memory.dmp	family_zgrat_v1
behavioral1/memory/2172-32-0x0000000009910000-0x0000000009B2B000-memory.dmp	family_zgrat_v1
behavioral1/memory/2172-28-0x0000000009910000-0x0000000009B2B000-memory.dmp	family_zgrat_v1
behavioral1/memory/2172-26-0x0000000009910000-0x0000000009B2B000-memory.dmp	family_zgrat_v1
behavioral1/memory/2172-34-0x0000000009910000-0x0000000009B2B000-memory.dmp	family_zgrat_v1
behavioral1/memory/2172-22-0x0000000009910000-0x0000000009B2B000-memory.dmp	family_zgrat_v1
behavioral1/memory/2172-20-0x0000000009910000-0x0000000009B2B000-memory.dmp	family_zgrat_v1
behavioral1/memory/2172-16-0x0000000009910000-0x0000000009B2B000-memory.dmp	family_zgrat_v1
behavioral1/memory/2172-12-0x0000000009910000-0x0000000009B2B000-memory.dmp	family_zgrat_v1
behavioral1/memory/2172-10-0x0000000009910000-0x0000000009B2B000-memory.dmp	family_zgrat_v1
behavioral1/memory/2172-6-0x0000000009910000-0x0000000009B2B000-memory.dmp	family_zgrat_v1
behavioral1/memory/2172-5-0x0000000009910000-0x0000000009B2B000-memory.dmp	family_zgrat_v1
behavioral1/memory/2172-36-0x0000000009910000-0x0000000009B2B000-memory.dmp	family_zgrat_v1
behavioral1/memory/2172-38-0x0000000009910000-0x0000000009B2B000-memory.dmp	family_zgrat_v1
behavioral1/memory/2172-50-0x0000000009910000-0x0000000009B2B000-memory.dmp	family_zgrat_v1
behavioral1/memory/2172-53-0x0000000009910000-0x0000000009B2B000-memory.dmp	family_zgrat_v1
behavioral1/memory/2172-68-0x0000000009910000-0x0000000009B2B000-memory.dmp	family_zgrat_v1
behavioral1/memory/2172-66-0x0000000009910000-0x0000000009B2B000-memory.dmp	family_zgrat_v1
behavioral1/memory/2172-64-0x0000000009910000-0x0000000009B2B000-memory.dmp	family_zgrat_v1
behavioral1/memory/2172-62-0x0000000009910000-0x0000000009B2B000-memory.dmp	family_zgrat_v1
behavioral1/memory/2172-60-0x0000000009910000-0x0000000009B2B000-memory.dmp	family_zgrat_v1
behavioral1/memory/2172-58-0x0000000009910000-0x0000000009B2B000-memory.dmp	family_zgrat_v1
behavioral1/memory/2172-56-0x0000000009910000-0x0000000009B2B000-memory.dmp	family_zgrat_v1
behavioral1/memory/2172-54-0x0000000009910000-0x0000000009B2B000-memory.dmp	family_zgrat_v1
behavioral1/memory/2172-48-0x0000000009910000-0x0000000009B2B000-memory.dmp	family_zgrat_v1
behavioral1/memory/2172-46-0x0000000009910000-0x0000000009B2B000-memory.dmp	family_zgrat_v1
behavioral1/memory/2172-44-0x0000000009910000-0x0000000009B2B000-memory.dmp	family_zgrat_v1
behavioral1/memory/2172-42-0x0000000009910000-0x0000000009B2B000-memory.dmp	family_zgrat_v1
behavioral1/memory/2172-40-0x0000000009910000-0x0000000009B2B000-memory.dmp	family_zgrat_v1

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\Ybpnnfui = "C:\\Users\\Admin\\AppData\\Roaming\\Ybpnnfui.exe"	9b6e50c8c2915f239c1f49d286991e20_NeikiAnalytics.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2172 set thread context of 2908	2172	9b6e50c8c2915f239c1f49d286991e20_NeikiAnalytics.exe	28

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2172	9b6e50c8c2915f239c1f49d286991e20_NeikiAnalytics.exe
Token: SeDebugPrivilege	2172	9b6e50c8c2915f239c1f49d286991e20_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2172 wrote to memory of 2908	2172	9b6e50c8c2915f239c1f49d286991e20_NeikiAnalytics.exe	28
PID 2172 wrote to memory of 2908	2172	9b6e50c8c2915f239c1f49d286991e20_NeikiAnalytics.exe	28
PID 2172 wrote to memory of 2908	2172	9b6e50c8c2915f239c1f49d286991e20_NeikiAnalytics.exe	28
PID 2172 wrote to memory of 2908	2172	9b6e50c8c2915f239c1f49d286991e20_NeikiAnalytics.exe	28
PID 2172 wrote to memory of 2908	2172	9b6e50c8c2915f239c1f49d286991e20_NeikiAnalytics.exe	28
PID 2172 wrote to memory of 2908	2172	9b6e50c8c2915f239c1f49d286991e20_NeikiAnalytics.exe	28
PID 2172 wrote to memory of 2908	2172	9b6e50c8c2915f239c1f49d286991e20_NeikiAnalytics.exe	28
PID 2172 wrote to memory of 2908	2172	9b6e50c8c2915f239c1f49d286991e20_NeikiAnalytics.exe	28
PID 2172 wrote to memory of 2908	2172	9b6e50c8c2915f239c1f49d286991e20_NeikiAnalytics.exe	28

C:\Users\Admin\AppData\Local\Temp\9b6e50c8c2915f239c1f49d286991e20_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\9b6e50c8c2915f239c1f49d286991e20_NeikiAnalytics.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2172
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:2908

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2172-0-0x000000007469E000-0x000000007469F000-memory.dmp

Filesize
4KB

Download
memory/2172-1-0x00000000001D0000-0x00000000004EA000-memory.dmp

Filesize
3.1MB

Download
memory/2172-2-0x0000000074690000-0x0000000074D7E000-memory.dmp

Filesize
6.9MB

Download
memory/2172-3-0x00000000062E0000-0x0000000006B50000-memory.dmp

Filesize
8.4MB

Download
memory/2172-4-0x0000000009910000-0x0000000009B30000-memory.dmp

Filesize
2.1MB

Download
memory/2172-8-0x0000000009910000-0x0000000009B2B000-memory.dmp

Filesize
2.1MB

Download
memory/2172-14-0x0000000009910000-0x0000000009B2B000-memory.dmp

Filesize
2.1MB

Download
memory/2172-18-0x0000000009910000-0x0000000009B2B000-memory.dmp

Filesize
2.1MB

Download
memory/2172-24-0x0000000009910000-0x0000000009B2B000-memory.dmp

Filesize
2.1MB

Download
memory/2172-30-0x0000000009910000-0x0000000009B2B000-memory.dmp

Filesize
2.1MB

Download
memory/2172-32-0x0000000009910000-0x0000000009B2B000-memory.dmp

Filesize
2.1MB

Download
memory/2172-28-0x0000000009910000-0x0000000009B2B000-memory.dmp

Filesize
2.1MB

Download
memory/2172-26-0x0000000009910000-0x0000000009B2B000-memory.dmp

Filesize
2.1MB

Download
memory/2172-34-0x0000000009910000-0x0000000009B2B000-memory.dmp

Filesize
2.1MB

Download
memory/2172-22-0x0000000009910000-0x0000000009B2B000-memory.dmp

Filesize
2.1MB

Download
memory/2172-20-0x0000000009910000-0x0000000009B2B000-memory.dmp

Filesize
2.1MB

Download
memory/2172-16-0x0000000009910000-0x0000000009B2B000-memory.dmp

Filesize
2.1MB

Download
memory/2172-12-0x0000000009910000-0x0000000009B2B000-memory.dmp

Filesize
2.1MB

Download
memory/2172-10-0x0000000009910000-0x0000000009B2B000-memory.dmp

Filesize
2.1MB

Download
memory/2172-6-0x0000000009910000-0x0000000009B2B000-memory.dmp

Filesize
2.1MB

Download
memory/2172-5-0x0000000009910000-0x0000000009B2B000-memory.dmp

Filesize
2.1MB

Download
memory/2172-36-0x0000000009910000-0x0000000009B2B000-memory.dmp

Filesize
2.1MB

Download
memory/2172-38-0x0000000009910000-0x0000000009B2B000-memory.dmp

Filesize
2.1MB

Download
memory/2172-50-0x0000000009910000-0x0000000009B2B000-memory.dmp

Filesize
2.1MB

Download
memory/2172-53-0x0000000009910000-0x0000000009B2B000-memory.dmp

Filesize
2.1MB

Download
memory/2172-68-0x0000000009910000-0x0000000009B2B000-memory.dmp

Filesize
2.1MB

Download
memory/2172-66-0x0000000009910000-0x0000000009B2B000-memory.dmp

Filesize
2.1MB

Download
memory/2172-64-0x0000000009910000-0x0000000009B2B000-memory.dmp

Filesize
2.1MB

Download
memory/2172-62-0x0000000009910000-0x0000000009B2B000-memory.dmp

Filesize
2.1MB

Download
memory/2172-4885-0x0000000074690000-0x0000000074D7E000-memory.dmp

Filesize
6.9MB

Download
memory/2172-60-0x0000000009910000-0x0000000009B2B000-memory.dmp

Filesize
2.1MB

Download
memory/2172-58-0x0000000009910000-0x0000000009B2B000-memory.dmp

Filesize
2.1MB

Download
memory/2172-56-0x0000000009910000-0x0000000009B2B000-memory.dmp

Filesize
2.1MB

Download
memory/2172-54-0x0000000009910000-0x0000000009B2B000-memory.dmp

Filesize
2.1MB

Download
memory/2172-48-0x0000000009910000-0x0000000009B2B000-memory.dmp

Filesize
2.1MB

Download
memory/2172-46-0x0000000009910000-0x0000000009B2B000-memory.dmp

Filesize
2.1MB

Download
memory/2172-44-0x0000000009910000-0x0000000009B2B000-memory.dmp

Filesize
2.1MB

Download
memory/2172-4887-0x0000000002720000-0x000000000276C000-memory.dmp

Filesize
304KB

Download
memory/2172-4886-0x00000000023E0000-0x000000000243C000-memory.dmp

Filesize
368KB

Download
memory/2172-42-0x0000000009910000-0x0000000009B2B000-memory.dmp

Filesize
2.1MB

Download
memory/2172-40-0x0000000009910000-0x0000000009B2B000-memory.dmp

Filesize
2.1MB

Download
memory/2172-4888-0x000000007469E000-0x000000007469F000-memory.dmp

Filesize
4KB

Download
memory/2172-4889-0x0000000074690000-0x0000000074D7E000-memory.dmp

Filesize
6.9MB

Download
memory/2172-4890-0x0000000074690000-0x0000000074D7E000-memory.dmp

Filesize
6.9MB

Download
memory/2172-4891-0x0000000006210000-0x0000000006264000-memory.dmp

Filesize
336KB

Download
memory/2172-4909-0x0000000074690000-0x0000000074D7E000-memory.dmp

Filesize
6.9MB

Download
memory/2908-4910-0x0000000074690000-0x0000000074D7E000-memory.dmp

Filesize
6.9MB

Download
memory/2908-4908-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2908-4911-0x0000000074690000-0x0000000074D7E000-memory.dmp

Filesize
6.9MB

Download
memory/2908-4912-0x0000000074690000-0x0000000074D7E000-memory.dmp

Filesize
6.9MB

Download
memory/2908-4913-0x0000000074690000-0x0000000074D7E000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads