asyncrat | a1117e97df6e8a615eb0dcacec3ae6476e11d66c4f080751d37286d0f4f8013e

Reason

Machine shutdown

General

Target

AsyncClient.exe
Size

47KB
MD5

a5394d7d38a3e45162457f120ae82d62
SHA1

07c9fd54030fed1bc672c573049a65670a14ce01
SHA256

a1117e97df6e8a615eb0dcacec3ae6476e11d66c4f080751d37286d0f4f8013e
SHA512

0f49ce9848d79017ab2da707d1c841c8085001c115e9658ef47501bf75ef7746daebe92ea93f7f7681438d494717c8e0c12f6e05d46c5397b3b669d201e58887
SSDEEP

768:XusZ1ThIn5PWUDvOtmo2qzVVLvEZof6SPIq7LATOk20bRcYEf+3od+ctMOZYBDZe:XusZ1Thsq2pZoqqoTnZbRclf+3ktMOZR

Score

10^/10

asyncrat zgrat default rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

C2

127.0.0.1:6522

127.0.0.1:37915

de-engines.gl.at.ply.gg:6522

de-engines.gl.at.ply.gg:37915

these-accommodation.gl.at.ply.gg:6522

these-accommodation.gl.at.ply.gg:37915

Mutex

vmplgwKOt6xO

Attributes

delay
3
install
false
install_file
Steam.exe
install_folder
%Temp%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Detect ZGRat V1 3 IoCs

Processes:

resource	yara_rule
behavioral2/memory/5076-9-0x00000000064F0000-0x0000000006554000-memory.dmp	family_zgrat_v1
behavioral2/memory/5076-11-0x00000000066B0000-0x0000000006718000-memory.dmp	family_zgrat_v1
behavioral2/memory/5076-13-0x0000000000DB0000-0x0000000000E14000-memory.dmp	family_zgrat_v1

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

AsyncClient.exe

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	AsyncClient.exe

Drops desktop.ini file(s) 1 IoCs

Processes:

AsyncClient.exe

description	ioc	Process
File opened for modification	\??\c:\program files\desktop.ini	AsyncClient.exe

Drops file in Program Files directory 20 IoCs

Processes:

AsyncClient.exe

description	ioc	Process
File opened for modification	\??\c:\program files\compressadd.docx	AsyncClient.exe
File opened for modification	\??\c:\program files\desktop.ini	AsyncClient.exe
File opened for modification	\??\c:\program files\groupinvoke.rmi	AsyncClient.exe
File opened for modification	\??\c:\program files\joinlimit.m2v	AsyncClient.exe
File opened for modification	\??\c:\program files\synclimit.ppsm	AsyncClient.exe
File opened for modification	\??\c:\program files\testclose.wmv	AsyncClient.exe
File opened for modification	\??\c:\program files\clearsave.potm	AsyncClient.exe
File opened for modification	\??\c:\program files\disablemount.vstx	AsyncClient.exe
File opened for modification	\??\c:\program files\joinstep.ts	AsyncClient.exe
File opened for modification	\??\c:\program files\pingsync.mp4	AsyncClient.exe
File opened for modification	\??\c:\program files\redoconvertto.temp	AsyncClient.exe
File opened for modification	\??\c:\program files\switchgroup.odt	AsyncClient.exe
File opened for modification	\??\c:\program files\denyunblock.rtf	AsyncClient.exe
File opened for modification	\??\c:\program files\disableselect.au	AsyncClient.exe
File opened for modification	\??\c:\program files\unlockregister.rm	AsyncClient.exe
File opened for modification	\??\c:\program files\updateenable.html	AsyncClient.exe
File opened for modification	\??\c:\program files\convertfromout.vdw	AsyncClient.exe
File opened for modification	\??\c:\program files\expandping.temp	AsyncClient.exe
File opened for modification	\??\c:\program files\outcheckpoint.sql	AsyncClient.exe
File opened for modification	\??\c:\program files\popdisable.mpg	AsyncClient.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 15 IoCs

Processes:

LogonUI.exe

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "217"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

AsyncClient.exeshutdown.exe

description	pid	Process
Token: SeDebugPrivilege	5076	AsyncClient.exe
Token: SeDebugPrivilege	5076	AsyncClient.exe
Token: SeShutdownPrivilege	4512	shutdown.exe
Token: SeRemoteShutdownPrivilege	4512	shutdown.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

LogonUI.exe

pid	Process
4624	LogonUI.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

AsyncClient.execmd.exe

description	pid	Process	procid_target
PID 5076 wrote to memory of 1940	5076	AsyncClient.exe	92
PID 5076 wrote to memory of 1940	5076	AsyncClient.exe	92
PID 5076 wrote to memory of 1940	5076	AsyncClient.exe	92
PID 1940 wrote to memory of 4512	1940	cmd.exe	94
PID 1940 wrote to memory of 4512	1940	cmd.exe	94
PID 1940 wrote to memory of 4512	1940	cmd.exe	94

C:\Users\Admin\AppData\Local\Temp\AsyncClient.exe
"C:\Users\Admin\AppData\Local\Temp\AsyncClient.exe"
1⤵
- Checks computer location settings
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5076
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c Shutdown /s /f /t 00
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1940
- - C:\Windows\SysWOW64\shutdown.exe
    Shutdown /s /f /t 00
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4512

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3940855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:4624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5076-0-0x000000007528E000-0x000000007528F000-memory.dmp

Filesize
4KB

Download
memory/5076-1-0x0000000000430000-0x0000000000442000-memory.dmp

Filesize
72KB

Download
memory/5076-2-0x0000000075280000-0x0000000075A30000-memory.dmp

Filesize
7.7MB

Download
memory/5076-3-0x0000000004DC0000-0x0000000004E26000-memory.dmp

Filesize
408KB

Download
memory/5076-4-0x0000000005270000-0x000000000530C000-memory.dmp

Filesize
624KB

Download
memory/5076-5-0x0000000005D40000-0x00000000062E4000-memory.dmp

Filesize
5.6MB

Download
memory/5076-6-0x000000007528E000-0x000000007528F000-memory.dmp

Filesize
4KB

Download
memory/5076-7-0x0000000075280000-0x0000000075A30000-memory.dmp

Filesize
7.7MB

Download
memory/5076-8-0x0000000006570000-0x00000000065E6000-memory.dmp

Filesize
472KB

Download
memory/5076-9-0x00000000064F0000-0x0000000006554000-memory.dmp

Filesize
400KB

Download
memory/5076-10-0x0000000006620000-0x000000000663E000-memory.dmp

Filesize
120KB

Download
memory/5076-11-0x00000000066B0000-0x0000000006718000-memory.dmp

Filesize
416KB

Download
memory/5076-12-0x0000000006ED0000-0x0000000006F62000-memory.dmp

Filesize
584KB

Download
memory/5076-13-0x0000000000DB0000-0x0000000000E14000-memory.dmp

Filesize
400KB

Download
memory/5076-14-0x0000000075280000-0x0000000075A30000-memory.dmp

Filesize
7.7MB

Download

Analysis

Sharing

Errors

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads