asyncrat | 4d3342755a6622e79184acda622c1b9a4e49c962e99d0fb4ec2e52712648f1ed

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
20-05-2024 13:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5f4fa1e76daa53fca0dbd4c9fb67f36c_JaffaCakes118.exe
Size

234KB
MD5

5f4fa1e76daa53fca0dbd4c9fb67f36c
SHA1

77df08a040ff244821646d3edf5e7d353423585f
SHA256

4d3342755a6622e79184acda622c1b9a4e49c962e99d0fb4ec2e52712648f1ed
SHA512

0f2a41596033021d1c48daf4903b4dd24e2a7756c1fe2f57d5457cc5655293f322549237a8a0d4ebddda33e8aa47f6bb8f460deb38bd4cf841241a9ae587948f
SSDEEP

3072:kjx4Azy9BGS15TNfs72havim+jVlokCTlAUQOHrazWdUAuPBN79Bt34ycLgF4IY2:kjx4AzwHDUvejVlWAUbH+WwTpBt4yLFD

Score

10^/10

asyncrat default persistence rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

Default

185.33.234.204:4784

Mutex

AsyncMutex_6SI8OkPnk

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

5f4fa1e76daa53fca0dbd4c9fb67f36c_JaffaCakes118.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\oiWgf = "C:\\SCFGBRBT\\oiWgfs\\oiWgfswfZ.vbs"	5f4fa1e76daa53fca0dbd4c9fb67f36c_JaffaCakes118.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

5f4fa1e76daa53fca0dbd4c9fb67f36c_JaffaCakes118.exe

description pid process target process

PID 2392 set thread context of 2784 2392 5f4fa1e76daa53fca0dbd4c9fb67f36c_JaffaCakes118.exe InstallUtil.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

5f4fa1e76daa53fca0dbd4c9fb67f36c_JaffaCakes118.exe

pid process

2392 5f4fa1e76daa53fca0dbd4c9fb67f36c_JaffaCakes118.exe

description	pid	process	target process
PID 2392 set thread context of 2784	2392	5f4fa1e76daa53fca0dbd4c9fb67f36c_JaffaCakes118.exe	InstallUtil.exe

pid	process
2392	5f4fa1e76daa53fca0dbd4c9fb67f36c_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

5f4fa1e76daa53fca0dbd4c9fb67f36c_JaffaCakes118.exe

description	pid	process	target process
PID 2392 wrote to memory of 2784	2392	5f4fa1e76daa53fca0dbd4c9fb67f36c_JaffaCakes118.exe	InstallUtil.exe
PID 2392 wrote to memory of 2784	2392	5f4fa1e76daa53fca0dbd4c9fb67f36c_JaffaCakes118.exe	InstallUtil.exe
PID 2392 wrote to memory of 2784	2392	5f4fa1e76daa53fca0dbd4c9fb67f36c_JaffaCakes118.exe	InstallUtil.exe
PID 2392 wrote to memory of 2784	2392	5f4fa1e76daa53fca0dbd4c9fb67f36c_JaffaCakes118.exe	InstallUtil.exe
PID 2392 wrote to memory of 2784	2392	5f4fa1e76daa53fca0dbd4c9fb67f36c_JaffaCakes118.exe	InstallUtil.exe
PID 2392 wrote to memory of 2784	2392	5f4fa1e76daa53fca0dbd4c9fb67f36c_JaffaCakes118.exe	InstallUtil.exe
PID 2392 wrote to memory of 2784	2392	5f4fa1e76daa53fca0dbd4c9fb67f36c_JaffaCakes118.exe	InstallUtil.exe
PID 2392 wrote to memory of 2784	2392	5f4fa1e76daa53fca0dbd4c9fb67f36c_JaffaCakes118.exe	InstallUtil.exe

C:\Users\Admin\AppData\Local\Temp\5f4fa1e76daa53fca0dbd4c9fb67f36c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\5f4fa1e76daa53fca0dbd4c9fb67f36c_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2392
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
  "C:\Windows\\\\Microsoft.NET\\\\Framework\\\\v4.0.30319\\\\InstallUtil.exe"
  2⤵
  PID:2784

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2392-0-0x0000000073EFE000-0x0000000073EFF000-memory.dmp

Filesize
4KB

Download
memory/2392-1-0x00000000011E0000-0x0000000001220000-memory.dmp

Filesize
256KB

Download
memory/2392-2-0x0000000000370000-0x0000000000386000-memory.dmp

Filesize
88KB

Download
memory/2392-3-0x0000000073EFE000-0x0000000073EFF000-memory.dmp

Filesize
4KB

Download
memory/2392-15-0x0000000073EF0000-0x00000000745DE000-memory.dmp

Filesize
6.9MB

Download
memory/2392-12-0x0000000073EF0000-0x00000000745DE000-memory.dmp

Filesize
6.9MB

Download
memory/2784-8-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2784-11-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2784-13-0x0000000073EF0000-0x00000000745DE000-memory.dmp

Filesize
6.9MB

Download
memory/2784-14-0x0000000073EF0000-0x00000000745DE000-memory.dmp

Filesize
6.9MB

Download
memory/2784-6-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2784-16-0x0000000073EF0000-0x00000000745DE000-memory.dmp

Filesize
6.9MB

Download
memory/2784-17-0x0000000073EF0000-0x00000000745DE000-memory.dmp

Filesize
6.9MB

Download