asyncrat | 4d3342755a6622e79184acda622c1b9a4e49c962e99d0fb4ec2e52712648f1ed

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
20-05-2024 13:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5f4fa1e76daa53fca0dbd4c9fb67f36c_JaffaCakes118.exe
Size

234KB
MD5

5f4fa1e76daa53fca0dbd4c9fb67f36c
SHA1

77df08a040ff244821646d3edf5e7d353423585f
SHA256

4d3342755a6622e79184acda622c1b9a4e49c962e99d0fb4ec2e52712648f1ed
SHA512

0f2a41596033021d1c48daf4903b4dd24e2a7756c1fe2f57d5457cc5655293f322549237a8a0d4ebddda33e8aa47f6bb8f460deb38bd4cf841241a9ae587948f
SSDEEP

3072:kjx4Azy9BGS15TNfs72havim+jVlokCTlAUQOHrazWdUAuPBN79Bt34ycLgF4IY2:kjx4AzwHDUvejVlWAUbH+WwTpBt4yLFD

Score

10^/10

asyncrat default persistence rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

Default

185.33.234.204:4784

Mutex

AsyncMutex_6SI8OkPnk

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

5f4fa1e76daa53fca0dbd4c9fb67f36c_JaffaCakes118.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\oiWgf = "C:\\RIJTOOVX\\oiWgfs\\oiWgfswfZ.vbs"	5f4fa1e76daa53fca0dbd4c9fb67f36c_JaffaCakes118.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

5f4fa1e76daa53fca0dbd4c9fb67f36c_JaffaCakes118.exe

description pid process target process

PID 1428 set thread context of 2232 1428 5f4fa1e76daa53fca0dbd4c9fb67f36c_JaffaCakes118.exe InstallUtil.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

5f4fa1e76daa53fca0dbd4c9fb67f36c_JaffaCakes118.exe

pid process

1428 5f4fa1e76daa53fca0dbd4c9fb67f36c_JaffaCakes118.exe

description	pid	process	target process
PID 1428 set thread context of 2232	1428	5f4fa1e76daa53fca0dbd4c9fb67f36c_JaffaCakes118.exe	InstallUtil.exe

pid	process
1428	5f4fa1e76daa53fca0dbd4c9fb67f36c_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

5f4fa1e76daa53fca0dbd4c9fb67f36c_JaffaCakes118.exe

description	pid	process	target process
PID 1428 wrote to memory of 2232	1428	5f4fa1e76daa53fca0dbd4c9fb67f36c_JaffaCakes118.exe	InstallUtil.exe
PID 1428 wrote to memory of 2232	1428	5f4fa1e76daa53fca0dbd4c9fb67f36c_JaffaCakes118.exe	InstallUtil.exe
PID 1428 wrote to memory of 2232	1428	5f4fa1e76daa53fca0dbd4c9fb67f36c_JaffaCakes118.exe	InstallUtil.exe
PID 1428 wrote to memory of 2232	1428	5f4fa1e76daa53fca0dbd4c9fb67f36c_JaffaCakes118.exe	InstallUtil.exe

C:\Users\Admin\AppData\Local\Temp\5f4fa1e76daa53fca0dbd4c9fb67f36c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\5f4fa1e76daa53fca0dbd4c9fb67f36c_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1428
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
  "C:\Windows\\\\Microsoft.NET\\\\Framework\\\\v4.0.30319\\\\InstallUtil.exe"
  2⤵
  PID:2232

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1428-0-0x000000007476E000-0x000000007476F000-memory.dmp

Filesize
4KB

Download
memory/1428-1-0x0000000000940000-0x0000000000980000-memory.dmp

Filesize
256KB

Download
memory/1428-2-0x00000000052B0000-0x00000000052C6000-memory.dmp

Filesize
88KB

Download
memory/1428-3-0x00000000059D0000-0x0000000005F74000-memory.dmp

Filesize
5.6MB

Download
memory/1428-4-0x000000007476E000-0x000000007476F000-memory.dmp

Filesize
4KB

Download
memory/1428-9-0x0000000074760000-0x0000000074F10000-memory.dmp

Filesize
7.7MB

Download
memory/1428-12-0x0000000074760000-0x0000000074F10000-memory.dmp

Filesize
7.7MB

Download
memory/2232-7-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2232-10-0x0000000074760000-0x0000000074F10000-memory.dmp

Filesize
7.7MB

Download
memory/2232-11-0x0000000074760000-0x0000000074F10000-memory.dmp

Filesize
7.7MB

Download
memory/2232-13-0x0000000074760000-0x0000000074F10000-memory.dmp

Filesize
7.7MB

Download