asyncrat | a150a433c6a3e4278f6cc4cbc85863fc431e5c1e65081ad67253513e8ca01282

General

Target

b8d455465260a845db35492fda5a8888.exe
Size

63KB
MD5

b8d455465260a845db35492fda5a8888
SHA1

287b0ba049ad8f3be802d2224efb86dba72d3221
SHA256

a150a433c6a3e4278f6cc4cbc85863fc431e5c1e65081ad67253513e8ca01282
SHA512

5dba43ae31420de362593752e8ff491afbe8d20f183f6b95e6962ea1e637c7bf3bd50b5213e4d928a96b85d9b54841ee697798b0089624b13ef7eded826cd86a
SSDEEP

768:CuY6LVcsTPq781wC8A+XjuazcBRL5JTk1+T4KSBGHmDbD/ph0oX9rAW6dEYSuEdP:reQPckdSJYUbdh9O8uEdpqKmY7

Score

10^/10

asyncrat default evasion rat trojan

Malware Config

Extracted

Family

asyncrat

Botnet

Default

C2

66.235.168.242:3232

Attributes

delay
1
install
true
install_file
Loaader.exe
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

Loaader.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Loaader.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	Loaader.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	Loaader.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	Loaader.exe

UAC bypass 3 TTPs 3 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

Loaader.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\enablelua = "0"	Loaader.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\promptonsecuredesktop = "0"	Loaader.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\consentpromptbehavioradmin = "0"	Loaader.exe

Async RAT payload 1 IoCs

rat

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Roaming\Loaader.exe	family_asyncrat

Executes dropped EXE 1 IoCs

Processes:

Loaader.exe

pid process

2968 Loaader.exe
Windows security modification 2 TTPs 1 IoCs
evasion trojan

Disable or Modify Tools
T1562.001

Modify Registry
T1112

Processes:

Loaader.exe

description ioc process

Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features Loaader.exe

pid	process
2968	Loaader.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features	Loaader.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

Loaader.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\enablelua = "0"	Loaader.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\enablelua	Loaader.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

2700 schtasks.exe
Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

2664 timeout.exe

pid	process
2700	schtasks.exe

pid	process
2664	timeout.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

Processes:

b8d455465260a845db35492fda5a8888.exepowershell.exepowershell.exeLoaader.exe

pid	process
108	b8d455465260a845db35492fda5a8888.exe
108	b8d455465260a845db35492fda5a8888.exe
1556	powershell.exe
1328	powershell.exe
2968	Loaader.exe
2968	Loaader.exe
2968	Loaader.exe
2968	Loaader.exe
2968	Loaader.exe
2968	Loaader.exe
2968	Loaader.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

b8d455465260a845db35492fda5a8888.exeLoaader.exepowershell.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	108	b8d455465260a845db35492fda5a8888.exe
Token: SeDebugPrivilege	2968	Loaader.exe
Token: SeDebugPrivilege	1556	powershell.exe
Token: SeDebugPrivilege	1328	powershell.exe

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

b8d455465260a845db35492fda5a8888.execmd.execmd.exeLoaader.exe

description	pid	process	target process
PID 108 wrote to memory of 2972	108	b8d455465260a845db35492fda5a8888.exe	cmd.exe
PID 108 wrote to memory of 2972	108	b8d455465260a845db35492fda5a8888.exe	cmd.exe
PID 108 wrote to memory of 2972	108	b8d455465260a845db35492fda5a8888.exe	cmd.exe
PID 108 wrote to memory of 2660	108	b8d455465260a845db35492fda5a8888.exe	cmd.exe
PID 108 wrote to memory of 2660	108	b8d455465260a845db35492fda5a8888.exe	cmd.exe
PID 108 wrote to memory of 2660	108	b8d455465260a845db35492fda5a8888.exe	cmd.exe
PID 2972 wrote to memory of 2700	2972	cmd.exe	schtasks.exe
PID 2972 wrote to memory of 2700	2972	cmd.exe	schtasks.exe
PID 2972 wrote to memory of 2700	2972	cmd.exe	schtasks.exe
PID 2660 wrote to memory of 2664	2660	cmd.exe	timeout.exe
PID 2660 wrote to memory of 2664	2660	cmd.exe	timeout.exe
PID 2660 wrote to memory of 2664	2660	cmd.exe	timeout.exe
PID 2660 wrote to memory of 2968	2660	cmd.exe	Loaader.exe
PID 2660 wrote to memory of 2968	2660	cmd.exe	Loaader.exe
PID 2660 wrote to memory of 2968	2660	cmd.exe	Loaader.exe
PID 2968 wrote to memory of 1556	2968	Loaader.exe	powershell.exe
PID 2968 wrote to memory of 1556	2968	Loaader.exe	powershell.exe
PID 2968 wrote to memory of 1556	2968	Loaader.exe	powershell.exe
PID 2968 wrote to memory of 1328	2968	Loaader.exe	powershell.exe
PID 2968 wrote to memory of 1328	2968	Loaader.exe	powershell.exe
PID 2968 wrote to memory of 1328	2968	Loaader.exe	powershell.exe

System policy modification 1 TTPs 3 IoCs

evasion

Modify Registry

T1112

Processes:

Loaader.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\consentpromptbehavioradmin = "0"	Loaader.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\enablelua = "0"	Loaader.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\promptonsecuredesktop = "0"	Loaader.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\b8d455465260a845db35492fda5a8888.exe
"C:\Users\Admin\AppData\Local\Temp\b8d455465260a845db35492fda5a8888.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:108

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Loaader" /tr '"C:\Users\Admin\AppData\Roaming\Loaader.exe"' & exit
2⤵
- Suspicious use of WriteProcessMemory
PID:2972

C:\Windows\system32\schtasks.exe
schtasks /create /f /sc onlogon /rl highest /tn "Loaader" /tr '"C:\Users\Admin\AppData\Roaming\Loaader.exe"'
3⤵
- Creates scheduled task(s)
PID:2700

C:\Windows\system32\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp2904.tmp.bat""
2⤵
- Suspicious use of WriteProcessMemory
PID:2660

C:\Windows\system32\timeout.exe
timeout 3
3⤵
- Delays execution with timeout.exe
PID:2664

C:\Users\Admin\AppData\Roaming\Loaader.exe
"C:\Users\Admin\AppData\Roaming\Loaader.exe"
3⤵
- Modifies Windows Defender Real-time Protection settings
- UAC bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2968

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" Get-MpPreference -verbose
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1556

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add - MpPreference - ExclusionExtension ".exe"
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1328

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Create or Modify System Process

1

T1543

Windows Service

Scheduled Task/Job

Privilege Escalation

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Abuse Elevation Control Mechanism

1

T1548

Bypass User Account Control

Scheduled Task/Job

Defense Evasion

Modify Registry

4

T1112

Impair Defenses

3

T1562

Disable or Modify Tools

3

T1562.001

Abuse Elevation Control Mechanism

1

T1548

Bypass User Account Control

1

T1548.002

Credential Access

Discovery

System Information Discovery

2

T1082

Query Registry

1

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Cab3D41.tmp
Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4935.tmp
Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp2904.tmp.bat
Filesize
151B

MD5
1978cde4850688fe21d666ae450a12fd

SHA1
b8ea3f62856b8e144ae8e7e7ea24915248f0575e

SHA256
9295b0e689e41162ac0467dfd9cb73108c77cdf85a04c9d161bbb6b7c003c1e0

SHA512
0b7c7a95d132eafbfa17181578b139212f4bcb365c4c8d8669c5bbea16f2b619032fcb2f3f7dc055cd279457bc0689092122e1e8fc024198691c14abe684df7e

Download Submit
C:\Users\Admin\AppData\Roaming\Loaader.exe
Filesize
63KB

MD5
b8d455465260a845db35492fda5a8888

SHA1
287b0ba049ad8f3be802d2224efb86dba72d3221

SHA256
a150a433c6a3e4278f6cc4cbc85863fc431e5c1e65081ad67253513e8ca01282

SHA512
5dba43ae31420de362593752e8ff491afbe8d20f183f6b95e6962ea1e637c7bf3bd50b5213e4d928a96b85d9b54841ee697798b0089624b13ef7eded826cd86a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize
7KB

MD5
35c3132f91f08b268621315974293987

SHA1
f3d56563dbdfb232738086c821491ff702c7296a

SHA256
3128dd0d87ef939915bb911e5594acea19576a94928c1ca9d85223c833523b99

SHA512
d8da15d17d801a6fc9ecd6ef83b808d0353d1d6521b75c244e6a08653d6c5ce3963b651c158c120ed2f55d58d2a03778b30b62d4733ba42455c438cf558382e8

Download Submit
memory/108-3-0x000007FEF5FC0000-0x000007FEF69AC000-memory.dmp

Filesize
9.9MB

Download
memory/108-0-0x000007FEF5FC3000-0x000007FEF5FC4000-memory.dmp

Filesize
4KB

Download
memory/108-12-0x000007FEF5FC0000-0x000007FEF69AC000-memory.dmp

Filesize
9.9MB

Download
memory/108-2-0x000007FEF5FC0000-0x000007FEF69AC000-memory.dmp

Filesize
9.9MB

Download
memory/108-1-0x0000000000E30000-0x0000000000E46000-memory.dmp

Filesize
88KB

Download
memory/1328-83-0x0000000002860000-0x0000000002868000-memory.dmp

Filesize
32KB

Download
memory/1328-82-0x000000001B710000-0x000000001B9F2000-memory.dmp

Filesize
2.9MB

Download
memory/1556-76-0x0000000001E10000-0x0000000001E18000-memory.dmp

Filesize
32KB

Download
memory/1556-75-0x000000001B670000-0x000000001B952000-memory.dmp

Filesize
2.9MB

Download
memory/2968-34-0x00000000004D0000-0x0000000000504000-memory.dmp

Filesize
208KB

Download
memory/2968-17-0x0000000000A20000-0x0000000000A36000-memory.dmp

Filesize
88KB

Download
memory/2968-84-0x000000001B510000-0x000000001B5C2000-memory.dmp

Filesize
712KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads