asyncrat | a150a433c6a3e4278f6cc4cbc85863fc431e5c1e65081ad67253513e8ca01282

General

Target

a150a433c6a3e4278f6cc4cbc85863fc431e5c1e65081ad67253513e8ca01282.exe
Size

63KB
MD5

b8d455465260a845db35492fda5a8888
SHA1

287b0ba049ad8f3be802d2224efb86dba72d3221
SHA256

a150a433c6a3e4278f6cc4cbc85863fc431e5c1e65081ad67253513e8ca01282
SHA512

5dba43ae31420de362593752e8ff491afbe8d20f183f6b95e6962ea1e637c7bf3bd50b5213e4d928a96b85d9b54841ee697798b0089624b13ef7eded826cd86a
SSDEEP

768:CuY6LVcsTPq781wC8A+XjuazcBRL5JTk1+T4KSBGHmDbD/ph0oX9rAW6dEYSuEdP:reQPckdSJYUbdh9O8uEdpqKmY7

Score

10^/10

asyncrat default rat

Malware Config

Extracted

Family

asyncrat

Botnet

Default

C2

66.235.168.242:3232

Attributes

delay
1
install
true
install_file
Loaader.exe
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Roaming\Loaader.exe	family_asyncrat

Detects executables attemping to enumerate video devices using WMI 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2288-1-0x00000000013A0000-0x00000000013B6000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice
C:\Users\Admin\AppData\Roaming\Loaader.exe	INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice
behavioral1/memory/2692-17-0x0000000000190000-0x00000000001A6000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice

Detects executables containing the string DcRatBy 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2288-1-0x00000000013A0000-0x00000000013B6000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_DcRatBy
C:\Users\Admin\AppData\Roaming\Loaader.exe	INDICATOR_SUSPICIOUS_EXE_DcRatBy
behavioral1/memory/2692-17-0x0000000000190000-0x00000000001A6000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_DcRatBy

Executes dropped EXE 1 IoCs

Processes:

Loaader.exe

pid process

2692 Loaader.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

2828 schtasks.exe
Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

2536 timeout.exe

pid	process
2692	Loaader.exe

pid	process
2828	schtasks.exe

pid	process
2536	timeout.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

a150a433c6a3e4278f6cc4cbc85863fc431e5c1e65081ad67253513e8ca01282.exe

pid	process
2288	a150a433c6a3e4278f6cc4cbc85863fc431e5c1e65081ad67253513e8ca01282.exe
2288	a150a433c6a3e4278f6cc4cbc85863fc431e5c1e65081ad67253513e8ca01282.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

a150a433c6a3e4278f6cc4cbc85863fc431e5c1e65081ad67253513e8ca01282.exeLoaader.exe

description	pid	process
Token: SeDebugPrivilege	2288	a150a433c6a3e4278f6cc4cbc85863fc431e5c1e65081ad67253513e8ca01282.exe
Token: SeDebugPrivilege	2692	Loaader.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

a150a433c6a3e4278f6cc4cbc85863fc431e5c1e65081ad67253513e8ca01282.execmd.execmd.exe

description	pid	process	target process
PID 2288 wrote to memory of 2968	2288	a150a433c6a3e4278f6cc4cbc85863fc431e5c1e65081ad67253513e8ca01282.exe	cmd.exe
PID 2288 wrote to memory of 2968	2288	a150a433c6a3e4278f6cc4cbc85863fc431e5c1e65081ad67253513e8ca01282.exe	cmd.exe
PID 2288 wrote to memory of 2968	2288	a150a433c6a3e4278f6cc4cbc85863fc431e5c1e65081ad67253513e8ca01282.exe	cmd.exe
PID 2288 wrote to memory of 2592	2288	a150a433c6a3e4278f6cc4cbc85863fc431e5c1e65081ad67253513e8ca01282.exe	cmd.exe
PID 2288 wrote to memory of 2592	2288	a150a433c6a3e4278f6cc4cbc85863fc431e5c1e65081ad67253513e8ca01282.exe	cmd.exe
PID 2288 wrote to memory of 2592	2288	a150a433c6a3e4278f6cc4cbc85863fc431e5c1e65081ad67253513e8ca01282.exe	cmd.exe
PID 2968 wrote to memory of 2828	2968	cmd.exe	schtasks.exe
PID 2968 wrote to memory of 2828	2968	cmd.exe	schtasks.exe
PID 2968 wrote to memory of 2828	2968	cmd.exe	schtasks.exe
PID 2592 wrote to memory of 2536	2592	cmd.exe	timeout.exe
PID 2592 wrote to memory of 2536	2592	cmd.exe	timeout.exe
PID 2592 wrote to memory of 2536	2592	cmd.exe	timeout.exe
PID 2592 wrote to memory of 2692	2592	cmd.exe	Loaader.exe
PID 2592 wrote to memory of 2692	2592	cmd.exe	Loaader.exe
PID 2592 wrote to memory of 2692	2592	cmd.exe	Loaader.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\a150a433c6a3e4278f6cc4cbc85863fc431e5c1e65081ad67253513e8ca01282.exe
"C:\Users\Admin\AppData\Local\Temp\a150a433c6a3e4278f6cc4cbc85863fc431e5c1e65081ad67253513e8ca01282.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2288

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Loaader" /tr '"C:\Users\Admin\AppData\Roaming\Loaader.exe"' & exit
2⤵
- Suspicious use of WriteProcessMemory
PID:2968

C:\Windows\system32\schtasks.exe
schtasks /create /f /sc onlogon /rl highest /tn "Loaader" /tr '"C:\Users\Admin\AppData\Roaming\Loaader.exe"'
3⤵
- Creates scheduled task(s)
PID:2828

C:\Windows\system32\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp1B8C.tmp.bat""
2⤵
- Suspicious use of WriteProcessMemory
PID:2592

C:\Windows\system32\timeout.exe
timeout 3
3⤵
- Delays execution with timeout.exe
PID:2536

C:\Users\Admin\AppData\Roaming\Loaader.exe
"C:\Users\Admin\AppData\Roaming\Loaader.exe"
3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2692

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Query Registry

1

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp1B8C.tmp.bat
Filesize
151B

MD5
6fc0985d1eb5d0a716ac1c3143cb3ec5

SHA1
59512e5116516f121a89ad42893c324c6d77fc5c

SHA256
67bb6d884c6697d5cfba12e7d930a41219700b7f9a716a8da864ffffae335829

SHA512
e8ecab23febc0a42379c3bd8f849869c5e8643a9fc71a6baf3ac4646529ca4f5687d2bed6a891560c6d43a64d4a412de4ce4d11202dabd3e686f18b36bd71220

Download Submit
C:\Users\Admin\AppData\Roaming\Loaader.exe
Filesize
63KB

MD5
b8d455465260a845db35492fda5a8888

SHA1
287b0ba049ad8f3be802d2224efb86dba72d3221

SHA256
a150a433c6a3e4278f6cc4cbc85863fc431e5c1e65081ad67253513e8ca01282

SHA512
5dba43ae31420de362593752e8ff491afbe8d20f183f6b95e6962ea1e637c7bf3bd50b5213e4d928a96b85d9b54841ee697798b0089624b13ef7eded826cd86a

Download Submit
memory/2288-0-0x000007FEF5E63000-0x000007FEF5E64000-memory.dmp

Filesize
4KB

Download
memory/2288-1-0x00000000013A0000-0x00000000013B6000-memory.dmp

Filesize
88KB

Download
memory/2288-2-0x000007FEF5E60000-0x000007FEF684C000-memory.dmp

Filesize
9.9MB

Download
memory/2288-3-0x000007FEF5E60000-0x000007FEF684C000-memory.dmp

Filesize
9.9MB

Download
memory/2288-12-0x000007FEF5E60000-0x000007FEF684C000-memory.dmp

Filesize
9.9MB

Download
memory/2692-17-0x0000000000190000-0x00000000001A6000-memory.dmp

Filesize
88KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads