asyncrat | d948a6af0e9a1e9981669d300da54d84e526fc55e9654b8de1ba58821e14b96b

General

Target

Optimix_client.exe
Size

45KB
MD5

bc9efb1b76331a392346d4cce9c3b177
SHA1

ecd6d5584ab75f5735a69864ecf74dddde8683a1
SHA256

d948a6af0e9a1e9981669d300da54d84e526fc55e9654b8de1ba58821e14b96b
SHA512

4969259be841c308d791c16d0645e8f72db3f8708975bd9682ae630cca4c8f27b778d48387b5f17f1a1d82f3b8392cfbe95f8d5cd860ad25543f0d520e6b3f19
SSDEEP

768:luAINTHkvSbWUnFKJmo2q7XIrzXIxOPILzjbjXgXAiHFeq1BDZPx:luAINTHgN2Lv83L3bEX9leqbdPx

Score

10^/10

asyncrat default rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

C2

192.168.0.76:6606

192.168.0.76:7707

192.168.0.76:8808

192.168.0.76:4444

Mutex

YNGv5uoT0xzv

Attributes

delay
3
install
true
install_file
ProtonyteAntiVirusSetup.exe
install_folder
%Temp%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\ProtonyteAntiVirusSetup.exe	family_asyncrat

Executes dropped EXE 1 IoCs

Processes:

ProtonyteAntiVirusSetup.exe

pid process

3032 ProtonyteAntiVirusSetup.exe
Loads dropped DLL 1 IoCs

Processes:

cmd.exe

pid process

2636 cmd.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

2704 schtasks.exe
Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

2640 timeout.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

Optimix_client.exe

pid process

2212 Optimix_client.exe
2212 Optimix_client.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Optimix_client.exeProtonyteAntiVirusSetup.exe

description pid process

Token: SeDebugPrivilege 2212 Optimix_client.exe
Token: SeDebugPrivilege 3032 ProtonyteAntiVirusSetup.exe

pid	process
3032	ProtonyteAntiVirusSetup.exe

pid	process
2636	cmd.exe

pid	process
2704	schtasks.exe

pid	process
2640	timeout.exe

pid	process
2212	Optimix_client.exe
2212	Optimix_client.exe

description	pid	process
Token: SeDebugPrivilege	2212	Optimix_client.exe
Token: SeDebugPrivilege	3032	ProtonyteAntiVirusSetup.exe

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

Optimix_client.execmd.execmd.exe

description	pid	process	target process
PID 2212 wrote to memory of 2736	2212	Optimix_client.exe	cmd.exe
PID 2212 wrote to memory of 2736	2212	Optimix_client.exe	cmd.exe
PID 2212 wrote to memory of 2736	2212	Optimix_client.exe	cmd.exe
PID 2212 wrote to memory of 2736	2212	Optimix_client.exe	cmd.exe
PID 2212 wrote to memory of 2636	2212	Optimix_client.exe	cmd.exe
PID 2212 wrote to memory of 2636	2212	Optimix_client.exe	cmd.exe
PID 2212 wrote to memory of 2636	2212	Optimix_client.exe	cmd.exe
PID 2212 wrote to memory of 2636	2212	Optimix_client.exe	cmd.exe
PID 2736 wrote to memory of 2704	2736	cmd.exe	schtasks.exe
PID 2736 wrote to memory of 2704	2736	cmd.exe	schtasks.exe
PID 2736 wrote to memory of 2704	2736	cmd.exe	schtasks.exe
PID 2736 wrote to memory of 2704	2736	cmd.exe	schtasks.exe
PID 2636 wrote to memory of 2640	2636	cmd.exe	timeout.exe
PID 2636 wrote to memory of 2640	2636	cmd.exe	timeout.exe
PID 2636 wrote to memory of 2640	2636	cmd.exe	timeout.exe
PID 2636 wrote to memory of 2640	2636	cmd.exe	timeout.exe
PID 2636 wrote to memory of 3032	2636	cmd.exe	ProtonyteAntiVirusSetup.exe
PID 2636 wrote to memory of 3032	2636	cmd.exe	ProtonyteAntiVirusSetup.exe
PID 2636 wrote to memory of 3032	2636	cmd.exe	ProtonyteAntiVirusSetup.exe
PID 2636 wrote to memory of 3032	2636	cmd.exe	ProtonyteAntiVirusSetup.exe
PID 2636 wrote to memory of 3032	2636	cmd.exe	ProtonyteAntiVirusSetup.exe
PID 2636 wrote to memory of 3032	2636	cmd.exe	ProtonyteAntiVirusSetup.exe
PID 2636 wrote to memory of 3032	2636	cmd.exe	ProtonyteAntiVirusSetup.exe

C:\Users\Admin\AppData\Local\Temp\Optimix_client.exe
"C:\Users\Admin\AppData\Local\Temp\Optimix_client.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2212

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "ProtonyteAntiVirusSetup" /tr '"C:\Users\Admin\AppData\Local\Temp\ProtonyteAntiVirusSetup.exe"' & exit
2⤵
- Suspicious use of WriteProcessMemory
PID:2736

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /f /sc onlogon /rl highest /tn "ProtonyteAntiVirusSetup" /tr '"C:\Users\Admin\AppData\Local\Temp\ProtonyteAntiVirusSetup.exe"'
3⤵
- Creates scheduled task(s)
PID:2704

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp2E32.tmp.bat""
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2636

C:\Windows\SysWOW64\timeout.exe
timeout 3
3⤵
- Delays execution with timeout.exe
PID:2640

C:\Users\Admin\AppData\Local\Temp\ProtonyteAntiVirusSetup.exe
"C:\Users\Admin\AppData\Local\Temp\ProtonyteAntiVirusSetup.exe"
3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3032

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp2E32.tmp.bat
Filesize
170B

MD5
bb1d8bae623a64a20c7a95a758fea8b7

SHA1
fa690bc95bb16ec3d5b45d1eb673a6d59b143848

SHA256
aa950c991e228c674a45881547a3376a677e382b767eae4a1dd8aefeec98c6be

SHA512
5fed89702abfe86b02f2cce34cdebe01cd319ed25324308e42be9e6b6d61fd9fb786eb358b34dca29778e249b66c7020acc9ea01b205b3063c258588fa01717d

Download Submit
\Users\Admin\AppData\Local\Temp\ProtonyteAntiVirusSetup.exe
Filesize
45KB

MD5
bc9efb1b76331a392346d4cce9c3b177

SHA1
ecd6d5584ab75f5735a69864ecf74dddde8683a1

SHA256
d948a6af0e9a1e9981669d300da54d84e526fc55e9654b8de1ba58821e14b96b

SHA512
4969259be841c308d791c16d0645e8f72db3f8708975bd9682ae630cca4c8f27b778d48387b5f17f1a1d82f3b8392cfbe95f8d5cd860ad25543f0d520e6b3f19

Download Submit
memory/2212-0-0x00000000745DE000-0x00000000745DF000-memory.dmp

Filesize
4KB

Download
memory/2212-1-0x0000000000A10000-0x0000000000A22000-memory.dmp

Filesize
72KB

Download
memory/2212-2-0x00000000745D0000-0x0000000074CBE000-memory.dmp

Filesize
6.9MB

Download
memory/2212-12-0x00000000745D0000-0x0000000074CBE000-memory.dmp

Filesize
6.9MB

Download
memory/3032-16-0x0000000000990000-0x00000000009A2000-memory.dmp

Filesize
72KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads