asyncrat | d948a6af0e9a1e9981669d300da54d84e526fc55e9654b8de1ba58821e14b96b

General

Target

Optimix_client.exe
Size

45KB
MD5

bc9efb1b76331a392346d4cce9c3b177
SHA1

ecd6d5584ab75f5735a69864ecf74dddde8683a1
SHA256

d948a6af0e9a1e9981669d300da54d84e526fc55e9654b8de1ba58821e14b96b
SHA512

4969259be841c308d791c16d0645e8f72db3f8708975bd9682ae630cca4c8f27b778d48387b5f17f1a1d82f3b8392cfbe95f8d5cd860ad25543f0d520e6b3f19
SSDEEP

768:luAINTHkvSbWUnFKJmo2q7XIrzXIxOPILzjbjXgXAiHFeq1BDZPx:luAINTHgN2Lv83L3bEX9leqbdPx

Score

10^/10

asyncrat default rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

C2

192.168.0.76:6606

192.168.0.76:7707

192.168.0.76:8808

192.168.0.76:4444

Mutex

YNGv5uoT0xzv

Attributes

delay
3
install
true
install_file
ProtonyteAntiVirusSetup.exe
install_folder
%Temp%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\ProtonyteAntiVirusSetup.exe	family_asyncrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Optimix_client.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	Optimix_client.exe

Executes dropped EXE 1 IoCs

Processes:

ProtonyteAntiVirusSetup.exe

pid process

4580 ProtonyteAntiVirusSetup.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

1764 schtasks.exe
Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

3716 timeout.exe

pid	process
4580	ProtonyteAntiVirusSetup.exe

pid	process
1764	schtasks.exe

pid	process
3716	timeout.exe

Suspicious behavior: EnumeratesProcesses 21 IoCs

Processes:

Optimix_client.exe

pid	process
3972	Optimix_client.exe
3972	Optimix_client.exe
3972	Optimix_client.exe
3972	Optimix_client.exe
3972	Optimix_client.exe
3972	Optimix_client.exe
3972	Optimix_client.exe
3972	Optimix_client.exe
3972	Optimix_client.exe
3972	Optimix_client.exe
3972	Optimix_client.exe
3972	Optimix_client.exe
3972	Optimix_client.exe
3972	Optimix_client.exe
3972	Optimix_client.exe
3972	Optimix_client.exe
3972	Optimix_client.exe
3972	Optimix_client.exe
3972	Optimix_client.exe
3972	Optimix_client.exe
3972	Optimix_client.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Optimix_client.exeProtonyteAntiVirusSetup.exe

description pid process

Token: SeDebugPrivilege 3972 Optimix_client.exe
Token: SeDebugPrivilege 4580 ProtonyteAntiVirusSetup.exe

description	pid	process
Token: SeDebugPrivilege	3972	Optimix_client.exe
Token: SeDebugPrivilege	4580	ProtonyteAntiVirusSetup.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

Optimix_client.execmd.execmd.exe

description	pid	process	target process
PID 3972 wrote to memory of 3984	3972	Optimix_client.exe	cmd.exe
PID 3972 wrote to memory of 3984	3972	Optimix_client.exe	cmd.exe
PID 3972 wrote to memory of 3984	3972	Optimix_client.exe	cmd.exe
PID 3972 wrote to memory of 4436	3972	Optimix_client.exe	cmd.exe
PID 3972 wrote to memory of 4436	3972	Optimix_client.exe	cmd.exe
PID 3972 wrote to memory of 4436	3972	Optimix_client.exe	cmd.exe
PID 4436 wrote to memory of 3716	4436	cmd.exe	timeout.exe
PID 4436 wrote to memory of 3716	4436	cmd.exe	timeout.exe
PID 4436 wrote to memory of 3716	4436	cmd.exe	timeout.exe
PID 3984 wrote to memory of 1764	3984	cmd.exe	schtasks.exe
PID 3984 wrote to memory of 1764	3984	cmd.exe	schtasks.exe
PID 3984 wrote to memory of 1764	3984	cmd.exe	schtasks.exe
PID 4436 wrote to memory of 4580	4436	cmd.exe	ProtonyteAntiVirusSetup.exe
PID 4436 wrote to memory of 4580	4436	cmd.exe	ProtonyteAntiVirusSetup.exe
PID 4436 wrote to memory of 4580	4436	cmd.exe	ProtonyteAntiVirusSetup.exe

C:\Users\Admin\AppData\Local\Temp\Optimix_client.exe
"C:\Users\Admin\AppData\Local\Temp\Optimix_client.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3972

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "ProtonyteAntiVirusSetup" /tr '"C:\Users\Admin\AppData\Local\Temp\ProtonyteAntiVirusSetup.exe"' & exit
2⤵
- Suspicious use of WriteProcessMemory
PID:3984

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /f /sc onlogon /rl highest /tn "ProtonyteAntiVirusSetup" /tr '"C:\Users\Admin\AppData\Local\Temp\ProtonyteAntiVirusSetup.exe"'
3⤵
- Creates scheduled task(s)
PID:1764

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp4D45.tmp.bat""
2⤵
- Suspicious use of WriteProcessMemory
PID:4436

C:\Windows\SysWOW64\timeout.exe
timeout 3
3⤵
- Delays execution with timeout.exe
PID:3716

C:\Users\Admin\AppData\Local\Temp\ProtonyteAntiVirusSetup.exe
"C:\Users\Admin\AppData\Local\Temp\ProtonyteAntiVirusSetup.exe"
3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4580

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\ProtonyteAntiVirusSetup.exe
Filesize
45KB

MD5
bc9efb1b76331a392346d4cce9c3b177

SHA1
ecd6d5584ab75f5735a69864ecf74dddde8683a1

SHA256
d948a6af0e9a1e9981669d300da54d84e526fc55e9654b8de1ba58821e14b96b

SHA512
4969259be841c308d791c16d0645e8f72db3f8708975bd9682ae630cca4c8f27b778d48387b5f17f1a1d82f3b8392cfbe95f8d5cd860ad25543f0d520e6b3f19

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp4D45.tmp.bat
Filesize
170B

MD5
62de602f5aa66c0a06cc9fcbf381d615

SHA1
656358844befc8331cf7521c53f619147e32fa4f

SHA256
e0a934c27c6c687c5d6193f61c44099bd41d4cc6cffe7cdb3f9f7c572084efab

SHA512
05c4d35a8cf23e63b1b79819e990bfb5e68821fe286feeea1437d85128ec0b9cef4c1ee2aee2ea2d90264b0bbc75e8e79e424d6c496f19c560a62b7b67857103

Download Submit
memory/3972-0-0x0000000074FBE000-0x0000000074FBF000-memory.dmp

Filesize
4KB

Download
memory/3972-1-0x0000000000D50000-0x0000000000D62000-memory.dmp

Filesize
72KB

Download
memory/3972-2-0x0000000074FB0000-0x0000000075760000-memory.dmp

Filesize
7.7MB

Download
memory/3972-3-0x0000000005710000-0x00000000057AC000-memory.dmp

Filesize
624KB

Download
memory/3972-9-0x0000000074FB0000-0x0000000075760000-memory.dmp

Filesize
7.7MB

Download
memory/4580-13-0x0000000074F10000-0x00000000756C0000-memory.dmp

Filesize
7.7MB

Download
memory/4580-14-0x0000000074F10000-0x00000000756C0000-memory.dmp

Filesize
7.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads