asyncrat | 37157625bef24977ce0cf11e74b3d5c8412a0638b541e51cc0944b5127b2469d

Analysis

max time kernel
119s
max time network
145s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
24-05-2024 15:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

37157625bef24977ce0cf11e74b3d5c8412a0638b541e51cc0944b5127b2469d.exe
Size

1.8MB
MD5

dd256157a85a12405cbdf789af1b2442
SHA1

215b9612eec327982a956ada1c5c9ca0cb934b0b
SHA256

37157625bef24977ce0cf11e74b3d5c8412a0638b541e51cc0944b5127b2469d
SHA512

4e6b8dcc6cf00c85d3a68a412555e370a5d63ee480594e7a7ee6f8289e2873ea4b2860d6e5a7e3bd77ea1c079132ecbf9010bb6e47683c6c49ac640357fee2f3
SSDEEP

49152:P1opHluallLeIfGpD+ePfGaBbVoJLshVGbdMeaLaf:N2HluaDp7WmeJaf

Score

10^/10

asyncrat oro-benditos 2 persistence rat

Malware Config

Extracted

Family

asyncrat

Version

1.0.7

Botnet

ORO-BENDITOS 2

krakenstudio061Q.casacam.net:8002

Mutex

DcRatMutex_qwqdanchun

Attributes

delay
1
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

37157625bef24977ce0cf11e74b3d5c8412a0638b541e51cc0944b5127b2469d.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\SmokerLtd = "C:\\Users\\Admin\\Documents\\Umunu\\uOperna.exe"	37157625bef24977ce0cf11e74b3d5c8412a0638b541e51cc0944b5127b2469d.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

37157625bef24977ce0cf11e74b3d5c8412a0638b541e51cc0944b5127b2469d.exe

description	pid	process	target process
PID 2416 set thread context of 1160	2416	37157625bef24977ce0cf11e74b3d5c8412a0638b541e51cc0944b5127b2469d.exe	csc.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

csc.exe

description pid process

Token: SeDebugPrivilege 1160 csc.exe

description	pid	process
Token: SeDebugPrivilege	1160	csc.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

37157625bef24977ce0cf11e74b3d5c8412a0638b541e51cc0944b5127b2469d.exe

description	pid	process	target process
PID 2416 wrote to memory of 1160	2416	37157625bef24977ce0cf11e74b3d5c8412a0638b541e51cc0944b5127b2469d.exe	csc.exe
PID 2416 wrote to memory of 1160	2416	37157625bef24977ce0cf11e74b3d5c8412a0638b541e51cc0944b5127b2469d.exe	csc.exe
PID 2416 wrote to memory of 1160	2416	37157625bef24977ce0cf11e74b3d5c8412a0638b541e51cc0944b5127b2469d.exe	csc.exe
PID 2416 wrote to memory of 1160	2416	37157625bef24977ce0cf11e74b3d5c8412a0638b541e51cc0944b5127b2469d.exe	csc.exe
PID 2416 wrote to memory of 1160	2416	37157625bef24977ce0cf11e74b3d5c8412a0638b541e51cc0944b5127b2469d.exe	csc.exe
PID 2416 wrote to memory of 1160	2416	37157625bef24977ce0cf11e74b3d5c8412a0638b541e51cc0944b5127b2469d.exe	csc.exe

C:\Users\Admin\AppData\Local\Temp\37157625bef24977ce0cf11e74b3d5c8412a0638b541e51cc0944b5127b2469d.exe
"C:\Users\Admin\AppData\Local\Temp\37157625bef24977ce0cf11e74b3d5c8412a0638b541e51cc0944b5127b2469d.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2416
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1160

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1160-7-0x0000000000080000-0x0000000000092000-memory.dmp

Filesize
72KB

Download
memory/1160-3-0x0000000000080000-0x0000000000092000-memory.dmp

Filesize
72KB

Download
memory/1160-4-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/1160-5-0x0000000000080000-0x0000000000092000-memory.dmp

Filesize
72KB

Download
memory/1160-9-0x0000000000080000-0x0000000000092000-memory.dmp

Filesize
72KB

Download
memory/1160-11-0x000000007472E000-0x000000007472F000-memory.dmp

Filesize
4KB

Download
memory/1160-12-0x0000000074720000-0x0000000074E0E000-memory.dmp

Filesize
6.9MB

Download
memory/1160-30-0x000000007472E000-0x000000007472F000-memory.dmp

Filesize
4KB

Download
memory/1160-31-0x0000000074720000-0x0000000074E0E000-memory.dmp

Filesize
6.9MB

Download
memory/2416-2-0x0000000000400000-0x00000000005DB000-memory.dmp

Filesize
1.9MB

Download
memory/2416-1-0x000000000040C000-0x0000000000425000-memory.dmp

Filesize
100KB

Download
memory/2416-0-0x0000000000400000-0x00000000005DB000-memory.dmp

Filesize
1.9MB

Download
memory/2416-10-0x0000000000400000-0x00000000005DB000-memory.dmp

Filesize
1.9MB

Download