asyncrat | 37157625bef24977ce0cf11e74b3d5c8412a0638b541e51cc0944b5127b2469d

Analysis

max time kernel
132s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
24-05-2024 15:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

37157625bef24977ce0cf11e74b3d5c8412a0638b541e51cc0944b5127b2469d.exe
Size

1.8MB
MD5

dd256157a85a12405cbdf789af1b2442
SHA1

215b9612eec327982a956ada1c5c9ca0cb934b0b
SHA256

37157625bef24977ce0cf11e74b3d5c8412a0638b541e51cc0944b5127b2469d
SHA512

4e6b8dcc6cf00c85d3a68a412555e370a5d63ee480594e7a7ee6f8289e2873ea4b2860d6e5a7e3bd77ea1c079132ecbf9010bb6e47683c6c49ac640357fee2f3
SSDEEP

49152:P1opHluallLeIfGpD+ePfGaBbVoJLshVGbdMeaLaf:N2HluaDp7WmeJaf

Score

10^/10

asyncrat oro-benditos 2 persistence rat

Malware Config

Extracted

Family

asyncrat

Version

1.0.7

Botnet

ORO-BENDITOS 2

krakenstudio061Q.casacam.net:8002

Mutex

DcRatMutex_qwqdanchun

Attributes

delay
1
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

37157625bef24977ce0cf11e74b3d5c8412a0638b541e51cc0944b5127b2469d.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SmokerLtd = "C:\\Users\\Admin\\Documents\\Umunu\\uOperna.exe"	37157625bef24977ce0cf11e74b3d5c8412a0638b541e51cc0944b5127b2469d.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

37157625bef24977ce0cf11e74b3d5c8412a0638b541e51cc0944b5127b2469d.exe

description	pid	process	target process
PID 3348 set thread context of 3168	3348	37157625bef24977ce0cf11e74b3d5c8412a0638b541e51cc0944b5127b2469d.exe	csc.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

csc.exe

description pid process

Token: SeDebugPrivilege 3168 csc.exe

description	pid	process
Token: SeDebugPrivilege	3168	csc.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

37157625bef24977ce0cf11e74b3d5c8412a0638b541e51cc0944b5127b2469d.exe

description	pid	process	target process
PID 3348 wrote to memory of 3168	3348	37157625bef24977ce0cf11e74b3d5c8412a0638b541e51cc0944b5127b2469d.exe	csc.exe
PID 3348 wrote to memory of 3168	3348	37157625bef24977ce0cf11e74b3d5c8412a0638b541e51cc0944b5127b2469d.exe	csc.exe
PID 3348 wrote to memory of 3168	3348	37157625bef24977ce0cf11e74b3d5c8412a0638b541e51cc0944b5127b2469d.exe	csc.exe
PID 3348 wrote to memory of 3168	3348	37157625bef24977ce0cf11e74b3d5c8412a0638b541e51cc0944b5127b2469d.exe	csc.exe
PID 3348 wrote to memory of 3168	3348	37157625bef24977ce0cf11e74b3d5c8412a0638b541e51cc0944b5127b2469d.exe	csc.exe

C:\Users\Admin\AppData\Local\Temp\37157625bef24977ce0cf11e74b3d5c8412a0638b541e51cc0944b5127b2469d.exe
"C:\Users\Admin\AppData\Local\Temp\37157625bef24977ce0cf11e74b3d5c8412a0638b541e51cc0944b5127b2469d.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3348

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3168

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3168-6-0x0000000073D50000-0x0000000074500000-memory.dmp

Filesize
7.7MB

Download
memory/3168-10-0x0000000006280000-0x0000000006824000-memory.dmp

Filesize
5.6MB

Download
memory/3168-15-0x0000000073D50000-0x0000000074500000-memory.dmp

Filesize
7.7MB

Download
memory/3168-3-0x0000000000A10000-0x0000000000A22000-memory.dmp

Filesize
72KB

Download
memory/3168-9-0x0000000005C30000-0x0000000005CCC000-memory.dmp

Filesize
624KB

Download
memory/3168-5-0x0000000073D5E000-0x0000000073D5F000-memory.dmp

Filesize
4KB

Download
memory/3168-14-0x0000000073D50000-0x0000000074500000-memory.dmp

Filesize
7.7MB

Download
memory/3168-13-0x0000000073D5E000-0x0000000073D5F000-memory.dmp

Filesize
4KB

Download
memory/3168-12-0x0000000073D50000-0x0000000074500000-memory.dmp

Filesize
7.7MB

Download
memory/3168-11-0x0000000005CD0000-0x0000000005D36000-memory.dmp

Filesize
408KB

Download
memory/3348-4-0x0000000000400000-0x00000000005DB000-memory.dmp

Filesize
1.9MB

Download
memory/3348-0-0x0000000000400000-0x00000000005DB000-memory.dmp

Filesize
1.9MB

Download
memory/3348-2-0x0000000000400000-0x00000000005DB000-memory.dmp

Filesize
1.9MB

Download
memory/3348-1-0x000000000040C000-0x0000000000425000-memory.dmp

Filesize
100KB

Download