asyncrat | 53677ec9a71a72447531c8e81956df068800b738dae73ed46d700e01bea58745

General

Target

53677ec9a71a72447531c8e81956df068800b738dae73ed46d700e01bea58745.exe
Size

52KB
MD5

c3f34df135ab3ba4b0c8408a3fe041f8
SHA1

a26cc4fc291830ce9f4b5726fb196a3893c38dcb
SHA256

53677ec9a71a72447531c8e81956df068800b738dae73ed46d700e01bea58745
SHA512

2a6cb888d4bc6e5a234b2692f80d0389739f2c4994e2a5e705ca9ab57ee9e05292b4d9fa7a29309ca2859cfe8b596fb0720d42505050615206b1e048bb81a9a1
SSDEEP

1536:ouUDVT0d5262POAgB8CRbHUdlaacfKodd5N:ouUBT0d527OAgBZbHUaacDN

Score

10^/10

asyncrat default rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

C2

91.92.241.69:5555

Mutex

WZl6sjIAcmXI

Attributes

delay
3
install
true
install_file
AMD Update Manager.exe
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Roaming\AMD Update Manager.exe	family_asyncrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

53677ec9a71a72447531c8e81956df068800b738dae73ed46d700e01bea58745.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	53677ec9a71a72447531c8e81956df068800b738dae73ed46d700e01bea58745.exe

Executes dropped EXE 1 IoCs

Processes:

AMD Update Manager.exe

pid process

4028 AMD Update Manager.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

1992 schtasks.exe
Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

2364 timeout.exe

pid	process
4028	AMD Update Manager.exe

pid	process
1992	schtasks.exe

pid	process
2364	timeout.exe

Suspicious behavior: EnumeratesProcesses 23 IoCs

Processes:

53677ec9a71a72447531c8e81956df068800b738dae73ed46d700e01bea58745.exe

pid	process
4436	53677ec9a71a72447531c8e81956df068800b738dae73ed46d700e01bea58745.exe
4436	53677ec9a71a72447531c8e81956df068800b738dae73ed46d700e01bea58745.exe
4436	53677ec9a71a72447531c8e81956df068800b738dae73ed46d700e01bea58745.exe
4436	53677ec9a71a72447531c8e81956df068800b738dae73ed46d700e01bea58745.exe
4436	53677ec9a71a72447531c8e81956df068800b738dae73ed46d700e01bea58745.exe
4436	53677ec9a71a72447531c8e81956df068800b738dae73ed46d700e01bea58745.exe
4436	53677ec9a71a72447531c8e81956df068800b738dae73ed46d700e01bea58745.exe
4436	53677ec9a71a72447531c8e81956df068800b738dae73ed46d700e01bea58745.exe
4436	53677ec9a71a72447531c8e81956df068800b738dae73ed46d700e01bea58745.exe
4436	53677ec9a71a72447531c8e81956df068800b738dae73ed46d700e01bea58745.exe
4436	53677ec9a71a72447531c8e81956df068800b738dae73ed46d700e01bea58745.exe
4436	53677ec9a71a72447531c8e81956df068800b738dae73ed46d700e01bea58745.exe
4436	53677ec9a71a72447531c8e81956df068800b738dae73ed46d700e01bea58745.exe
4436	53677ec9a71a72447531c8e81956df068800b738dae73ed46d700e01bea58745.exe
4436	53677ec9a71a72447531c8e81956df068800b738dae73ed46d700e01bea58745.exe
4436	53677ec9a71a72447531c8e81956df068800b738dae73ed46d700e01bea58745.exe
4436	53677ec9a71a72447531c8e81956df068800b738dae73ed46d700e01bea58745.exe
4436	53677ec9a71a72447531c8e81956df068800b738dae73ed46d700e01bea58745.exe
4436	53677ec9a71a72447531c8e81956df068800b738dae73ed46d700e01bea58745.exe
4436	53677ec9a71a72447531c8e81956df068800b738dae73ed46d700e01bea58745.exe
4436	53677ec9a71a72447531c8e81956df068800b738dae73ed46d700e01bea58745.exe
4436	53677ec9a71a72447531c8e81956df068800b738dae73ed46d700e01bea58745.exe
4436	53677ec9a71a72447531c8e81956df068800b738dae73ed46d700e01bea58745.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

53677ec9a71a72447531c8e81956df068800b738dae73ed46d700e01bea58745.exeAMD Update Manager.exe

description	pid	process
Token: SeDebugPrivilege	4436	53677ec9a71a72447531c8e81956df068800b738dae73ed46d700e01bea58745.exe
Token: SeDebugPrivilege	4028	AMD Update Manager.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

53677ec9a71a72447531c8e81956df068800b738dae73ed46d700e01bea58745.execmd.execmd.exe

description	pid	process	target process
PID 4436 wrote to memory of 440	4436	53677ec9a71a72447531c8e81956df068800b738dae73ed46d700e01bea58745.exe	cmd.exe
PID 4436 wrote to memory of 440	4436	53677ec9a71a72447531c8e81956df068800b738dae73ed46d700e01bea58745.exe	cmd.exe
PID 4436 wrote to memory of 440	4436	53677ec9a71a72447531c8e81956df068800b738dae73ed46d700e01bea58745.exe	cmd.exe
PID 4436 wrote to memory of 4552	4436	53677ec9a71a72447531c8e81956df068800b738dae73ed46d700e01bea58745.exe	cmd.exe
PID 4436 wrote to memory of 4552	4436	53677ec9a71a72447531c8e81956df068800b738dae73ed46d700e01bea58745.exe	cmd.exe
PID 4436 wrote to memory of 4552	4436	53677ec9a71a72447531c8e81956df068800b738dae73ed46d700e01bea58745.exe	cmd.exe
PID 4552 wrote to memory of 2364	4552	cmd.exe	timeout.exe
PID 4552 wrote to memory of 2364	4552	cmd.exe	timeout.exe
PID 4552 wrote to memory of 2364	4552	cmd.exe	timeout.exe
PID 440 wrote to memory of 1992	440	cmd.exe	schtasks.exe
PID 440 wrote to memory of 1992	440	cmd.exe	schtasks.exe
PID 440 wrote to memory of 1992	440	cmd.exe	schtasks.exe
PID 4552 wrote to memory of 4028	4552	cmd.exe	AMD Update Manager.exe
PID 4552 wrote to memory of 4028	4552	cmd.exe	AMD Update Manager.exe
PID 4552 wrote to memory of 4028	4552	cmd.exe	AMD Update Manager.exe

C:\Users\Admin\AppData\Local\Temp\53677ec9a71a72447531c8e81956df068800b738dae73ed46d700e01bea58745.exe
"C:\Users\Admin\AppData\Local\Temp\53677ec9a71a72447531c8e81956df068800b738dae73ed46d700e01bea58745.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4436
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "AMD Update Manager" /tr '"C:\Users\Admin\AppData\Roaming\AMD Update Manager.exe"' & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:440
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /f /sc onlogon /rl highest /tn "AMD Update Manager" /tr '"C:\Users\Admin\AppData\Roaming\AMD Update Manager.exe"'
    3⤵
    - Creates scheduled task(s)
    PID:1992
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp606F.tmp.bat""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4552
- - C:\Windows\SysWOW64\timeout.exe
    timeout 3
    3⤵
    - Delays execution with timeout.exe
    PID:2364
- - C:\Users\Admin\AppData\Roaming\AMD Update Manager.exe
    "C:\Users\Admin\AppData\Roaming\AMD Update Manager.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:4028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp606F.tmp.bat

Filesize
162B

MD5
f20efc0615b950052948c73259f67830

SHA1
a7fa41348c02d27e17fa7c536650546536ad5543

SHA256
07ab04fae5beaac9b70b10bbd4f38cf693dfcc08b317ad3915ec3f5412d72047

SHA512
8a5ab3ce72fd3daac8fe081f384d11959a0b5fd8569c505743738d4da51225bfe9bc5d87ad49fe093e4155fa2b3924722dc6e7cf6788b3901c6db2822ce282d0

Download Submit
C:\Users\Admin\AppData\Roaming\AMD Update Manager.exe

Filesize
52KB

MD5
c3f34df135ab3ba4b0c8408a3fe041f8

SHA1
a26cc4fc291830ce9f4b5726fb196a3893c38dcb

SHA256
53677ec9a71a72447531c8e81956df068800b738dae73ed46d700e01bea58745

SHA512
2a6cb888d4bc6e5a234b2692f80d0389739f2c4994e2a5e705ca9ab57ee9e05292b4d9fa7a29309ca2859cfe8b596fb0720d42505050615206b1e048bb81a9a1

Download Submit
memory/4028-13-0x0000000074AE0000-0x0000000075290000-memory.dmp

Filesize
7.7MB

Download
memory/4028-16-0x0000000006580000-0x0000000006B24000-memory.dmp

Filesize
5.6MB

Download
memory/4028-17-0x00000000060A0000-0x0000000006106000-memory.dmp

Filesize
408KB

Download
memory/4028-18-0x0000000074AE0000-0x0000000075290000-memory.dmp

Filesize
7.7MB

Download
memory/4436-0-0x0000000074B8E000-0x0000000074B8F000-memory.dmp

Filesize
4KB

Download
memory/4436-1-0x0000000000E70000-0x0000000000E82000-memory.dmp

Filesize
72KB

Download
memory/4436-2-0x0000000074B80000-0x0000000075330000-memory.dmp

Filesize
7.7MB

Download
memory/4436-3-0x00000000058C0000-0x000000000595C000-memory.dmp

Filesize
624KB

Download
memory/4436-9-0x0000000074B80000-0x0000000075330000-memory.dmp

Filesize
7.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads