asyncrat | 9864678182d8d06ed1bebd8aad901cab4f77cfced7547f5e365e8c1854ef2cdf

General

Target

Cranium.exe
Size

48KB
MD5

0acff5a467301fe851017b11e1263334
SHA1

67282d4682edbb78cc3eded3d3621d20060e5517
SHA256

9864678182d8d06ed1bebd8aad901cab4f77cfced7547f5e365e8c1854ef2cdf
SHA512

ec18c72cf4184781fe3deffa64c6dbd48f75ba9d185f6fa689469e1aded7aa7e5705c0f7abb5173f9ace1db039fbd0dda6f4d07014cac179f59132925df6f70f
SSDEEP

768:6uYp9T3kH1jWUvTqRmo2qb2v8eIfEePIL1/Yr90bzZR51guD6NpHqS/9OuBDZ0C:6uYp9T34y2PZuEnp/9bzZR7guD8R/91L

Score

10^/10

asyncrat default rat spyware stealer

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

Mutex

HVo4diHzRR9N

Attributes

delay
3
install
true
install_file
Cranium.exe
install_folder
%Temp%
pastebin_config
https://pastebin.com/raw/d3N8c1P9

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Cranium.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	Cranium.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service
T1102

Processes:

flow ioc

20 pastebin.com
22 pastebin.com
26 5.tcp.eu.ngrok.io
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

4368 timeout.exe
Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

Cranium.exe

pid process

3344 Cranium.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Cranium.exe

description pid process

Token: SeDebugPrivilege 3344 Cranium.exe
Token: SeDebugPrivilege 3344 Cranium.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

Cranium.exe

pid process

3344 Cranium.exe

flow	ioc
20	pastebin.com
22	pastebin.com
26	5.tcp.eu.ngrok.io

pid	process
4368	timeout.exe

pid	process
3344	Cranium.exe

description	pid	process
Token: SeDebugPrivilege	3344	Cranium.exe
Token: SeDebugPrivilege	3344	Cranium.exe

pid	process
3344	Cranium.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

Cranium.execmd.execmd.exe

description	pid	process	target process
PID 3344 wrote to memory of 4768	3344	Cranium.exe	cmd.exe
PID 3344 wrote to memory of 4768	3344	Cranium.exe	cmd.exe
PID 3344 wrote to memory of 4768	3344	Cranium.exe	cmd.exe
PID 3344 wrote to memory of 3036	3344	Cranium.exe	cmd.exe
PID 3344 wrote to memory of 3036	3344	Cranium.exe	cmd.exe
PID 3344 wrote to memory of 3036	3344	Cranium.exe	cmd.exe
PID 4768 wrote to memory of 1712	4768	cmd.exe	schtasks.exe
PID 4768 wrote to memory of 1712	4768	cmd.exe	schtasks.exe
PID 4768 wrote to memory of 1712	4768	cmd.exe	schtasks.exe
PID 3036 wrote to memory of 4368	3036	cmd.exe	timeout.exe
PID 3036 wrote to memory of 4368	3036	cmd.exe	timeout.exe
PID 3036 wrote to memory of 4368	3036	cmd.exe	timeout.exe

C:\Users\Admin\AppData\Local\Temp\Cranium.exe
"C:\Users\Admin\AppData\Local\Temp\Cranium.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3344
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /delete /f /tn "Cranium"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4768
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /f /tn "Cranium"
    3⤵
    PID:1712
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp8095.tmp.bat""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3036
- - C:\Windows\SysWOW64\timeout.exe
    timeout 3
    3⤵
    - Delays execution with timeout.exe
    PID:4368

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp8095.tmp.bat

Filesize
159B

MD5
49d1d4e4f39cfd539d4a88c49c22cdef

SHA1
19fc4eac6ed8282e76bdf86e82473ad6320e742a

SHA256
b8ffcda21b360422bd0fb94f762ab2456b4eee1113105203dc73e1bbbf46fd0e

SHA512
d1aa04695140d93c5574c8cd997b2d58d8ed98b150d8bc620c8b743090582e2d7d1eb36360b3ba3e3b86b4d89e50137d1d7c11892cc8b85b8c265629e48d0f48

Download Submit
memory/3344-12-0x0000000006B20000-0x0000000006BBC000-memory.dmp

Filesize
624KB

Download
memory/3344-3-0x0000000004B80000-0x0000000004BE6000-memory.dmp

Filesize
408KB

Download
memory/3344-14-0x0000000006C30000-0x0000000006C70000-memory.dmp

Filesize
256KB

Download
memory/3344-4-0x0000000004FD0000-0x000000000506C000-memory.dmp

Filesize
624KB

Download
memory/3344-7-0x0000000006090000-0x0000000006634000-memory.dmp

Filesize
5.6MB

Download
memory/3344-8-0x00000000067C0000-0x0000000006836000-memory.dmp

Filesize
472KB

Download
memory/3344-9-0x0000000006740000-0x00000000067A8000-memory.dmp

Filesize
416KB

Download
memory/3344-10-0x0000000006890000-0x00000000068AE000-memory.dmp

Filesize
120KB

Download
memory/3344-15-0x0000000006A10000-0x0000000006A1A000-memory.dmp

Filesize
40KB

Download
memory/3344-0-0x000000007528E000-0x000000007528F000-memory.dmp

Filesize
4KB

Download
memory/3344-1-0x0000000000180000-0x0000000000192000-memory.dmp

Filesize
72KB

Download
memory/3344-2-0x0000000075280000-0x0000000075A30000-memory.dmp

Filesize
7.7MB

Download
memory/3344-11-0x0000000006A80000-0x0000000006B12000-memory.dmp

Filesize
584KB

Download
memory/3344-16-0x000000007528E000-0x000000007528F000-memory.dmp

Filesize
4KB

Download
memory/3344-17-0x0000000075280000-0x0000000075A30000-memory.dmp

Filesize
7.7MB

Download
memory/3344-18-0x0000000006C80000-0x0000000006CE2000-memory.dmp

Filesize
392KB

Download
memory/3344-19-0x0000000007150000-0x000000000715A000-memory.dmp

Filesize
40KB

Download
memory/3344-20-0x0000000006FC0000-0x0000000007024000-memory.dmp

Filesize
400KB

Download
memory/3344-21-0x0000000007090000-0x00000000070F4000-memory.dmp

Filesize
400KB

Download
memory/3344-22-0x0000000007470000-0x00000000074D4000-memory.dmp

Filesize
400KB

Download
memory/3344-26-0x0000000075280000-0x0000000075A30000-memory.dmp

Filesize
7.7MB

Download
memory/3344-13-0x0000000006A00000-0x0000000006A08000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing