asyncrat | 842f83e6ba429b2f09bf50de8aca1b5d9ca9a78b00ee09087dd6c518852b0446

General

Target

f5efd1b435706c4eb87582528b1f34825765cc5324f768a93d763b31642f8263.exe
Size

48KB
MD5

36b7614f2f6b0788e6c2be5def44c68f
SHA1

0aca41d981fbc11d8eee8d7c668fc68637b4985c
SHA256

f5efd1b435706c4eb87582528b1f34825765cc5324f768a93d763b31642f8263
SHA512

b1243336e444127b0931c9cc5ce7e364540dd1fba1d25e9b7384e6d1d6d68036d7ea46b2c56592c20891d2d085af319286eda4eef57c1056bed97abdcb1d2449
SSDEEP

768:AukzVT0kLd3WULgPdVmo2qDnJTTb2cWss3kPIDeR+0b01D1wKgHEujzhrNYNKBDq:AukzVT0Mq12qJnHDyJDeRxb0nngkuprw

Score

10^/10

asyncrat default rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

Default

C2

61.14.233.130:6606

61.14.233.130:7707

61.14.233.130:8808

Mutex

AsyncMutex_6SI8OkPnk

Attributes

delay
3
install
true
install_file
Sysbin.exe
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral1/files/0x000a00000001227f-14.dat	family_asyncrat

Executes dropped EXE 1 IoCs

pid	Process
2696	Sysbin.exe

Loads dropped DLL 1 IoCs

pid	Process
2820	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2368	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
2076	timeout.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2372	f5efd1b435706c4eb87582528b1f34825765cc5324f768a93d763b31642f8263.exe
2372	f5efd1b435706c4eb87582528b1f34825765cc5324f768a93d763b31642f8263.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2372	f5efd1b435706c4eb87582528b1f34825765cc5324f768a93d763b31642f8263.exe
Token: SeDebugPrivilege	2696	Sysbin.exe
Token: SeDebugPrivilege	2696	Sysbin.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2372 wrote to memory of 2428	2372	f5efd1b435706c4eb87582528b1f34825765cc5324f768a93d763b31642f8263.exe	28
PID 2372 wrote to memory of 2428	2372	f5efd1b435706c4eb87582528b1f34825765cc5324f768a93d763b31642f8263.exe	28
PID 2372 wrote to memory of 2428	2372	f5efd1b435706c4eb87582528b1f34825765cc5324f768a93d763b31642f8263.exe	28
PID 2372 wrote to memory of 2428	2372	f5efd1b435706c4eb87582528b1f34825765cc5324f768a93d763b31642f8263.exe	28
PID 2372 wrote to memory of 2820	2372	f5efd1b435706c4eb87582528b1f34825765cc5324f768a93d763b31642f8263.exe	30
PID 2372 wrote to memory of 2820	2372	f5efd1b435706c4eb87582528b1f34825765cc5324f768a93d763b31642f8263.exe	30
PID 2372 wrote to memory of 2820	2372	f5efd1b435706c4eb87582528b1f34825765cc5324f768a93d763b31642f8263.exe	30
PID 2372 wrote to memory of 2820	2372	f5efd1b435706c4eb87582528b1f34825765cc5324f768a93d763b31642f8263.exe	30
PID 2428 wrote to memory of 2368	2428	cmd.exe	32
PID 2428 wrote to memory of 2368	2428	cmd.exe	32
PID 2428 wrote to memory of 2368	2428	cmd.exe	32
PID 2428 wrote to memory of 2368	2428	cmd.exe	32
PID 2820 wrote to memory of 2076	2820	cmd.exe	33
PID 2820 wrote to memory of 2076	2820	cmd.exe	33
PID 2820 wrote to memory of 2076	2820	cmd.exe	33
PID 2820 wrote to memory of 2076	2820	cmd.exe	33
PID 2820 wrote to memory of 2696	2820	cmd.exe	34
PID 2820 wrote to memory of 2696	2820	cmd.exe	34
PID 2820 wrote to memory of 2696	2820	cmd.exe	34
PID 2820 wrote to memory of 2696	2820	cmd.exe	34

C:\Users\Admin\AppData\Local\Temp\f5efd1b435706c4eb87582528b1f34825765cc5324f768a93d763b31642f8263.exe
"C:\Users\Admin\AppData\Local\Temp\f5efd1b435706c4eb87582528b1f34825765cc5324f768a93d763b31642f8263.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2372
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Sysbin" /tr '"C:\Users\Admin\AppData\Roaming\Sysbin.exe"' & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2428
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /f /sc onlogon /rl highest /tn "Sysbin" /tr '"C:\Users\Admin\AppData\Roaming\Sysbin.exe"'
    3⤵
    - Creates scheduled task(s)
    PID:2368
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp28D5.tmp.bat""
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2820
- - C:\Windows\SysWOW64\timeout.exe
    timeout 3
    3⤵
    - Delays execution with timeout.exe
    PID:2076
- - C:\Users\Admin\AppData\Roaming\Sysbin.exe
    "C:\Users\Admin\AppData\Roaming\Sysbin.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:2696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp28D5.tmp.bat

Filesize
150B

MD5
a3627e13813e822f06ccbc8e6ba2ec43

SHA1
9c60cccc8f33a1460ba107f06e7941fbf3824909

SHA256
7a5543aad5308d47bfdcd42f1657b689525b63e451d478129fd9115d78164475

SHA512
ff614df12920426b026abe832e8d60ef09f90820800af360e84c780fc5117a8bfc9da1b216bcf73e39f5c7f9eeeea256a16cdd76eafa73c69d4ad528427ed945

Download Submit
C:\Users\Admin\AppData\Roaming\Sysbin.exe

Filesize
48KB

MD5
36b7614f2f6b0788e6c2be5def44c68f

SHA1
0aca41d981fbc11d8eee8d7c668fc68637b4985c

SHA256
f5efd1b435706c4eb87582528b1f34825765cc5324f768a93d763b31642f8263

SHA512
b1243336e444127b0931c9cc5ce7e364540dd1fba1d25e9b7384e6d1d6d68036d7ea46b2c56592c20891d2d085af319286eda4eef57c1056bed97abdcb1d2449

Download Submit
memory/2372-1-0x0000000000C10000-0x0000000000C22000-memory.dmp

Filesize
72KB

Download
memory/2372-0-0x00000000747AE000-0x00000000747AF000-memory.dmp

Filesize
4KB

Download
memory/2372-2-0x00000000747A0000-0x0000000074E8E000-memory.dmp

Filesize
6.9MB

Download
memory/2372-12-0x00000000747A0000-0x0000000074E8E000-memory.dmp

Filesize
6.9MB

Download
memory/2696-16-0x0000000000050000-0x0000000000062000-memory.dmp

Filesize
72KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads