asyncrat | c1000bb63421d408df4d0b3869163a95d33c1682b14a3710a41aec00c986ea3e

General

Target

AsyncClient.exe
Size

47KB
MD5

b600b84e2c0d59eec1edf643e07c529f
SHA1

2541870884411c007991150f21fe0ff814041e13
SHA256

c1000bb63421d408df4d0b3869163a95d33c1682b14a3710a41aec00c986ea3e
SHA512

7372e3708a66de6eee1f9ebf9b9761f566c8c1fcdca79aa5ce21cf62593035623cf5a49386194b3cd57f5a5a4c5ba0c74e0277dec7b4b598a9e6f8806634b355
SSDEEP

768:suI1tT/w70kWUquzumo2qzj2OUM0EtE/43aPINPW98HxC0bsIpz461ochiX/Sjo2:suI1tT/kW2euEtEgjN5HfbsIesof//dW

Score

10^/10

asyncrat default rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

C2

127.0.0.1:6606

127.0.0.1:7707

127.0.0.1:8808

Mutex

wv97guKzbU2n

Attributes

delay
3
install
true
install_file
Issas.exe
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral1/files/0x000a000000012029-13.dat	family_asyncrat

Executes dropped EXE 1 IoCs

pid	Process
2596	Issas.exe

Loads dropped DLL 1 IoCs

pid	Process
2840	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
2412	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2716	schtasks.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2772	AsyncClient.exe
2772	AsyncClient.exe
2772	AsyncClient.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2772	AsyncClient.exe
Token: SeDebugPrivilege	2596	Issas.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2772 wrote to memory of 1800	2772	AsyncClient.exe	30
PID 2772 wrote to memory of 1800	2772	AsyncClient.exe	30
PID 2772 wrote to memory of 1800	2772	AsyncClient.exe	30
PID 2772 wrote to memory of 1800	2772	AsyncClient.exe	30
PID 2772 wrote to memory of 2840	2772	AsyncClient.exe	31
PID 2772 wrote to memory of 2840	2772	AsyncClient.exe	31
PID 2772 wrote to memory of 2840	2772	AsyncClient.exe	31
PID 2772 wrote to memory of 2840	2772	AsyncClient.exe	31
PID 2840 wrote to memory of 2412	2840	cmd.exe	34
PID 2840 wrote to memory of 2412	2840	cmd.exe	34
PID 2840 wrote to memory of 2412	2840	cmd.exe	34
PID 2840 wrote to memory of 2412	2840	cmd.exe	34
PID 1800 wrote to memory of 2716	1800	cmd.exe	35
PID 1800 wrote to memory of 2716	1800	cmd.exe	35
PID 1800 wrote to memory of 2716	1800	cmd.exe	35
PID 1800 wrote to memory of 2716	1800	cmd.exe	35
PID 2840 wrote to memory of 2596	2840	cmd.exe	36
PID 2840 wrote to memory of 2596	2840	cmd.exe	36
PID 2840 wrote to memory of 2596	2840	cmd.exe	36
PID 2840 wrote to memory of 2596	2840	cmd.exe	36

C:\Users\Admin\AppData\Local\Temp\AsyncClient.exe
"C:\Users\Admin\AppData\Local\Temp\AsyncClient.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2772
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Issas" /tr '"C:\Users\Admin\AppData\Roaming\Issas.exe"' & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1800
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /f /sc onlogon /rl highest /tn "Issas" /tr '"C:\Users\Admin\AppData\Roaming\Issas.exe"'
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2716
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp63C2.tmp.bat""
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2840
- - C:\Windows\SysWOW64\timeout.exe
    timeout 3
    3⤵
    - Delays execution with timeout.exe
    PID:2412
- - C:\Users\Admin\AppData\Roaming\Issas.exe
    "C:\Users\Admin\AppData\Roaming\Issas.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:2596

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp63C2.tmp.bat

Filesize
149B

MD5
7e74a670b1f526e7fb108de6dc0103e6

SHA1
b8d110e17ffe5a1976283212437b63e541ae8966

SHA256
090170a2bb4fc84dd752a9d4c677a849d045084e46bba1aa7e1091fea8d4c28e

SHA512
d21194ac74fe6dcee745574371c643cd33a8f2f3f3cf38dbc11ebc1132a833a3953c3d47414094710e0d5969eb5edd7eb78e077cb94f393cc6f462897903f2d2

Download Submit
\Users\Admin\AppData\Roaming\Issas.exe

Filesize
47KB

MD5
b600b84e2c0d59eec1edf643e07c529f

SHA1
2541870884411c007991150f21fe0ff814041e13

SHA256
c1000bb63421d408df4d0b3869163a95d33c1682b14a3710a41aec00c986ea3e

SHA512
7372e3708a66de6eee1f9ebf9b9761f566c8c1fcdca79aa5ce21cf62593035623cf5a49386194b3cd57f5a5a4c5ba0c74e0277dec7b4b598a9e6f8806634b355

Download Submit
memory/2596-16-0x0000000000240000-0x0000000000252000-memory.dmp

Filesize
72KB

Download
memory/2772-0-0x000000007414E000-0x000000007414F000-memory.dmp

Filesize
4KB

Download
memory/2772-1-0x0000000001340000-0x0000000001352000-memory.dmp

Filesize
72KB

Download
memory/2772-2-0x0000000074140000-0x000000007482E000-memory.dmp

Filesize
6.9MB

Download
memory/2772-11-0x0000000074140000-0x000000007482E000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads