asyncrat | 333bb61be5eb4be9c261a3f99c144cf7be0cee3c00898c1ac6a6c886469e1ab1

Analysis

max time kernel
147s
max time network
153s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
14-07-2024 08:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

333bb61be5eb4be9c261a3f99c144cf7be0cee3c00898c1ac6a6c886469e1ab1.exe
Size

1.5MB
MD5

db361206702d61f0beff5f87508152e5
SHA1

88e52c01ac24fc062221841948700c482090b145
SHA256

333bb61be5eb4be9c261a3f99c144cf7be0cee3c00898c1ac6a6c886469e1ab1
SHA512

3e6d49fbddaf6b005aa087c1345ddd156c43ae0b77f2eed4bc6d120b74ef3157414728066246ba8fa92e715abbb0a8e0704e2bf29fba4249454530ae8de80c74
SSDEEP

24576:Bj8PZOWNKI9g7XEJ859lSYbd0OW5FwBy47rKDBhU6OC2nfLyf7MBTPanM:BEQWlm685KGd0Ogwj7WDk6zOba

Score

10^/10

asyncrat redline tpb-grenn infostealer persistence rat

Malware Config

Extracted

Family

redline

Botnet

TPB-GRENN

amrican-sport-live-stream.cc:4581

Attributes

auth_value
2a11f38d280b0650ef9616b38e3ae877

Extracted

Family

asyncrat

Version

0.5.7B

Mutex

Aakn1515knAakn1515kn

Attributes

c2_url_file
http://update-checker-status.cc/OCB-Async.txt
delay
3
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,\"C:\\Users\\Admin\\AppData\\Roaming\\BREbererbFEcAC\\brwber.EXE\","	333bb61be5eb4be9c261a3f99c144cf7be0cee3c00898c1ac6a6c886469e1ab1.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Executes dropped EXE 1 IoCs

pid	Process
2640	Pipppuccxtivwagftpb-grenn - reddomain-obufcastesolution.exe

Loads dropped DLL 1 IoCs

pid	Process
2220	333bb61be5eb4be9c261a3f99c144cf7be0cee3c00898c1ac6a6c886469e1ab1.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2220 set thread context of 2900	2220	333bb61be5eb4be9c261a3f99c144cf7be0cee3c00898c1ac6a6c886469e1ab1.exe	34

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2220	333bb61be5eb4be9c261a3f99c144cf7be0cee3c00898c1ac6a6c886469e1ab1.exe
2220	333bb61be5eb4be9c261a3f99c144cf7be0cee3c00898c1ac6a6c886469e1ab1.exe
2220	333bb61be5eb4be9c261a3f99c144cf7be0cee3c00898c1ac6a6c886469e1ab1.exe
2220	333bb61be5eb4be9c261a3f99c144cf7be0cee3c00898c1ac6a6c886469e1ab1.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2220	333bb61be5eb4be9c261a3f99c144cf7be0cee3c00898c1ac6a6c886469e1ab1.exe
Token: SeDebugPrivilege	2900	InstallUtil.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 2220 wrote to memory of 2640	2220	333bb61be5eb4be9c261a3f99c144cf7be0cee3c00898c1ac6a6c886469e1ab1.exe	31
PID 2220 wrote to memory of 2640	2220	333bb61be5eb4be9c261a3f99c144cf7be0cee3c00898c1ac6a6c886469e1ab1.exe	31
PID 2220 wrote to memory of 2640	2220	333bb61be5eb4be9c261a3f99c144cf7be0cee3c00898c1ac6a6c886469e1ab1.exe	31
PID 2220 wrote to memory of 2640	2220	333bb61be5eb4be9c261a3f99c144cf7be0cee3c00898c1ac6a6c886469e1ab1.exe	31
PID 2220 wrote to memory of 2500	2220	333bb61be5eb4be9c261a3f99c144cf7be0cee3c00898c1ac6a6c886469e1ab1.exe	32
PID 2220 wrote to memory of 2500	2220	333bb61be5eb4be9c261a3f99c144cf7be0cee3c00898c1ac6a6c886469e1ab1.exe	32
PID 2220 wrote to memory of 2500	2220	333bb61be5eb4be9c261a3f99c144cf7be0cee3c00898c1ac6a6c886469e1ab1.exe	32
PID 2220 wrote to memory of 2500	2220	333bb61be5eb4be9c261a3f99c144cf7be0cee3c00898c1ac6a6c886469e1ab1.exe	32
PID 2220 wrote to memory of 2500	2220	333bb61be5eb4be9c261a3f99c144cf7be0cee3c00898c1ac6a6c886469e1ab1.exe	32
PID 2220 wrote to memory of 2500	2220	333bb61be5eb4be9c261a3f99c144cf7be0cee3c00898c1ac6a6c886469e1ab1.exe	32
PID 2220 wrote to memory of 2500	2220	333bb61be5eb4be9c261a3f99c144cf7be0cee3c00898c1ac6a6c886469e1ab1.exe	32
PID 2220 wrote to memory of 2688	2220	333bb61be5eb4be9c261a3f99c144cf7be0cee3c00898c1ac6a6c886469e1ab1.exe	33
PID 2220 wrote to memory of 2688	2220	333bb61be5eb4be9c261a3f99c144cf7be0cee3c00898c1ac6a6c886469e1ab1.exe	33
PID 2220 wrote to memory of 2688	2220	333bb61be5eb4be9c261a3f99c144cf7be0cee3c00898c1ac6a6c886469e1ab1.exe	33
PID 2220 wrote to memory of 2688	2220	333bb61be5eb4be9c261a3f99c144cf7be0cee3c00898c1ac6a6c886469e1ab1.exe	33
PID 2220 wrote to memory of 2688	2220	333bb61be5eb4be9c261a3f99c144cf7be0cee3c00898c1ac6a6c886469e1ab1.exe	33
PID 2220 wrote to memory of 2688	2220	333bb61be5eb4be9c261a3f99c144cf7be0cee3c00898c1ac6a6c886469e1ab1.exe	33
PID 2220 wrote to memory of 2688	2220	333bb61be5eb4be9c261a3f99c144cf7be0cee3c00898c1ac6a6c886469e1ab1.exe	33
PID 2220 wrote to memory of 2900	2220	333bb61be5eb4be9c261a3f99c144cf7be0cee3c00898c1ac6a6c886469e1ab1.exe	34
PID 2220 wrote to memory of 2900	2220	333bb61be5eb4be9c261a3f99c144cf7be0cee3c00898c1ac6a6c886469e1ab1.exe	34
PID 2220 wrote to memory of 2900	2220	333bb61be5eb4be9c261a3f99c144cf7be0cee3c00898c1ac6a6c886469e1ab1.exe	34
PID 2220 wrote to memory of 2900	2220	333bb61be5eb4be9c261a3f99c144cf7be0cee3c00898c1ac6a6c886469e1ab1.exe	34
PID 2220 wrote to memory of 2900	2220	333bb61be5eb4be9c261a3f99c144cf7be0cee3c00898c1ac6a6c886469e1ab1.exe	34
PID 2220 wrote to memory of 2900	2220	333bb61be5eb4be9c261a3f99c144cf7be0cee3c00898c1ac6a6c886469e1ab1.exe	34
PID 2220 wrote to memory of 2900	2220	333bb61be5eb4be9c261a3f99c144cf7be0cee3c00898c1ac6a6c886469e1ab1.exe	34
PID 2220 wrote to memory of 2900	2220	333bb61be5eb4be9c261a3f99c144cf7be0cee3c00898c1ac6a6c886469e1ab1.exe	34
PID 2220 wrote to memory of 2900	2220	333bb61be5eb4be9c261a3f99c144cf7be0cee3c00898c1ac6a6c886469e1ab1.exe	34
PID 2220 wrote to memory of 2900	2220	333bb61be5eb4be9c261a3f99c144cf7be0cee3c00898c1ac6a6c886469e1ab1.exe	34
PID 2220 wrote to memory of 2900	2220	333bb61be5eb4be9c261a3f99c144cf7be0cee3c00898c1ac6a6c886469e1ab1.exe	34
PID 2220 wrote to memory of 2900	2220	333bb61be5eb4be9c261a3f99c144cf7be0cee3c00898c1ac6a6c886469e1ab1.exe	34

C:\Users\Admin\AppData\Local\Temp\333bb61be5eb4be9c261a3f99c144cf7be0cee3c00898c1ac6a6c886469e1ab1.exe
"C:\Users\Admin\AppData\Local\Temp\333bb61be5eb4be9c261a3f99c144cf7be0cee3c00898c1ac6a6c886469e1ab1.exe"
1⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2220
- C:\Users\Admin\AppData\Local\Temp\Pipppuccxtivwagftpb-grenn - reddomain-obufcastesolution.exe
  "C:\Users\Admin\AppData\Local\Temp\Pipppuccxtivwagftpb-grenn - reddomain-obufcastesolution.exe"
  2⤵
  - Executes dropped EXE
  PID:2640
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
  2⤵
  PID:2500
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
  2⤵
  PID:2688
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2900

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\Pipppuccxtivwagftpb-grenn - reddomain-obufcastesolution.exe

Filesize
334KB

MD5
52566803b9e6dd804a5bcad48515411e

SHA1
67082b151a39245342b2ad6c367f1be283878775

SHA256
5ef7b280de98eaa5bc116f104f95f300780e4859b0440cb12f9c667bbbbd10f6

SHA512
dab2fee7ea114d8b213f8a10f09d9de1b21a6601b8cf09eeb167378c83d4f91d612f21fc6ca80101fa166ad9155c69010d79fe2b671f21dab7fe6bb278254e55

Download Submit
memory/2220-17-0x0000000004FA0000-0x0000000004FE4000-memory.dmp

Filesize
272KB

Download
memory/2220-0-0x0000000073D5E000-0x0000000073D5F000-memory.dmp

Filesize
4KB

Download
memory/2220-33-0x0000000073D50000-0x000000007443E000-memory.dmp

Filesize
6.9MB

Download
memory/2220-4-0x0000000004700000-0x0000000004792000-memory.dmp

Filesize
584KB

Download
memory/2220-1-0x0000000000910000-0x0000000000A8E000-memory.dmp

Filesize
1.5MB

Download
memory/2220-3-0x0000000073D50000-0x000000007443E000-memory.dmp

Filesize
6.9MB

Download
memory/2220-2-0x0000000004A40000-0x0000000004BBC000-memory.dmp

Filesize
1.5MB

Download
memory/2640-13-0x0000000000280000-0x0000000000286000-memory.dmp

Filesize
24KB

Download
memory/2640-16-0x0000000073D50000-0x000000007443E000-memory.dmp

Filesize
6.9MB

Download
memory/2640-14-0x0000000073D50000-0x000000007443E000-memory.dmp

Filesize
6.9MB

Download
memory/2640-12-0x0000000001340000-0x000000000139A000-memory.dmp

Filesize
360KB

Download
memory/2640-35-0x0000000073D50000-0x000000007443E000-memory.dmp

Filesize
6.9MB

Download
memory/2640-34-0x0000000073D50000-0x000000007443E000-memory.dmp

Filesize
6.9MB

Download
memory/2900-28-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2900-30-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2900-26-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2900-24-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2900-22-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2900-18-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2900-32-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2900-20-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download