asyncrat | fbb41333d4ca06cace9a9d040cc9c2a95a644a03298da9789def5f48e34f5515

Analysis

max time kernel
254s
max time network
302s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
17-07-2024 18:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Ujuax.exe
Size

4.8MB
MD5

cc0586b98c46e5ed73efb1b0e9181130
SHA1

ff4a38d4acb50e4385727ef5455b77344b9b01c6
SHA256

b32f304e47735f05127ca24f7094514ef8b2b6d4d23c2b34a519ada6dc93b628
SHA512

2a8e5c1f6a449abe949b7e1fab291a1919bb80859648fd2bad50cf46964a3292db7f63663a4aa9f62993f3f85fb1e14fd05dfc68f9632e25f19a59bdf9e22468
SSDEEP

24576:D0cxDzNN+hJELofuY4e9fB03aZTtjck/aCbycRZxE7EiMdwTBHPJArTJnC03Ud1E:4cnk

Score

10^/10

asyncrat scar rat spyware stealer

Malware Config

Extracted

Family

asyncrat

Version

AWS | 3Losh

Botnet

Scar

scar77747.duckdns.org:6606

scar77747.duckdns.org:7707

scar77747.duckdns.org:8808

Mutex

Alx_alx

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral1/memory/2172-4899-0x00000000048E0000-0x00000000048F6000-memory.dmp	family_asyncrat

Executes dropped EXE 1 IoCs

pid	Process
1680	Scar.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3288	ipconfig.exe
3952	ipconfig.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
3476	powershell.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	2172	Ujuax.exe
Token: SeDebugPrivilege	2172	Ujuax.exe
Token: SeDebugPrivilege	3476	powershell.exe
Token: SeDebugPrivilege	1680	Scar.exe
Token: SeDebugPrivilege	1680	Scar.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 2172 wrote to memory of 3260	2172	Ujuax.exe	31
PID 2172 wrote to memory of 3260	2172	Ujuax.exe	31
PID 2172 wrote to memory of 3260	2172	Ujuax.exe	31
PID 2172 wrote to memory of 3260	2172	Ujuax.exe	31
PID 3260 wrote to memory of 3288	3260	cmd.exe	33
PID 3260 wrote to memory of 3288	3260	cmd.exe	33
PID 3260 wrote to memory of 3288	3260	cmd.exe	33
PID 3260 wrote to memory of 3288	3260	cmd.exe	33
PID 2172 wrote to memory of 3476	2172	Ujuax.exe	34
PID 2172 wrote to memory of 3476	2172	Ujuax.exe	34
PID 2172 wrote to memory of 3476	2172	Ujuax.exe	34
PID 2172 wrote to memory of 3476	2172	Ujuax.exe	34
PID 2932 wrote to memory of 1680	2932	taskeng.exe	38
PID 2932 wrote to memory of 1680	2932	taskeng.exe	38
PID 2932 wrote to memory of 1680	2932	taskeng.exe	38
PID 2932 wrote to memory of 1680	2932	taskeng.exe	38
PID 1680 wrote to memory of 1876	1680	Scar.exe	39
PID 1680 wrote to memory of 1876	1680	Scar.exe	39
PID 1680 wrote to memory of 1876	1680	Scar.exe	39
PID 1680 wrote to memory of 1876	1680	Scar.exe	39
PID 1876 wrote to memory of 3952	1876	cmd.exe	41
PID 1876 wrote to memory of 3952	1876	cmd.exe	41
PID 1876 wrote to memory of 3952	1876	cmd.exe	41
PID 1876 wrote to memory of 3952	1876	cmd.exe	41

C:\Users\Admin\AppData\Local\Temp\Ujuax.exe
"C:\Users\Admin\AppData\Local\Temp\Ujuax.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2172
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ipconfig /release
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3260
- - C:\Windows\SysWOW64\ipconfig.exe
    ipconfig /release
    3⤵
    - Gathers network information
    PID:3288
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAVQBqAHUAYQB4AC4AZQB4AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAcgBvAGMAZQBzAHMAIABVAGoAdQBhAHgALgBlAHgAZQA7AEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIABDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwAUgBvAGEAbQBpAG4AZwBcAFMAYwBhAHIALgBlAHgAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUAByAG8AYwBlAHMAcwAgAFMAYwBhAHIALgBlAHgAZQA=
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3476

C:\Windows\system32\taskeng.exe
taskeng.exe {1D1E573F-07BE-4553-8131-B563A22C9207} S-1-5-21-1506706701-1246725540-2219210854-1000:MUYDDIIS\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:2932
- C:\Users\Admin\AppData\Roaming\Scar.exe
  C:\Users\Admin\AppData\Roaming\Scar.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1680
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c ipconfig /release
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1876
  - - C:\Windows\SysWOW64\ipconfig.exe
      ipconfig /release
      4⤵
      Gathers network information
      PID:3952

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Cab6173.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar764E.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Roaming\Scar.exe

Filesize
4.8MB

MD5
cc0586b98c46e5ed73efb1b0e9181130

SHA1
ff4a38d4acb50e4385727ef5455b77344b9b01c6

SHA256
b32f304e47735f05127ca24f7094514ef8b2b6d4d23c2b34a519ada6dc93b628

SHA512
2a8e5c1f6a449abe949b7e1fab291a1919bb80859648fd2bad50cf46964a3292db7f63663a4aa9f62993f3f85fb1e14fd05dfc68f9632e25f19a59bdf9e22468

Download Submit
memory/1680-9824-0x0000000000DD0000-0x0000000000E24000-memory.dmp

Filesize
336KB

Download
memory/1680-4937-0x0000000001170000-0x0000000001638000-memory.dmp

Filesize
4.8MB

Download
memory/2172-60-0x0000000006140000-0x000000000635D000-memory.dmp

Filesize
2.1MB

Download
memory/2172-28-0x0000000006140000-0x000000000635D000-memory.dmp

Filesize
2.1MB

Download
memory/2172-30-0x0000000006140000-0x000000000635D000-memory.dmp

Filesize
2.1MB

Download
memory/2172-56-0x0000000006140000-0x000000000635D000-memory.dmp

Filesize
2.1MB

Download
memory/2172-26-0x0000000006140000-0x000000000635D000-memory.dmp

Filesize
2.1MB

Download
memory/2172-24-0x0000000006140000-0x000000000635D000-memory.dmp

Filesize
2.1MB

Download
memory/2172-22-0x0000000006140000-0x000000000635D000-memory.dmp

Filesize
2.1MB

Download
memory/2172-18-0x0000000006140000-0x000000000635D000-memory.dmp

Filesize
2.1MB

Download
memory/2172-16-0x0000000006140000-0x000000000635D000-memory.dmp

Filesize
2.1MB

Download
memory/2172-14-0x0000000006140000-0x000000000635D000-memory.dmp

Filesize
2.1MB

Download
memory/2172-58-0x0000000006140000-0x000000000635D000-memory.dmp

Filesize
2.1MB

Download
memory/2172-10-0x0000000006140000-0x000000000635D000-memory.dmp

Filesize
2.1MB

Download
memory/2172-52-0x0000000006140000-0x000000000635D000-memory.dmp

Filesize
2.1MB

Download
memory/2172-6-0x0000000006140000-0x000000000635D000-memory.dmp

Filesize
2.1MB

Download
memory/2172-36-0x0000000006140000-0x000000000635D000-memory.dmp

Filesize
2.1MB

Download
memory/2172-54-0x0000000006140000-0x000000000635D000-memory.dmp

Filesize
2.1MB

Download
memory/2172-66-0x0000000006140000-0x000000000635D000-memory.dmp

Filesize
2.1MB

Download
memory/2172-64-0x0000000006140000-0x000000000635D000-memory.dmp

Filesize
2.1MB

Download
memory/2172-62-0x0000000006140000-0x000000000635D000-memory.dmp

Filesize
2.1MB

Download
memory/2172-0-0x000000007469E000-0x000000007469F000-memory.dmp

Filesize
4KB

Download
memory/2172-12-0x0000000006140000-0x000000000635D000-memory.dmp

Filesize
2.1MB

Download
memory/2172-32-0x0000000006140000-0x000000000635D000-memory.dmp

Filesize
2.1MB

Download
memory/2172-8-0x0000000006140000-0x000000000635D000-memory.dmp

Filesize
2.1MB

Download
memory/2172-50-0x0000000006140000-0x000000000635D000-memory.dmp

Filesize
2.1MB

Download
memory/2172-48-0x0000000006140000-0x000000000635D000-memory.dmp

Filesize
2.1MB

Download
memory/2172-46-0x0000000006140000-0x000000000635D000-memory.dmp

Filesize
2.1MB

Download
memory/2172-44-0x0000000006140000-0x000000000635D000-memory.dmp

Filesize
2.1MB

Download
memory/2172-42-0x0000000006140000-0x000000000635D000-memory.dmp

Filesize
2.1MB

Download
memory/2172-40-0x0000000006140000-0x000000000635D000-memory.dmp

Filesize
2.1MB

Download
memory/2172-38-0x0000000006140000-0x000000000635D000-memory.dmp

Filesize
2.1MB

Download
memory/2172-34-0x0000000006140000-0x000000000635D000-memory.dmp

Filesize
2.1MB

Download
memory/2172-4890-0x0000000002390000-0x00000000023DC000-memory.dmp

Filesize
304KB

Download
memory/2172-4889-0x0000000002540000-0x000000000259E000-memory.dmp

Filesize
376KB

Download
memory/2172-4891-0x0000000074690000-0x0000000074D7E000-memory.dmp

Filesize
6.9MB

Download
memory/2172-4892-0x0000000074690000-0x0000000074D7E000-memory.dmp

Filesize
6.9MB

Download
memory/2172-4893-0x000000007469E000-0x000000007469F000-memory.dmp

Filesize
4KB

Download
memory/2172-4894-0x0000000074690000-0x0000000074D7E000-memory.dmp

Filesize
6.9MB

Download
memory/2172-4895-0x00000000050A0000-0x00000000050F4000-memory.dmp

Filesize
336KB

Download
memory/2172-4899-0x00000000048E0000-0x00000000048F6000-memory.dmp

Filesize
88KB

Download
memory/2172-4-0x0000000006140000-0x000000000635D000-memory.dmp

Filesize
2.1MB

Download
memory/2172-20-0x0000000006140000-0x000000000635D000-memory.dmp

Filesize
2.1MB

Download
memory/2172-3-0x0000000006140000-0x000000000635D000-memory.dmp

Filesize
2.1MB

Download
memory/2172-2-0x0000000006140000-0x0000000006364000-memory.dmp

Filesize
2.1MB

Download
memory/2172-1-0x0000000000800000-0x0000000000CC8000-memory.dmp

Filesize
4.8MB

Download