asyncrat | 228b84ada13e534e5148ad5e7c4c9c4aacaceee624cd45beff57a9bbe67c30d3

General

Target

Client.exe
Size

275KB
MD5

d4101d2cc39349c3153cace3bb155c34
SHA1

513d13873f2d7d416cdb6d403b20e9cd128425df
SHA256

228b84ada13e534e5148ad5e7c4c9c4aacaceee624cd45beff57a9bbe67c30d3
SHA512

2c6351cb235b5ac4fbbd742cd4657a2310ad8f071714116600a3a285c706fccf943393ce6680486379604d661e621ea630605afbf84a87169f17791ce76e710b
SSDEEP

6144:fXaWPMVWaesVbepU0sNOBTunbw0/5Wpi:fXaMds4pUviinbT5Wg

Score

10^/10

asyncrat wavelol rat

Malware Config

Extracted

Family

asyncrat

Version

Venom RAT + HVNC + Stealer + Grabber v6.0.3

Botnet

WaveLOL

C2

147.185.221.213:35374

Mutex

%AppData%

Attributes

delay
1
install
true
install_file
faggotry.exe
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral1/files/0x0009000000016d21-16.dat	family_asyncrat

Executes dropped EXE 1 IoCs

pid	Process
2680	faggotry.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
2768	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2700	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3008	Client.exe
3008	Client.exe
3008	Client.exe
2680	faggotry.exe
2680	faggotry.exe
2680	faggotry.exe
2680	faggotry.exe
2680	faggotry.exe
2680	faggotry.exe
2680	faggotry.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3008	Client.exe
Token: SeDebugPrivilege	2680	faggotry.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2680	faggotry.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 3008 wrote to memory of 2484	3008	Client.exe	31
PID 3008 wrote to memory of 2484	3008	Client.exe	31
PID 3008 wrote to memory of 2484	3008	Client.exe	31
PID 3008 wrote to memory of 2892	3008	Client.exe	33
PID 3008 wrote to memory of 2892	3008	Client.exe	33
PID 3008 wrote to memory of 2892	3008	Client.exe	33
PID 2484 wrote to memory of 2700	2484	cmd.exe	35
PID 2484 wrote to memory of 2700	2484	cmd.exe	35
PID 2484 wrote to memory of 2700	2484	cmd.exe	35
PID 2892 wrote to memory of 2768	2892	cmd.exe	36
PID 2892 wrote to memory of 2768	2892	cmd.exe	36
PID 2892 wrote to memory of 2768	2892	cmd.exe	36
PID 2892 wrote to memory of 2680	2892	cmd.exe	37
PID 2892 wrote to memory of 2680	2892	cmd.exe	37
PID 2892 wrote to memory of 2680	2892	cmd.exe	37

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Client.exe
"C:\Users\Admin\AppData\Local\Temp\Client.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3008
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "faggotry" /tr '"C:\Users\Admin\AppData\Roaming\faggotry.exe"' & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2484
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc onlogon /rl highest /tn "faggotry" /tr '"C:\Users\Admin\AppData\Roaming\faggotry.exe"'
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2700
- C:\Windows\system32\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpF595.tmp.bat""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2892
- - C:\Windows\system32\timeout.exe
    timeout 3
    3⤵
    - Delays execution with timeout.exe
    PID:2768
- - C:\Users\Admin\AppData\Roaming\faggotry.exe
    "C:\Users\Admin\AppData\Roaming\faggotry.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:2680

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpF595.tmp.bat

Filesize
152B

MD5
71d694855be5235ffc8677016fe1cd9f

SHA1
914ff054745ae32931e2d3688a75089dfd08e0e1

SHA256
91aa496b3a64f88b1c8053f107d1be3a6ce5f74d55652c135199b785bcef0df9

SHA512
93a27fed041289b43a2277f07238cee8d4a05a303351f91e60bbd2b15fb7646c76c77cfe9cb37969e333416ff4a78f42ec599046bb547a94a4a7b42a6cdea764

Download Submit
C:\Users\Admin\AppData\Roaming\MyData\DataLogs.conf

Filesize
8B

MD5
cf759e4c5f14fe3eec41b87ed756cea8

SHA1
c27c796bb3c2fac929359563676f4ba1ffada1f5

SHA256
c9f9f193409217f73cc976ad078c6f8bf65d3aabcf5fad3e5a47536d47aa6761

SHA512
c7f832aee13a5eb36d145f35d4464374a9e12fa2017f3c2257442d67483b35a55eccae7f7729243350125b37033e075efbc2303839fd86b81b9b4dca3626953b

Download Submit
C:\Users\Admin\AppData\Roaming\faggotry.exe

Filesize
275KB

MD5
d4101d2cc39349c3153cace3bb155c34

SHA1
513d13873f2d7d416cdb6d403b20e9cd128425df

SHA256
228b84ada13e534e5148ad5e7c4c9c4aacaceee624cd45beff57a9bbe67c30d3

SHA512
2c6351cb235b5ac4fbbd742cd4657a2310ad8f071714116600a3a285c706fccf943393ce6680486379604d661e621ea630605afbf84a87169f17791ce76e710b

Download Submit
memory/2680-18-0x00000000002E0000-0x000000000032A000-memory.dmp

Filesize
296KB

Download
memory/3008-0-0x000007FEF5FD3000-0x000007FEF5FD4000-memory.dmp

Filesize
4KB

Download
memory/3008-1-0x0000000000F60000-0x0000000000FAA000-memory.dmp

Filesize
296KB

Download
memory/3008-3-0x000007FEF5FD0000-0x000007FEF69BC000-memory.dmp

Filesize
9.9MB

Download
memory/3008-11-0x000007FEF5FD0000-0x000007FEF69BC000-memory.dmp

Filesize
9.9MB

Download
memory/3008-14-0x000007FEF5FD0000-0x000007FEF69BC000-memory.dmp

Filesize
9.9MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads