asyncrat | 7ce2d225442252064d744be1c38e9c1572dd355bbbaf7fa411ce79e41288dfca

General

Target

7ce2d225442252064d744be1c38e9c1572dd355bbbaf7fa411ce79e41288dfca.exe
Size

64KB
MD5

919b43661894503a00d44ffd1174d613
SHA1

c510009fb7bad735e35a10c0ebe925d730ca961f
SHA256

7ce2d225442252064d744be1c38e9c1572dd355bbbaf7fa411ce79e41288dfca
SHA512

5019e86e2c0585aa59d7c14b4a0b03c911440487b9bd843db0a6138861e46274f17d72deea09429b650c5976aa9bf03d7427d65b26cc4b65c0c0bd9f1b19997b
SSDEEP

768:N9aGzWs/9PiPJ5eit9JSTLavfU4OnsD3q66T1+4SCv7mqb2nRpwH1oDjoUhPGnPP:vaW90TekUJyq6OqGbbUwDuGnPpqKmY7

Score

10^/10

asyncrat rat

Malware Config

Extracted

Family

asyncrat

Version

5.0.5

C2

server.underground-cheat.xyz:4449

Mutex

Venom_RAT_HVNC_Mutex_Venom RAT_HVNC

Attributes

delay
1
install
true
install_file
Host Process for Windows.exe
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral1/files/0x000900000001225f-15.dat	family_asyncrat

Executes dropped EXE 1 IoCs

pid	Process
2708	Host Process for Windows.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
2776	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2756	schtasks.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2324	7ce2d225442252064d744be1c38e9c1572dd355bbbaf7fa411ce79e41288dfca.exe
2324	7ce2d225442252064d744be1c38e9c1572dd355bbbaf7fa411ce79e41288dfca.exe
2324	7ce2d225442252064d744be1c38e9c1572dd355bbbaf7fa411ce79e41288dfca.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2324	7ce2d225442252064d744be1c38e9c1572dd355bbbaf7fa411ce79e41288dfca.exe
Token: SeDebugPrivilege	2708	Host Process for Windows.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 2324 wrote to memory of 2340	2324	7ce2d225442252064d744be1c38e9c1572dd355bbbaf7fa411ce79e41288dfca.exe	31
PID 2324 wrote to memory of 2340	2324	7ce2d225442252064d744be1c38e9c1572dd355bbbaf7fa411ce79e41288dfca.exe	31
PID 2324 wrote to memory of 2340	2324	7ce2d225442252064d744be1c38e9c1572dd355bbbaf7fa411ce79e41288dfca.exe	31
PID 2324 wrote to memory of 2116	2324	7ce2d225442252064d744be1c38e9c1572dd355bbbaf7fa411ce79e41288dfca.exe	33
PID 2324 wrote to memory of 2116	2324	7ce2d225442252064d744be1c38e9c1572dd355bbbaf7fa411ce79e41288dfca.exe	33
PID 2324 wrote to memory of 2116	2324	7ce2d225442252064d744be1c38e9c1572dd355bbbaf7fa411ce79e41288dfca.exe	33
PID 2340 wrote to memory of 2756	2340	cmd.exe	35
PID 2340 wrote to memory of 2756	2340	cmd.exe	35
PID 2340 wrote to memory of 2756	2340	cmd.exe	35
PID 2116 wrote to memory of 2776	2116	cmd.exe	36
PID 2116 wrote to memory of 2776	2116	cmd.exe	36
PID 2116 wrote to memory of 2776	2116	cmd.exe	36
PID 2116 wrote to memory of 2708	2116	cmd.exe	37
PID 2116 wrote to memory of 2708	2116	cmd.exe	37
PID 2116 wrote to memory of 2708	2116	cmd.exe	37

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\7ce2d225442252064d744be1c38e9c1572dd355bbbaf7fa411ce79e41288dfca.exe
"C:\Users\Admin\AppData\Local\Temp\7ce2d225442252064d744be1c38e9c1572dd355bbbaf7fa411ce79e41288dfca.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2324
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Host Process for Windows" /tr '"C:\Users\Admin\AppData\Roaming\Host Process for Windows.exe"' & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2340
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc onlogon /rl highest /tn "Host Process for Windows" /tr '"C:\Users\Admin\AppData\Roaming\Host Process for Windows.exe"'
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2756
- C:\Windows\system32\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpF9F8.tmp.bat""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2116
- - C:\Windows\system32\timeout.exe
    timeout 3
    3⤵
    - Delays execution with timeout.exe
    PID:2776
- - C:\Users\Admin\AppData\Roaming\Host Process for Windows.exe
    "C:\Users\Admin\AppData\Roaming\Host Process for Windows.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:2708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpF9F8.tmp.bat

Filesize
168B

MD5
2e26778bb455f7e55148966822d009ad

SHA1
a63488bdb9e69bf6e45936c83cb30e072df52155

SHA256
c398957fec970a93e86d439b53f504f64bef4e163fd4ce05811aa2ae9e8c68df

SHA512
83c61c108f31061dc2086b2b357d17ec76a78d8dd85db558201d5d47b5e58e7ef4b8100ec4508b1bbbd60ac844a3b663e42f2f516c8d00a8dc8778353fc07fe1

Download Submit
C:\Users\Admin\AppData\Roaming\Host Process for Windows.exe

Filesize
64KB

MD5
919b43661894503a00d44ffd1174d613

SHA1
c510009fb7bad735e35a10c0ebe925d730ca961f

SHA256
7ce2d225442252064d744be1c38e9c1572dd355bbbaf7fa411ce79e41288dfca

SHA512
5019e86e2c0585aa59d7c14b4a0b03c911440487b9bd843db0a6138861e46274f17d72deea09429b650c5976aa9bf03d7427d65b26cc4b65c0c0bd9f1b19997b

Download Submit
memory/2324-0-0x000007FEF5D03000-0x000007FEF5D04000-memory.dmp

Filesize
4KB

Download
memory/2324-1-0x0000000000B50000-0x0000000000B66000-memory.dmp

Filesize
88KB

Download
memory/2324-2-0x000007FEF5D00000-0x000007FEF66EC000-memory.dmp

Filesize
9.9MB

Download
memory/2324-3-0x000007FEF5D00000-0x000007FEF66EC000-memory.dmp

Filesize
9.9MB

Download
memory/2324-12-0x000007FEF5D00000-0x000007FEF66EC000-memory.dmp

Filesize
9.9MB

Download
memory/2708-17-0x0000000001090000-0x00000000010A6000-memory.dmp

Filesize
88KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads