asyncrat | 244cdde59538d83d57aa29d0ffb2570b80dedd9c7215e2ebf474ffe13f5af613

General

Target

7fc440d101840a5d943f0c20603dc0c0N.exe
Size

267KB
MD5

7fc440d101840a5d943f0c20603dc0c0
SHA1

9845d09acc8141c8a9429cc4f612a070d0a2f6d1
SHA256

244cdde59538d83d57aa29d0ffb2570b80dedd9c7215e2ebf474ffe13f5af613
SHA512

689a2e120f9c06ff421145f297d997effb59ce43c3053975427499aec1e81f23b8b19e022742dfae0560ef31ebfac410837b90ef9bde6bd7d056af9c854ca38a
SSDEEP

3072:WdvzDqxs8ORikgogWfiuRXd3YmSffdTKXNXANewGBvskX1pWA/sk:WFzDqa86hV6uRRqX1evPlwAEk

Score

10^/10

asyncrat discovery persistence rat

Malware Config

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Contains code to disable Windows Defender 5 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

resource	yara_rule
behavioral1/memory/2888-34-0x0000000000400000-0x0000000000430000-memory.dmp	disable_win_def
behavioral1/memory/2888-35-0x0000000000400000-0x0000000000430000-memory.dmp	disable_win_def
behavioral1/memory/2888-31-0x0000000000400000-0x0000000000430000-memory.dmp	disable_win_def
behavioral1/memory/2888-36-0x0000000000400000-0x0000000000430000-memory.dmp	disable_win_def
behavioral1/memory/2888-29-0x0000000000400000-0x0000000000430000-memory.dmp	disable_win_def

Executes dropped EXE 1 IoCs

pid	Process
2060	HiPatchService.exe

Loads dropped DLL 1 IoCs

pid	Process
1320	7fc440d101840a5d943f0c20603dc0c0N.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\HiPatch = "C:\\Users\\Admin\\AppData\\Roaming\\HiPatch\\HiPatchService.exe"	7fc440d101840a5d943f0c20603dc0c0N.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2060 set thread context of 2888	2060	HiPatchService.exe	34

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7fc440d101840a5d943f0c20603dc0c0N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HiPatchService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2888	RegAsm.exe
2888	RegAsm.exe
2888	RegAsm.exe
2888	RegAsm.exe
2888	RegAsm.exe
2888	RegAsm.exe
2888	RegAsm.exe
2888	RegAsm.exe
2888	RegAsm.exe
2888	RegAsm.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 1320 wrote to memory of 2060	1320	7fc440d101840a5d943f0c20603dc0c0N.exe	31
PID 1320 wrote to memory of 2060	1320	7fc440d101840a5d943f0c20603dc0c0N.exe	31
PID 1320 wrote to memory of 2060	1320	7fc440d101840a5d943f0c20603dc0c0N.exe	31
PID 1320 wrote to memory of 2060	1320	7fc440d101840a5d943f0c20603dc0c0N.exe	31
PID 1320 wrote to memory of 2060	1320	7fc440d101840a5d943f0c20603dc0c0N.exe	31
PID 1320 wrote to memory of 2060	1320	7fc440d101840a5d943f0c20603dc0c0N.exe	31
PID 1320 wrote to memory of 2060	1320	7fc440d101840a5d943f0c20603dc0c0N.exe	31
PID 1320 wrote to memory of 3020	1320	7fc440d101840a5d943f0c20603dc0c0N.exe	32
PID 1320 wrote to memory of 3020	1320	7fc440d101840a5d943f0c20603dc0c0N.exe	32
PID 1320 wrote to memory of 3020	1320	7fc440d101840a5d943f0c20603dc0c0N.exe	32
PID 1320 wrote to memory of 3020	1320	7fc440d101840a5d943f0c20603dc0c0N.exe	32
PID 1320 wrote to memory of 3020	1320	7fc440d101840a5d943f0c20603dc0c0N.exe	32
PID 1320 wrote to memory of 3020	1320	7fc440d101840a5d943f0c20603dc0c0N.exe	32
PID 1320 wrote to memory of 3020	1320	7fc440d101840a5d943f0c20603dc0c0N.exe	32
PID 2060 wrote to memory of 2888	2060	HiPatchService.exe	34
PID 2060 wrote to memory of 2888	2060	HiPatchService.exe	34
PID 2060 wrote to memory of 2888	2060	HiPatchService.exe	34
PID 2060 wrote to memory of 2888	2060	HiPatchService.exe	34
PID 2060 wrote to memory of 2888	2060	HiPatchService.exe	34
PID 2060 wrote to memory of 2888	2060	HiPatchService.exe	34
PID 2060 wrote to memory of 2888	2060	HiPatchService.exe	34
PID 2060 wrote to memory of 2888	2060	HiPatchService.exe	34
PID 2060 wrote to memory of 2888	2060	HiPatchService.exe	34
PID 2060 wrote to memory of 2888	2060	HiPatchService.exe	34
PID 2060 wrote to memory of 2888	2060	HiPatchService.exe	34
PID 2060 wrote to memory of 2888	2060	HiPatchService.exe	34

C:\Users\Admin\AppData\Local\Temp\7fc440d101840a5d943f0c20603dc0c0N.exe
"C:\Users\Admin\AppData\Local\Temp\7fc440d101840a5d943f0c20603dc0c0N.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1320
- C:\Users\Admin\AppData\Roaming\HiPatch\HiPatchService.exe
  "C:\Users\Admin\AppData\Roaming\HiPatch\HiPatchService.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2060
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:2888
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Roaming\HiPatch\HiPatchService.bat""
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3020

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:1796

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\HiPatch\HiPatchService.bat

Filesize
213B

MD5
0955cb4b691d44b37f8b6fad48a33b8e

SHA1
9dae759ae014cc124ab6eed7c8035788c124ae4a

SHA256
9092dbb1ca1767d1966b7f79349dd95a802a68248251bf070c0f1d74d5681d71

SHA512
08b868a028c1e8d29ed643416850df16f58d44668f9193b46bd3934965e5617a0a4015fc52815c5456023dbde01023450d295b76d936a936f26b602e764b0235

Download Submit
C:\Users\Admin\AppData\Roaming\HiPatch\HiPatchService.exe

Filesize
267KB

MD5
b074b992869832ed2f6672c03300e46a

SHA1
26d47951ded10984f9fbdaa6404e249589f49515

SHA256
42acb0dc44b9ea3c510caf671fe4bd039af274be13672a95cc1a228f76cb6e9c

SHA512
443bbe7118091fd50f925489a00e88886fdf7743af65e4490ed1e62863450c1a5554c830fc677a76bae97c1d90926d0c2037e9ac318049c9b2090152176d6522

Download Submit
memory/1320-24-0x0000000074A70000-0x000000007515E000-memory.dmp

Filesize
6.9MB

Download
memory/1320-2-0x00000000002A0000-0x00000000002AA000-memory.dmp

Filesize
40KB

Download
memory/1320-1-0x0000000000140000-0x0000000000186000-memory.dmp

Filesize
280KB

Download
memory/1320-0-0x0000000074A7E000-0x0000000074A7F000-memory.dmp

Filesize
4KB

Download
memory/1320-3-0x0000000074A70000-0x000000007515E000-memory.dmp

Filesize
6.9MB

Download
memory/2060-37-0x0000000074A70000-0x000000007515E000-memory.dmp

Filesize
6.9MB

Download
memory/2060-21-0x00000000012C0000-0x0000000001306000-memory.dmp

Filesize
280KB

Download
memory/2060-22-0x0000000074A70000-0x000000007515E000-memory.dmp

Filesize
6.9MB

Download
memory/2888-33-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2888-35-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2888-31-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2888-36-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2888-29-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2888-27-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2888-25-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2888-34-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads