asyncrat | 256bf164fbfd8bf52c47f08c73492854601a8579b642d72f7b9facae1f7e1d35

General

Target

256bf164fbfd8bf52c47f08c73492854601a8579b642d72f7b9facae1f7e1d35.exe
Size

216KB
MD5

5dd4e2111931c62c4093aa49f4934b9a
SHA1

077c3e7aecd3e796246bb9d8c6d8bebed575187a
SHA256

256bf164fbfd8bf52c47f08c73492854601a8579b642d72f7b9facae1f7e1d35
SHA512

5a205d6c4c11c41562bd127c3196645ae4ecdfbe551531cc250c2abd72952403e5846561e98142d51e38777c7f597817e44aca4cb9e1ac8607db1509cafd5435
SSDEEP

3072:EOsA++eZfkeB3uppruBjYPS+ttfQfLgJVNfSSl9WBX7/X3UYdB8:5sA++eF0niB89azgzl9wLd

Score

10^/10

asyncrat 591_grebe discovery rat

Malware Config

Extracted

Family

asyncrat

Version

1.0.7

Botnet

591_GreBe

C2

89.105.201.98:591

Mutex

NJ1234dfffddfddfdfKJHYGTGYHUJIKOuy7t6r5er6t7y98u0iH&GYFTRCVGBHU9u8y7T^R%DFTYG&UHJ(K)_

Attributes

delay
1
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2044 set thread context of 1888	2044	256bf164fbfd8bf52c47f08c73492854601a8579b642d72f7b9facae1f7e1d35.exe	85

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	256bf164fbfd8bf52c47f08c73492854601a8579b642d72f7b9facae1f7e1d35.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AppLaunch.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2044	256bf164fbfd8bf52c47f08c73492854601a8579b642d72f7b9facae1f7e1d35.exe
2044	256bf164fbfd8bf52c47f08c73492854601a8579b642d72f7b9facae1f7e1d35.exe
2044	256bf164fbfd8bf52c47f08c73492854601a8579b642d72f7b9facae1f7e1d35.exe
2044	256bf164fbfd8bf52c47f08c73492854601a8579b642d72f7b9facae1f7e1d35.exe
2044	256bf164fbfd8bf52c47f08c73492854601a8579b642d72f7b9facae1f7e1d35.exe
2044	256bf164fbfd8bf52c47f08c73492854601a8579b642d72f7b9facae1f7e1d35.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2044	256bf164fbfd8bf52c47f08c73492854601a8579b642d72f7b9facae1f7e1d35.exe
Token: SeDebugPrivilege	1888	AppLaunch.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 2044 wrote to memory of 336	2044	256bf164fbfd8bf52c47f08c73492854601a8579b642d72f7b9facae1f7e1d35.exe	83
PID 2044 wrote to memory of 336	2044	256bf164fbfd8bf52c47f08c73492854601a8579b642d72f7b9facae1f7e1d35.exe	83
PID 2044 wrote to memory of 336	2044	256bf164fbfd8bf52c47f08c73492854601a8579b642d72f7b9facae1f7e1d35.exe	83
PID 2044 wrote to memory of 336	2044	256bf164fbfd8bf52c47f08c73492854601a8579b642d72f7b9facae1f7e1d35.exe	83
PID 2044 wrote to memory of 336	2044	256bf164fbfd8bf52c47f08c73492854601a8579b642d72f7b9facae1f7e1d35.exe	83
PID 2044 wrote to memory of 336	2044	256bf164fbfd8bf52c47f08c73492854601a8579b642d72f7b9facae1f7e1d35.exe	83
PID 2044 wrote to memory of 336	2044	256bf164fbfd8bf52c47f08c73492854601a8579b642d72f7b9facae1f7e1d35.exe	83
PID 2044 wrote to memory of 336	2044	256bf164fbfd8bf52c47f08c73492854601a8579b642d72f7b9facae1f7e1d35.exe	83
PID 2044 wrote to memory of 1708	2044	256bf164fbfd8bf52c47f08c73492854601a8579b642d72f7b9facae1f7e1d35.exe	84
PID 2044 wrote to memory of 1708	2044	256bf164fbfd8bf52c47f08c73492854601a8579b642d72f7b9facae1f7e1d35.exe	84
PID 2044 wrote to memory of 1708	2044	256bf164fbfd8bf52c47f08c73492854601a8579b642d72f7b9facae1f7e1d35.exe	84
PID 2044 wrote to memory of 1708	2044	256bf164fbfd8bf52c47f08c73492854601a8579b642d72f7b9facae1f7e1d35.exe	84
PID 2044 wrote to memory of 1708	2044	256bf164fbfd8bf52c47f08c73492854601a8579b642d72f7b9facae1f7e1d35.exe	84
PID 2044 wrote to memory of 1708	2044	256bf164fbfd8bf52c47f08c73492854601a8579b642d72f7b9facae1f7e1d35.exe	84
PID 2044 wrote to memory of 1708	2044	256bf164fbfd8bf52c47f08c73492854601a8579b642d72f7b9facae1f7e1d35.exe	84
PID 2044 wrote to memory of 1708	2044	256bf164fbfd8bf52c47f08c73492854601a8579b642d72f7b9facae1f7e1d35.exe	84
PID 2044 wrote to memory of 1888	2044	256bf164fbfd8bf52c47f08c73492854601a8579b642d72f7b9facae1f7e1d35.exe	85
PID 2044 wrote to memory of 1888	2044	256bf164fbfd8bf52c47f08c73492854601a8579b642d72f7b9facae1f7e1d35.exe	85
PID 2044 wrote to memory of 1888	2044	256bf164fbfd8bf52c47f08c73492854601a8579b642d72f7b9facae1f7e1d35.exe	85
PID 2044 wrote to memory of 1888	2044	256bf164fbfd8bf52c47f08c73492854601a8579b642d72f7b9facae1f7e1d35.exe	85
PID 2044 wrote to memory of 1888	2044	256bf164fbfd8bf52c47f08c73492854601a8579b642d72f7b9facae1f7e1d35.exe	85
PID 2044 wrote to memory of 1888	2044	256bf164fbfd8bf52c47f08c73492854601a8579b642d72f7b9facae1f7e1d35.exe	85
PID 2044 wrote to memory of 1888	2044	256bf164fbfd8bf52c47f08c73492854601a8579b642d72f7b9facae1f7e1d35.exe	85
PID 2044 wrote to memory of 1888	2044	256bf164fbfd8bf52c47f08c73492854601a8579b642d72f7b9facae1f7e1d35.exe	85

C:\Users\Admin\AppData\Local\Temp\256bf164fbfd8bf52c47f08c73492854601a8579b642d72f7b9facae1f7e1d35.exe
"C:\Users\Admin\AppData\Local\Temp\256bf164fbfd8bf52c47f08c73492854601a8579b642d72f7b9facae1f7e1d35.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2044
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:336
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:1708
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:1888

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1888-14-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1888-21-0x00000000746F0000-0x0000000074EA1000-memory.dmp

Filesize
7.7MB

Download
memory/1888-20-0x00000000746F0000-0x0000000074EA1000-memory.dmp

Filesize
7.7MB

Download
memory/1888-19-0x0000000005640000-0x00000000056A6000-memory.dmp

Filesize
408KB

Download
memory/1888-18-0x00000000746F0000-0x0000000074EA1000-memory.dmp

Filesize
7.7MB

Download
memory/1888-17-0x00000000746F0000-0x0000000074EA1000-memory.dmp

Filesize
7.7MB

Download
memory/2044-10-0x0000000008060000-0x000000000807A000-memory.dmp

Filesize
104KB

Download
memory/2044-13-0x00000000746F0000-0x0000000074EA1000-memory.dmp

Filesize
7.7MB

Download
memory/2044-8-0x0000000007A10000-0x0000000007A1A000-memory.dmp

Filesize
40KB

Download
memory/2044-9-0x00000000746F0000-0x0000000074EA1000-memory.dmp

Filesize
7.7MB

Download
memory/2044-0-0x00000000746FE000-0x00000000746FF000-memory.dmp

Filesize
4KB

Download
memory/2044-11-0x000000000A6E0000-0x000000000A6E6000-memory.dmp

Filesize
24KB

Download
memory/2044-12-0x00000000746FE000-0x00000000746FF000-memory.dmp

Filesize
4KB

Download
memory/2044-7-0x000000000A420000-0x000000000A4B2000-memory.dmp

Filesize
584KB

Download
memory/2044-6-0x000000000A9D0000-0x000000000AF76000-memory.dmp

Filesize
5.6MB

Download
memory/2044-16-0x00000000746F0000-0x0000000074EA1000-memory.dmp

Filesize
7.7MB

Download
memory/2044-5-0x0000000002F60000-0x0000000002F66000-memory.dmp

Filesize
24KB

Download
memory/2044-4-0x0000000007BB0000-0x0000000007E72000-memory.dmp

Filesize
2.8MB

Download
memory/2044-3-0x00000000746F0000-0x0000000074EA1000-memory.dmp

Filesize
7.7MB

Download
memory/2044-2-0x0000000005630000-0x00000000056CC000-memory.dmp

Filesize
624KB

Download
memory/2044-1-0x00000000008B0000-0x00000000008EC000-memory.dmp

Filesize
240KB

Download

Analysis

Sharing