asyncrat | 20e9ad367dd61cf76d9aa1bd6993cf2c6a289b433d44fb445b0fb6d8a634fd03

General

Target

20e9ad367dd61cf76d9aa1bd6993cf2c6a289b433d44fb445b0fb6d8a634fd03.exe
Size

577KB
MD5

b98dc1d3907a29896233f92a1f91cc15
SHA1

daf5fa345ab29376c10ada6065f4e77526e8b531
SHA256

20e9ad367dd61cf76d9aa1bd6993cf2c6a289b433d44fb445b0fb6d8a634fd03
SHA512

a387a75cdb72537458e692e2339ed0840d7a4ffec390becd5175e142f10467c8e67c8c268b682b5c9d05facbdd1164c1d35875994b1b2398fca4578256bd6c90
SSDEEP

3072:COsA++eZfkec3uppruBjYP2+t9deQ+rjnCvulC7/X3UcrBw5KPA:vsA++eFfniB853eQ+rTCvNxrCKP

Score

10^/10

asyncrat 591_grebe discovery rat

Malware Config

Extracted

Family

asyncrat

Version

1.0.7

Botnet

591_GreBe

C2

89.105.201.98:591

Mutex

NJ1234dfffddfddfdfKJHYGTGYHUJIKOuy7t6r5er6t7y98u0iH&GYFTRCVGBHU9u8y7T^R%DFTYG&UHJ(K)_

Attributes

delay
1
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Suspicious use of SetThreadContext 1 IoCs

Processes:

20e9ad367dd61cf76d9aa1bd6993cf2c6a289b433d44fb445b0fb6d8a634fd03.exe

description	pid	process	target process
PID 2532 set thread context of 2008	2532	20e9ad367dd61cf76d9aa1bd6993cf2c6a289b433d44fb445b0fb6d8a634fd03.exe	AppLaunch.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

20e9ad367dd61cf76d9aa1bd6993cf2c6a289b433d44fb445b0fb6d8a634fd03.exeAppLaunch.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	20e9ad367dd61cf76d9aa1bd6993cf2c6a289b433d44fb445b0fb6d8a634fd03.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AppLaunch.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

20e9ad367dd61cf76d9aa1bd6993cf2c6a289b433d44fb445b0fb6d8a634fd03.exe

pid	process
2532	20e9ad367dd61cf76d9aa1bd6993cf2c6a289b433d44fb445b0fb6d8a634fd03.exe
2532	20e9ad367dd61cf76d9aa1bd6993cf2c6a289b433d44fb445b0fb6d8a634fd03.exe
2532	20e9ad367dd61cf76d9aa1bd6993cf2c6a289b433d44fb445b0fb6d8a634fd03.exe
2532	20e9ad367dd61cf76d9aa1bd6993cf2c6a289b433d44fb445b0fb6d8a634fd03.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

20e9ad367dd61cf76d9aa1bd6993cf2c6a289b433d44fb445b0fb6d8a634fd03.exeAppLaunch.exe

description	pid	process
Token: SeDebugPrivilege	2532	20e9ad367dd61cf76d9aa1bd6993cf2c6a289b433d44fb445b0fb6d8a634fd03.exe
Token: SeDebugPrivilege	2008	AppLaunch.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

20e9ad367dd61cf76d9aa1bd6993cf2c6a289b433d44fb445b0fb6d8a634fd03.exe

description	pid	process	target process
PID 2532 wrote to memory of 3284	2532	20e9ad367dd61cf76d9aa1bd6993cf2c6a289b433d44fb445b0fb6d8a634fd03.exe	AppLaunch.exe
PID 2532 wrote to memory of 3284	2532	20e9ad367dd61cf76d9aa1bd6993cf2c6a289b433d44fb445b0fb6d8a634fd03.exe	AppLaunch.exe
PID 2532 wrote to memory of 3284	2532	20e9ad367dd61cf76d9aa1bd6993cf2c6a289b433d44fb445b0fb6d8a634fd03.exe	AppLaunch.exe
PID 2532 wrote to memory of 3284	2532	20e9ad367dd61cf76d9aa1bd6993cf2c6a289b433d44fb445b0fb6d8a634fd03.exe	AppLaunch.exe
PID 2532 wrote to memory of 3284	2532	20e9ad367dd61cf76d9aa1bd6993cf2c6a289b433d44fb445b0fb6d8a634fd03.exe	AppLaunch.exe
PID 2532 wrote to memory of 3284	2532	20e9ad367dd61cf76d9aa1bd6993cf2c6a289b433d44fb445b0fb6d8a634fd03.exe	AppLaunch.exe
PID 2532 wrote to memory of 3284	2532	20e9ad367dd61cf76d9aa1bd6993cf2c6a289b433d44fb445b0fb6d8a634fd03.exe	AppLaunch.exe
PID 2532 wrote to memory of 3284	2532	20e9ad367dd61cf76d9aa1bd6993cf2c6a289b433d44fb445b0fb6d8a634fd03.exe	AppLaunch.exe
PID 2532 wrote to memory of 2008	2532	20e9ad367dd61cf76d9aa1bd6993cf2c6a289b433d44fb445b0fb6d8a634fd03.exe	AppLaunch.exe
PID 2532 wrote to memory of 2008	2532	20e9ad367dd61cf76d9aa1bd6993cf2c6a289b433d44fb445b0fb6d8a634fd03.exe	AppLaunch.exe
PID 2532 wrote to memory of 2008	2532	20e9ad367dd61cf76d9aa1bd6993cf2c6a289b433d44fb445b0fb6d8a634fd03.exe	AppLaunch.exe
PID 2532 wrote to memory of 2008	2532	20e9ad367dd61cf76d9aa1bd6993cf2c6a289b433d44fb445b0fb6d8a634fd03.exe	AppLaunch.exe
PID 2532 wrote to memory of 2008	2532	20e9ad367dd61cf76d9aa1bd6993cf2c6a289b433d44fb445b0fb6d8a634fd03.exe	AppLaunch.exe
PID 2532 wrote to memory of 2008	2532	20e9ad367dd61cf76d9aa1bd6993cf2c6a289b433d44fb445b0fb6d8a634fd03.exe	AppLaunch.exe
PID 2532 wrote to memory of 2008	2532	20e9ad367dd61cf76d9aa1bd6993cf2c6a289b433d44fb445b0fb6d8a634fd03.exe	AppLaunch.exe
PID 2532 wrote to memory of 2008	2532	20e9ad367dd61cf76d9aa1bd6993cf2c6a289b433d44fb445b0fb6d8a634fd03.exe	AppLaunch.exe

C:\Users\Admin\AppData\Local\Temp\20e9ad367dd61cf76d9aa1bd6993cf2c6a289b433d44fb445b0fb6d8a634fd03.exe
"C:\Users\Admin\AppData\Local\Temp\20e9ad367dd61cf76d9aa1bd6993cf2c6a289b433d44fb445b0fb6d8a634fd03.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2532

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
2⤵
PID:3284

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2008

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2008-15-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2008-26-0x0000000075160000-0x0000000075910000-memory.dmp

Filesize
7.7MB

Download
memory/2008-25-0x0000000075160000-0x0000000075910000-memory.dmp

Filesize
7.7MB

Download
memory/2008-24-0x0000000075160000-0x0000000075910000-memory.dmp

Filesize
7.7MB

Download
memory/2008-23-0x0000000075160000-0x0000000075910000-memory.dmp

Filesize
7.7MB

Download
memory/2008-22-0x0000000005A90000-0x0000000005AF6000-memory.dmp

Filesize
408KB

Download
memory/2008-19-0x0000000075160000-0x0000000075910000-memory.dmp

Filesize
7.7MB

Download
memory/2008-18-0x0000000075160000-0x0000000075910000-memory.dmp

Filesize
7.7MB

Download
memory/2532-6-0x0000000009FE0000-0x000000000A584000-memory.dmp

Filesize
5.6MB

Download
memory/2532-8-0x0000000009AB0000-0x0000000009ABA000-memory.dmp

Filesize
40KB

Download
memory/2532-10-0x00000000070B0000-0x00000000070CA000-memory.dmp

Filesize
104KB

Download
memory/2532-11-0x00000000070E0000-0x00000000070E6000-memory.dmp

Filesize
24KB

Download
memory/2532-12-0x000000007516E000-0x000000007516F000-memory.dmp

Filesize
4KB

Download
memory/2532-13-0x0000000075160000-0x0000000075910000-memory.dmp

Filesize
7.7MB

Download
memory/2532-14-0x0000000075160000-0x0000000075910000-memory.dmp

Filesize
7.7MB

Download
memory/2532-9-0x0000000075160000-0x0000000075910000-memory.dmp

Filesize
7.7MB

Download
memory/2532-17-0x0000000075160000-0x0000000075910000-memory.dmp

Filesize
7.7MB

Download
memory/2532-7-0x0000000009AD0000-0x0000000009B62000-memory.dmp

Filesize
584KB

Download
memory/2532-0-0x000000007516E000-0x000000007516F000-memory.dmp

Filesize
4KB

Download
memory/2532-5-0x0000000002620000-0x0000000002626000-memory.dmp

Filesize
24KB

Download
memory/2532-4-0x00000000072C0000-0x0000000007582000-memory.dmp

Filesize
2.8MB

Download
memory/2532-3-0x0000000075160000-0x0000000075910000-memory.dmp

Filesize
7.7MB

Download
memory/2532-2-0x0000000004BE0000-0x0000000004C7C000-memory.dmp

Filesize
624KB

Download
memory/2532-1-0x00000000008E0000-0x0000000000976000-memory.dmp

Filesize
600KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads