asyncrat | 9c75c0e33bb81cadd1659deef9302106b7f2358cd8ea613e6e8b76f41e60ba8a

General

Target

9c75c0e33bb81cadd1659deef9302106b7f2358cd8ea613e6e8b76f41e60ba8a.exe
Size

74KB
MD5

76e8d35fe35dce2fb65d0e2fb1be067c
SHA1

543ae7d1f3288b6439f50a7a6c50dacf02d13af4
SHA256

9c75c0e33bb81cadd1659deef9302106b7f2358cd8ea613e6e8b76f41e60ba8a
SHA512

d1a406fb8862577e0ba9ed1404b7568fcf519e8a39bc966e9ea58922bb2eb34bdd7275f9f3c6688b77d3604427a21973484d0b15a9cb4c992f61b17a2d775f02
SSDEEP

1536:ChUZAcxjVLcoCJPPMVOe9VdQuDI6H1bf/OQzc+LVclN:yUWcxjVLLCPPMVOe9VdQsH1bfGQXBY

Score

10^/10

asyncrat default rat

Malware Config

Extracted

Family

asyncrat

Version

Venom RAT + HVNC + Stealer + Grabber v6.0.3

Botnet

Default

C2

91.92.246.193:4444

Mutex

jugycwtdwjqv

Attributes

delay
1
install
true
install_file
task.exe
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

VenomRAT 3 IoCs

Detects VenomRAT.

rat

resource	yara_rule
behavioral1/memory/2544-1-0x0000000000070000-0x0000000000088000-memory.dmp	VenomRAT
behavioral1/files/0x00090000000190d2-16.dat	VenomRAT
behavioral1/memory/2624-18-0x0000000000CD0000-0x0000000000CE8000-memory.dmp	VenomRAT

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral1/files/0x00090000000190d2-16.dat	family_asyncrat

Executes dropped EXE 1 IoCs

pid	Process
2624	task.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
2884	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3008	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2544	9c75c0e33bb81cadd1659deef9302106b7f2358cd8ea613e6e8b76f41e60ba8a.exe
2544	9c75c0e33bb81cadd1659deef9302106b7f2358cd8ea613e6e8b76f41e60ba8a.exe
2544	9c75c0e33bb81cadd1659deef9302106b7f2358cd8ea613e6e8b76f41e60ba8a.exe
2624	task.exe
2624	task.exe
2624	task.exe
2624	task.exe
2624	task.exe
2624	task.exe
2624	task.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2544	9c75c0e33bb81cadd1659deef9302106b7f2358cd8ea613e6e8b76f41e60ba8a.exe
Token: SeDebugPrivilege	2624	task.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2624	task.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 2544 wrote to memory of 2080	2544	9c75c0e33bb81cadd1659deef9302106b7f2358cd8ea613e6e8b76f41e60ba8a.exe	30
PID 2544 wrote to memory of 2080	2544	9c75c0e33bb81cadd1659deef9302106b7f2358cd8ea613e6e8b76f41e60ba8a.exe	30
PID 2544 wrote to memory of 2080	2544	9c75c0e33bb81cadd1659deef9302106b7f2358cd8ea613e6e8b76f41e60ba8a.exe	30
PID 2544 wrote to memory of 1108	2544	9c75c0e33bb81cadd1659deef9302106b7f2358cd8ea613e6e8b76f41e60ba8a.exe	31
PID 2544 wrote to memory of 1108	2544	9c75c0e33bb81cadd1659deef9302106b7f2358cd8ea613e6e8b76f41e60ba8a.exe	31
PID 2544 wrote to memory of 1108	2544	9c75c0e33bb81cadd1659deef9302106b7f2358cd8ea613e6e8b76f41e60ba8a.exe	31
PID 1108 wrote to memory of 2884	1108	cmd.exe	34
PID 1108 wrote to memory of 2884	1108	cmd.exe	34
PID 1108 wrote to memory of 2884	1108	cmd.exe	34
PID 2080 wrote to memory of 3008	2080	cmd.exe	35
PID 2080 wrote to memory of 3008	2080	cmd.exe	35
PID 2080 wrote to memory of 3008	2080	cmd.exe	35
PID 1108 wrote to memory of 2624	1108	cmd.exe	36
PID 1108 wrote to memory of 2624	1108	cmd.exe	36
PID 1108 wrote to memory of 2624	1108	cmd.exe	36

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\9c75c0e33bb81cadd1659deef9302106b7f2358cd8ea613e6e8b76f41e60ba8a.exe
"C:\Users\Admin\AppData\Local\Temp\9c75c0e33bb81cadd1659deef9302106b7f2358cd8ea613e6e8b76f41e60ba8a.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2544
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "task" /tr '"C:\Users\Admin\AppData\Roaming\task.exe"' & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2080
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc onlogon /rl highest /tn "task" /tr '"C:\Users\Admin\AppData\Roaming\task.exe"'
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3008
- C:\Windows\system32\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp9F5B.tmp.bat""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1108
- - C:\Windows\system32\timeout.exe
    timeout 3
    3⤵
    - Delays execution with timeout.exe
    PID:2884
- - C:\Users\Admin\AppData\Roaming\task.exe
    "C:\Users\Admin\AppData\Roaming\task.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:2624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp9F5B.tmp.bat

Filesize
148B

MD5
53ce50f9b4d5c9e6f5b5846b61f47ac9

SHA1
adb85aed748d5aa88565af822b2f5ceb8e9e42d6

SHA256
898f4ef2c7d493c6ef598d7702bc1943752b7d07754eb44f9d6679c6e932ff6a

SHA512
52ba9b63d95b38d879c82ec299fdf2dc7dec6af433e1e04e9929be8306fa5a3950839c26f88031e247978946f18bf2d90cd0bb4038a6198dca8742d8bc825c95

Download Submit
C:\Users\Admin\AppData\Roaming\MyData\DataLogs.conf

Filesize
8B

MD5
cf759e4c5f14fe3eec41b87ed756cea8

SHA1
c27c796bb3c2fac929359563676f4ba1ffada1f5

SHA256
c9f9f193409217f73cc976ad078c6f8bf65d3aabcf5fad3e5a47536d47aa6761

SHA512
c7f832aee13a5eb36d145f35d4464374a9e12fa2017f3c2257442d67483b35a55eccae7f7729243350125b37033e075efbc2303839fd86b81b9b4dca3626953b

Download Submit
C:\Users\Admin\AppData\Roaming\task.exe

Filesize
74KB

MD5
76e8d35fe35dce2fb65d0e2fb1be067c

SHA1
543ae7d1f3288b6439f50a7a6c50dacf02d13af4

SHA256
9c75c0e33bb81cadd1659deef9302106b7f2358cd8ea613e6e8b76f41e60ba8a

SHA512
d1a406fb8862577e0ba9ed1404b7568fcf519e8a39bc966e9ea58922bb2eb34bdd7275f9f3c6688b77d3604427a21973484d0b15a9cb4c992f61b17a2d775f02

Download Submit
memory/2544-0-0x000007FEF5FA3000-0x000007FEF5FA4000-memory.dmp

Filesize
4KB

Download
memory/2544-1-0x0000000000070000-0x0000000000088000-memory.dmp

Filesize
96KB

Download
memory/2544-3-0x000007FEF5FA0000-0x000007FEF698C000-memory.dmp

Filesize
9.9MB

Download
memory/2544-12-0x000007FEF5FA0000-0x000007FEF698C000-memory.dmp

Filesize
9.9MB

Download
memory/2544-14-0x000007FEF5FA0000-0x000007FEF698C000-memory.dmp

Filesize
9.9MB

Download
memory/2624-18-0x0000000000CD0000-0x0000000000CE8000-memory.dmp

Filesize
96KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads