asyncrat | 8ee6f68dca0099b47df91506985c862800981bc91cc01d35768abe0350a2f3dc

General

Target

8ee6f68dca0099b47df91506985c862800981bc91cc01d35768abe0350a2f3dc.exe
Size

73KB
MD5

0bbabbd07feac55a3cea61b0f420c76e
SHA1

d6c4efa8da5419be01909320165a968435198855
SHA256

8ee6f68dca0099b47df91506985c862800981bc91cc01d35768abe0350a2f3dc
SHA512

4a047e9e613adf2067bab73d9896e0119dc219103fde9d76bd47f7e63d2c5c416aae5809bd5c741081349b10a946b82c36a56578ed19af96682d08eda25acd37
SSDEEP

1536:dUhQcx/5z/CMfPMV6e9VdQkhDIyH1bf/90AxQzcX3VclN:dUOcx/5bHfPMV6e9VdQgH1bfaAxQilY

Score

10^/10

asyncrat default rat

Malware Config

Extracted

Family

asyncrat

Version

Venom RAT + HVNC + Stealer + Grabber v6.0.3

Botnet

Default

C2

147.185.221.20:47800

Mutex

jrezrdiemuo

Attributes

delay
1
install
true
install_file
kV.exe
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

VenomRAT 3 IoCs

Detects VenomRAT.

rat

Processes:

resource	yara_rule
behavioral1/memory/2336-1-0x0000000000B10000-0x0000000000B26000-memory.dmp	VenomRAT
\Users\Admin\AppData\Roaming\kV.exe	VenomRAT
behavioral1/memory/2780-19-0x00000000001F0000-0x0000000000206000-memory.dmp	VenomRAT

Executes dropped EXE 1 IoCs

Processes:

kV.exe

pid process

2780 kV.exe
Loads dropped DLL 1 IoCs

Processes:

cmd.exe

pid process

696 cmd.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

2832 timeout.exe
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exe

pid process

2836 schtasks.exe

pid	process
2780	kV.exe

pid	process
696	cmd.exe

pid	process
2832	timeout.exe

pid	process
2836	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

8ee6f68dca0099b47df91506985c862800981bc91cc01d35768abe0350a2f3dc.exekV.exe

pid	process
2336	8ee6f68dca0099b47df91506985c862800981bc91cc01d35768abe0350a2f3dc.exe
2336	8ee6f68dca0099b47df91506985c862800981bc91cc01d35768abe0350a2f3dc.exe
2336	8ee6f68dca0099b47df91506985c862800981bc91cc01d35768abe0350a2f3dc.exe
2780	kV.exe
2780	kV.exe
2780	kV.exe
2780	kV.exe
2780	kV.exe
2780	kV.exe
2780	kV.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

8ee6f68dca0099b47df91506985c862800981bc91cc01d35768abe0350a2f3dc.exekV.exe

description	pid	process
Token: SeDebugPrivilege	2336	8ee6f68dca0099b47df91506985c862800981bc91cc01d35768abe0350a2f3dc.exe
Token: SeDebugPrivilege	2780	kV.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

kV.exe

pid process

2780 kV.exe

pid	process
2780	kV.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

8ee6f68dca0099b47df91506985c862800981bc91cc01d35768abe0350a2f3dc.execmd.execmd.exe

description	pid	process	target process
PID 2336 wrote to memory of 2324	2336	8ee6f68dca0099b47df91506985c862800981bc91cc01d35768abe0350a2f3dc.exe	cmd.exe
PID 2336 wrote to memory of 2324	2336	8ee6f68dca0099b47df91506985c862800981bc91cc01d35768abe0350a2f3dc.exe	cmd.exe
PID 2336 wrote to memory of 2324	2336	8ee6f68dca0099b47df91506985c862800981bc91cc01d35768abe0350a2f3dc.exe	cmd.exe
PID 2336 wrote to memory of 696	2336	8ee6f68dca0099b47df91506985c862800981bc91cc01d35768abe0350a2f3dc.exe	cmd.exe
PID 2336 wrote to memory of 696	2336	8ee6f68dca0099b47df91506985c862800981bc91cc01d35768abe0350a2f3dc.exe	cmd.exe
PID 2336 wrote to memory of 696	2336	8ee6f68dca0099b47df91506985c862800981bc91cc01d35768abe0350a2f3dc.exe	cmd.exe
PID 2324 wrote to memory of 2836	2324	cmd.exe	schtasks.exe
PID 2324 wrote to memory of 2836	2324	cmd.exe	schtasks.exe
PID 2324 wrote to memory of 2836	2324	cmd.exe	schtasks.exe
PID 696 wrote to memory of 2832	696	cmd.exe	timeout.exe
PID 696 wrote to memory of 2832	696	cmd.exe	timeout.exe
PID 696 wrote to memory of 2832	696	cmd.exe	timeout.exe
PID 696 wrote to memory of 2780	696	cmd.exe	kV.exe
PID 696 wrote to memory of 2780	696	cmd.exe	kV.exe
PID 696 wrote to memory of 2780	696	cmd.exe	kV.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\8ee6f68dca0099b47df91506985c862800981bc91cc01d35768abe0350a2f3dc.exe
"C:\Users\Admin\AppData\Local\Temp\8ee6f68dca0099b47df91506985c862800981bc91cc01d35768abe0350a2f3dc.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2336
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "kV" /tr '"C:\Users\Admin\AppData\Roaming\kV.exe"' & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2324
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc onlogon /rl highest /tn "kV" /tr '"C:\Users\Admin\AppData\Roaming\kV.exe"'
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2836
- C:\Windows\system32\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpD6FE.tmp.bat""
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:696
- - C:\Windows\system32\timeout.exe
    timeout 3
    3⤵
    - Delays execution with timeout.exe
    PID:2832
- - C:\Users\Admin\AppData\Roaming\kV.exe
    "C:\Users\Admin\AppData\Roaming\kV.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:2780

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpD6FE.tmp.bat

Filesize
146B

MD5
db4b641c7ee55b2f629a6786001c6d6f

SHA1
b96afcd90d35937b0c95439722d443f14eee7c87

SHA256
c1e8db9d3abd7a7df9cfd0ea076644132205ed2e685da2d0043902915a3ef810

SHA512
4438fd271b14b8265fd9ad6e9e4b203ecf4d131df8484d4f85a87b01f8a7e6c661c034447b7e94c64b6dc5d7b676eff4fef64ca076931dcfe63cb2df99ee905a

Download Submit
C:\Users\Admin\AppData\Roaming\MyData\DataLogs.conf

Filesize
8B

MD5
cf759e4c5f14fe3eec41b87ed756cea8

SHA1
c27c796bb3c2fac929359563676f4ba1ffada1f5

SHA256
c9f9f193409217f73cc976ad078c6f8bf65d3aabcf5fad3e5a47536d47aa6761

SHA512
c7f832aee13a5eb36d145f35d4464374a9e12fa2017f3c2257442d67483b35a55eccae7f7729243350125b37033e075efbc2303839fd86b81b9b4dca3626953b

Download Submit
\Users\Admin\AppData\Roaming\kV.exe

Filesize
73KB

MD5
0bbabbd07feac55a3cea61b0f420c76e

SHA1
d6c4efa8da5419be01909320165a968435198855

SHA256
8ee6f68dca0099b47df91506985c862800981bc91cc01d35768abe0350a2f3dc

SHA512
4a047e9e613adf2067bab73d9896e0119dc219103fde9d76bd47f7e63d2c5c416aae5809bd5c741081349b10a946b82c36a56578ed19af96682d08eda25acd37

Download Submit
memory/2336-0-0x000007FEF57F3000-0x000007FEF57F4000-memory.dmp

Filesize
4KB

Download
memory/2336-1-0x0000000000B10000-0x0000000000B26000-memory.dmp

Filesize
88KB

Download
memory/2336-3-0x000007FEF57F0000-0x000007FEF61DC000-memory.dmp

Filesize
9.9MB

Download
memory/2336-11-0x000007FEF57F0000-0x000007FEF61DC000-memory.dmp

Filesize
9.9MB

Download
memory/2336-13-0x000007FEF57F0000-0x000007FEF61DC000-memory.dmp

Filesize
9.9MB

Download
memory/2780-19-0x00000000001F0000-0x0000000000206000-memory.dmp

Filesize
88KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads