asyncrat | 2fed2e02c8e90c9265319f5d7bd573f68fd0b1f21c1ed97fa1695b51e45c2636

General

Target

2fed2e02c8e90c9265319f5d7bd573f68fd0b1f21c1ed97fa1695b51e45c2636N.exe
Size

63KB
MD5

9a553625e7bb4c85c51ef01ed4caf1e0
SHA1

3292c82975cea5051dd3f0e371491fade23d5fa4
SHA256

2fed2e02c8e90c9265319f5d7bd573f68fd0b1f21c1ed97fa1695b51e45c2636
SHA512

1eb2feff3b8443b499d6e19a02d958ffceea7ef70e283f40fdf812fddfcf633c3ab2b0576cec3a451135f529f807b14d7b2f10a7a42840e4e78d4b237e7223d7
SSDEEP

768:Cuw6LVcsTPq781wC8A+XjuazcBRL5JTk1+T4KSBGHmDbD/ph0oX52lSuEdpqKYhg:LeQPckdSJYUbdh91uEdpqKmY7

Score

10^/10

asyncrat default rat

Malware Config

Extracted

Family

asyncrat

Botnet

Default

C2

electronics-fear.gl.at.ply.gg:56358

Attributes

delay
1
install
true
install_file
dllhost.exe
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Roaming\dllhost.exe	family_asyncrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

2fed2e02c8e90c9265319f5d7bd573f68fd0b1f21c1ed97fa1695b51e45c2636N.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation	2fed2e02c8e90c9265319f5d7bd573f68fd0b1f21c1ed97fa1695b51e45c2636N.exe

Executes dropped EXE 1 IoCs

Processes:

dllhost.exe

pid process

1600 dllhost.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

4444 timeout.exe
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exe

pid process

3016 schtasks.exe

pid	process
1600	dllhost.exe

pid	process
4444	timeout.exe

pid	process
3016	schtasks.exe

Suspicious behavior: EnumeratesProcesses 23 IoCs

Processes:

2fed2e02c8e90c9265319f5d7bd573f68fd0b1f21c1ed97fa1695b51e45c2636N.exe

pid	process
2908	2fed2e02c8e90c9265319f5d7bd573f68fd0b1f21c1ed97fa1695b51e45c2636N.exe
2908	2fed2e02c8e90c9265319f5d7bd573f68fd0b1f21c1ed97fa1695b51e45c2636N.exe
2908	2fed2e02c8e90c9265319f5d7bd573f68fd0b1f21c1ed97fa1695b51e45c2636N.exe
2908	2fed2e02c8e90c9265319f5d7bd573f68fd0b1f21c1ed97fa1695b51e45c2636N.exe
2908	2fed2e02c8e90c9265319f5d7bd573f68fd0b1f21c1ed97fa1695b51e45c2636N.exe
2908	2fed2e02c8e90c9265319f5d7bd573f68fd0b1f21c1ed97fa1695b51e45c2636N.exe
2908	2fed2e02c8e90c9265319f5d7bd573f68fd0b1f21c1ed97fa1695b51e45c2636N.exe
2908	2fed2e02c8e90c9265319f5d7bd573f68fd0b1f21c1ed97fa1695b51e45c2636N.exe
2908	2fed2e02c8e90c9265319f5d7bd573f68fd0b1f21c1ed97fa1695b51e45c2636N.exe
2908	2fed2e02c8e90c9265319f5d7bd573f68fd0b1f21c1ed97fa1695b51e45c2636N.exe
2908	2fed2e02c8e90c9265319f5d7bd573f68fd0b1f21c1ed97fa1695b51e45c2636N.exe
2908	2fed2e02c8e90c9265319f5d7bd573f68fd0b1f21c1ed97fa1695b51e45c2636N.exe
2908	2fed2e02c8e90c9265319f5d7bd573f68fd0b1f21c1ed97fa1695b51e45c2636N.exe
2908	2fed2e02c8e90c9265319f5d7bd573f68fd0b1f21c1ed97fa1695b51e45c2636N.exe
2908	2fed2e02c8e90c9265319f5d7bd573f68fd0b1f21c1ed97fa1695b51e45c2636N.exe
2908	2fed2e02c8e90c9265319f5d7bd573f68fd0b1f21c1ed97fa1695b51e45c2636N.exe
2908	2fed2e02c8e90c9265319f5d7bd573f68fd0b1f21c1ed97fa1695b51e45c2636N.exe
2908	2fed2e02c8e90c9265319f5d7bd573f68fd0b1f21c1ed97fa1695b51e45c2636N.exe
2908	2fed2e02c8e90c9265319f5d7bd573f68fd0b1f21c1ed97fa1695b51e45c2636N.exe
2908	2fed2e02c8e90c9265319f5d7bd573f68fd0b1f21c1ed97fa1695b51e45c2636N.exe
2908	2fed2e02c8e90c9265319f5d7bd573f68fd0b1f21c1ed97fa1695b51e45c2636N.exe
2908	2fed2e02c8e90c9265319f5d7bd573f68fd0b1f21c1ed97fa1695b51e45c2636N.exe
2908	2fed2e02c8e90c9265319f5d7bd573f68fd0b1f21c1ed97fa1695b51e45c2636N.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

2fed2e02c8e90c9265319f5d7bd573f68fd0b1f21c1ed97fa1695b51e45c2636N.exedllhost.exe

description	pid	process
Token: SeDebugPrivilege	2908	2fed2e02c8e90c9265319f5d7bd573f68fd0b1f21c1ed97fa1695b51e45c2636N.exe
Token: SeDebugPrivilege	1600	dllhost.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

2fed2e02c8e90c9265319f5d7bd573f68fd0b1f21c1ed97fa1695b51e45c2636N.execmd.execmd.exe

description	pid	process	target process
PID 2908 wrote to memory of 632	2908	2fed2e02c8e90c9265319f5d7bd573f68fd0b1f21c1ed97fa1695b51e45c2636N.exe	cmd.exe
PID 2908 wrote to memory of 632	2908	2fed2e02c8e90c9265319f5d7bd573f68fd0b1f21c1ed97fa1695b51e45c2636N.exe	cmd.exe
PID 2908 wrote to memory of 1808	2908	2fed2e02c8e90c9265319f5d7bd573f68fd0b1f21c1ed97fa1695b51e45c2636N.exe	cmd.exe
PID 2908 wrote to memory of 1808	2908	2fed2e02c8e90c9265319f5d7bd573f68fd0b1f21c1ed97fa1695b51e45c2636N.exe	cmd.exe
PID 1808 wrote to memory of 4444	1808	cmd.exe	timeout.exe
PID 1808 wrote to memory of 4444	1808	cmd.exe	timeout.exe
PID 632 wrote to memory of 3016	632	cmd.exe	schtasks.exe
PID 632 wrote to memory of 3016	632	cmd.exe	schtasks.exe
PID 1808 wrote to memory of 1600	1808	cmd.exe	dllhost.exe
PID 1808 wrote to memory of 1600	1808	cmd.exe	dllhost.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2fed2e02c8e90c9265319f5d7bd573f68fd0b1f21c1ed97fa1695b51e45c2636N.exe
"C:\Users\Admin\AppData\Local\Temp\2fed2e02c8e90c9265319f5d7bd573f68fd0b1f21c1ed97fa1695b51e45c2636N.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2908

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "dllhost" /tr '"C:\Users\Admin\AppData\Roaming\dllhost.exe"' & exit
2⤵
- Suspicious use of WriteProcessMemory
PID:632

C:\Windows\system32\schtasks.exe
schtasks /create /f /sc onlogon /rl highest /tn "dllhost" /tr '"C:\Users\Admin\AppData\Roaming\dllhost.exe"'
3⤵
- Scheduled Task/Job: Scheduled Task
PID:3016

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp1C7C.tmp.bat""
2⤵
- Suspicious use of WriteProcessMemory
PID:1808

C:\Windows\system32\timeout.exe
timeout 3
3⤵
- Delays execution with timeout.exe
PID:4444

C:\Users\Admin\AppData\Roaming\dllhost.exe
"C:\Users\Admin\AppData\Roaming\dllhost.exe"
3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1600

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp1C7C.tmp.bat

Filesize
151B

MD5
84dc42f987963d290bdab43a5dfee9b7

SHA1
a447d330c59c126ef26b1a173017cb7290cad5ec

SHA256
b367013b52859d1c776ebc9419bcc0533f02610f8460b31ec50ce07f09385e84

SHA512
db663d1fa25f9c74ecec57efb037500d97862fa34267c58b198a4cf4383b445b433be0d6959869381b9ed306e4373684460c572783f89874504b6c8f68cfb1db

Download Submit
C:\Users\Admin\AppData\Roaming\dllhost.exe

Filesize
63KB

MD5
9a553625e7bb4c85c51ef01ed4caf1e0

SHA1
3292c82975cea5051dd3f0e371491fade23d5fa4

SHA256
2fed2e02c8e90c9265319f5d7bd573f68fd0b1f21c1ed97fa1695b51e45c2636

SHA512
1eb2feff3b8443b499d6e19a02d958ffceea7ef70e283f40fdf812fddfcf633c3ab2b0576cec3a451135f529f807b14d7b2f10a7a42840e4e78d4b237e7223d7

Download Submit
memory/2908-0-0x00007FF813C53000-0x00007FF813C55000-memory.dmp

Filesize
8KB

Download
memory/2908-1-0x0000000000100000-0x0000000000116000-memory.dmp

Filesize
88KB

Download
memory/2908-2-0x00007FF813C50000-0x00007FF814711000-memory.dmp

Filesize
10.8MB

Download
memory/2908-8-0x00007FF813C50000-0x00007FF814711000-memory.dmp

Filesize
10.8MB

Download
memory/2908-7-0x00007FF813C50000-0x00007FF814711000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads