asyncrat | 7c15fa68e1ae83f81c98a2c616753777ccd720a8a2a1adda490e08be9369a3c8

General

Target

search.exe
Size

63KB
MD5

4a3d7bd2084b48024bf8f459b10aa913
SHA1

ed47940c8e00f846e0656bd95ca14ddd8d157ba0
SHA256

7c15fa68e1ae83f81c98a2c616753777ccd720a8a2a1adda490e08be9369a3c8
SHA512

94e00110aa23f713e099039b027d01e7ea1c5521b4f9b6563cebf537eafb226a3aa840d7f3f4ec08872ec098bd57567c3fd8c3694ea62468139ae84ee5cc5b35
SSDEEP

768:RdGnVhwdjndk78TQC8A+XiuazcBRL5JTk1+T4KSBGHmDbD/ph0oXkDkhgOSuAdph:mnSdsNdSJYUbdh9kcIuAdpqKmY7

Score

10^/10

asyncrat default rat

Malware Config

Extracted

Family

asyncrat

Botnet

Default

C2

natural-familiar.gl.at.ply.gg:65030

Attributes

delay
1
install
true
install_file
search.exe
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Roaming\search.exe	family_asyncrat

Executes dropped EXE 1 IoCs

Processes:

search.exe

pid process

2672 search.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

2780 timeout.exe
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exe

pid process

1220 schtasks.exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

search.exe

pid process

2668 search.exe
2668 search.exe
2668 search.exe

pid	process
2672	search.exe

pid	process
2780	timeout.exe

pid	process
1220	schtasks.exe

pid	process
2668	search.exe
2668	search.exe
2668	search.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

search.exesearch.exe

description	pid	process
Token: SeDebugPrivilege	2668	search.exe
Token: SeDebugPrivilege	2668	search.exe
Token: SeDebugPrivilege	2672	search.exe
Token: SeDebugPrivilege	2672	search.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

search.execmd.execmd.exe

description	pid	process	target process
PID 2668 wrote to memory of 2760	2668	search.exe	cmd.exe
PID 2668 wrote to memory of 2760	2668	search.exe	cmd.exe
PID 2668 wrote to memory of 2760	2668	search.exe	cmd.exe
PID 2668 wrote to memory of 2676	2668	search.exe	cmd.exe
PID 2668 wrote to memory of 2676	2668	search.exe	cmd.exe
PID 2668 wrote to memory of 2676	2668	search.exe	cmd.exe
PID 2676 wrote to memory of 2780	2676	cmd.exe	timeout.exe
PID 2676 wrote to memory of 2780	2676	cmd.exe	timeout.exe
PID 2676 wrote to memory of 2780	2676	cmd.exe	timeout.exe
PID 2760 wrote to memory of 1220	2760	cmd.exe	schtasks.exe
PID 2760 wrote to memory of 1220	2760	cmd.exe	schtasks.exe
PID 2760 wrote to memory of 1220	2760	cmd.exe	schtasks.exe
PID 2676 wrote to memory of 2672	2676	cmd.exe	search.exe
PID 2676 wrote to memory of 2672	2676	cmd.exe	search.exe
PID 2676 wrote to memory of 2672	2676	cmd.exe	search.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\search.exe
"C:\Users\Admin\AppData\Local\Temp\search.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2668

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "search" /tr '"C:\Users\Admin\AppData\Roaming\search.exe"' & exit
2⤵
- Suspicious use of WriteProcessMemory
PID:2760

C:\Windows\system32\schtasks.exe
schtasks /create /f /sc onlogon /rl highest /tn "search" /tr '"C:\Users\Admin\AppData\Roaming\search.exe"'
3⤵
- Scheduled Task/Job: Scheduled Task
PID:1220

C:\Windows\system32\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpF1BE.tmp.bat""
2⤵
- Suspicious use of WriteProcessMemory
PID:2676

C:\Windows\system32\timeout.exe
timeout 3
3⤵
- Delays execution with timeout.exe
PID:2780

C:\Users\Admin\AppData\Roaming\search.exe
"C:\Users\Admin\AppData\Roaming\search.exe"
3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2672

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpF1BE.tmp.bat

Filesize
150B

MD5
b1d0a0e38eae77faab83d6e673dae041

SHA1
ac90dd6bb3eae81355b6f112528fa888d224139e

SHA256
4028dbcfbc07d56aea281d2cff4f15318dc5ec7586952ca93023d3578ca9115b

SHA512
ccd8651e2a3155f600588af133db1efb0c4cd3d4015466d58e48a5a2f466874cf0926d5699abf8241647e917d5ad38042a51af05d4d61df1bfbc15f2ecdea642

Download Submit
C:\Users\Admin\AppData\Roaming\search.exe

Filesize
63KB

MD5
4a3d7bd2084b48024bf8f459b10aa913

SHA1
ed47940c8e00f846e0656bd95ca14ddd8d157ba0

SHA256
7c15fa68e1ae83f81c98a2c616753777ccd720a8a2a1adda490e08be9369a3c8

SHA512
94e00110aa23f713e099039b027d01e7ea1c5521b4f9b6563cebf537eafb226a3aa840d7f3f4ec08872ec098bd57567c3fd8c3694ea62468139ae84ee5cc5b35

Download Submit
memory/2668-0-0x000007FEF5473000-0x000007FEF5474000-memory.dmp

Filesize
4KB

Download
memory/2668-1-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/2668-2-0x000007FEF5470000-0x000007FEF5E5C000-memory.dmp

Filesize
9.9MB

Download
memory/2668-3-0x000007FEF5470000-0x000007FEF5E5C000-memory.dmp

Filesize
9.9MB

Download
memory/2668-12-0x000007FEF5470000-0x000007FEF5E5C000-memory.dmp

Filesize
9.9MB

Download
memory/2672-17-0x0000000001350000-0x0000000001366000-memory.dmp

Filesize
88KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads