asyncrat | 7c15fa68e1ae83f81c98a2c616753777ccd720a8a2a1adda490e08be9369a3c8

General

Target

search.exe
Size

63KB
MD5

4a3d7bd2084b48024bf8f459b10aa913
SHA1

ed47940c8e00f846e0656bd95ca14ddd8d157ba0
SHA256

7c15fa68e1ae83f81c98a2c616753777ccd720a8a2a1adda490e08be9369a3c8
SHA512

94e00110aa23f713e099039b027d01e7ea1c5521b4f9b6563cebf537eafb226a3aa840d7f3f4ec08872ec098bd57567c3fd8c3694ea62468139ae84ee5cc5b35
SSDEEP

768:RdGnVhwdjndk78TQC8A+XiuazcBRL5JTk1+T4KSBGHmDbD/ph0oXkDkhgOSuAdph:mnSdsNdSJYUbdh9kcIuAdpqKmY7

Score

10^/10

asyncrat default rat

Malware Config

Extracted

Family

asyncrat

Botnet

Default

C2

natural-familiar.gl.at.ply.gg:65030

Attributes

delay
1
install
true
install_file
search.exe
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Roaming\search.exe	family_asyncrat

Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

search.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation search.exe
Executes dropped EXE 1 IoCs

Processes:

search.exe

pid process

768 search.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

640 timeout.exe
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exe

pid process

2520 schtasks.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	search.exe

pid	process
768	search.exe

pid	process
640	timeout.exe

pid	process
2520	schtasks.exe

Suspicious behavior: EnumeratesProcesses 19 IoCs

Processes:

search.exe

pid	process
2564	search.exe
2564	search.exe
2564	search.exe
2564	search.exe
2564	search.exe
2564	search.exe
2564	search.exe
2564	search.exe
2564	search.exe
2564	search.exe
2564	search.exe
2564	search.exe
2564	search.exe
2564	search.exe
2564	search.exe
2564	search.exe
2564	search.exe
2564	search.exe
2564	search.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

search.exesearch.exe

description	pid	process
Token: SeDebugPrivilege	2564	search.exe
Token: SeDebugPrivilege	2564	search.exe
Token: SeDebugPrivilege	768	search.exe
Token: SeDebugPrivilege	768	search.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

search.execmd.execmd.exe

description	pid	process	target process
PID 2564 wrote to memory of 4304	2564	search.exe	cmd.exe
PID 2564 wrote to memory of 4304	2564	search.exe	cmd.exe
PID 2564 wrote to memory of 4092	2564	search.exe	cmd.exe
PID 2564 wrote to memory of 4092	2564	search.exe	cmd.exe
PID 4092 wrote to memory of 640	4092	cmd.exe	timeout.exe
PID 4092 wrote to memory of 640	4092	cmd.exe	timeout.exe
PID 4304 wrote to memory of 2520	4304	cmd.exe	schtasks.exe
PID 4304 wrote to memory of 2520	4304	cmd.exe	schtasks.exe
PID 4092 wrote to memory of 768	4092	cmd.exe	search.exe
PID 4092 wrote to memory of 768	4092	cmd.exe	search.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\search.exe
"C:\Users\Admin\AppData\Local\Temp\search.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2564

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "search" /tr '"C:\Users\Admin\AppData\Roaming\search.exe"' & exit
2⤵
- Suspicious use of WriteProcessMemory
PID:4304

C:\Windows\system32\schtasks.exe
schtasks /create /f /sc onlogon /rl highest /tn "search" /tr '"C:\Users\Admin\AppData\Roaming\search.exe"'
3⤵
- Scheduled Task/Job: Scheduled Task
PID:2520

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpBFC6.tmp.bat""
2⤵
- Suspicious use of WriteProcessMemory
PID:4092

C:\Windows\system32\timeout.exe
timeout 3
3⤵
- Delays execution with timeout.exe
PID:640

C:\Users\Admin\AppData\Roaming\search.exe
"C:\Users\Admin\AppData\Roaming\search.exe"
3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:768

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\search.exe.log

Filesize
425B

MD5
fff5cbccb6b31b40f834b8f4778a779a

SHA1
899ed0377e89f1ed434cfeecc5bc0163ebdf0454

SHA256
b8f7e4ed81764db56b9c09050f68c5a26af78d8a5e2443e75e0e1aa7cd2ccd76

SHA512
1a188a14c667bc31d2651b220aa762be9cce4a75713217846fbe472a307c7bbc6e3c27617f75f489902a534d9184648d204d03ee956ac57b11aa90551248b8f9

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpBFC6.tmp.bat

Filesize
150B

MD5
bd98f2643e37f98320e43c5b3b9c0bed

SHA1
238ee9e3ac7fe47b1984289f0e36bd827a6c6c15

SHA256
a7ad5820ccbd09f7ad74b0aba70a23a9c0db1a4fb02f299a36d6cdc8cd2eb73f

SHA512
111cac7242827b6c8477822e821463285368f40c89a54457c900572d476d604c13fcb1b4b6be0cf9a65a535365f9116ab1c572b76e570041b3cf91c88cb5a3c5

Download Submit
C:\Users\Admin\AppData\Roaming\search.exe

Filesize
63KB

MD5
4a3d7bd2084b48024bf8f459b10aa913

SHA1
ed47940c8e00f846e0656bd95ca14ddd8d157ba0

SHA256
7c15fa68e1ae83f81c98a2c616753777ccd720a8a2a1adda490e08be9369a3c8

SHA512
94e00110aa23f713e099039b027d01e7ea1c5521b4f9b6563cebf537eafb226a3aa840d7f3f4ec08872ec098bd57567c3fd8c3694ea62468139ae84ee5cc5b35

Download Submit
memory/2564-0-0x00007FF8563B3000-0x00007FF8563B5000-memory.dmp

Filesize
8KB

Download
memory/2564-1-0x0000000000DD0000-0x0000000000DE6000-memory.dmp

Filesize
88KB

Download
memory/2564-2-0x00007FF8563B0000-0x00007FF856E71000-memory.dmp

Filesize
10.8MB

Download
memory/2564-7-0x00007FF8563B0000-0x00007FF856E71000-memory.dmp

Filesize
10.8MB

Download
memory/2564-8-0x00007FF8563B0000-0x00007FF856E71000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads