asyncrat | 6f194457591e38ef91c704ee2e78d676158721b7123c5d6f1f7ab893525c1d0f

General

Target

27995188901b199243be270c69f32511_JaffaCakes118.exe
Size

74KB
MD5

27995188901b199243be270c69f32511
SHA1

c7409c4bae6f03ea8aca14e5c451cebb27724ed0
SHA256

6f194457591e38ef91c704ee2e78d676158721b7123c5d6f1f7ab893525c1d0f
SHA512

0c263a3401c4033de5383b33c2b10ae36fa1491658ef1278d98f39d68eb2ed421e2253fe374aca3e5691da489d09682adcb19587d679981d1e81ccfc0d1736e7
SSDEEP

1536:0ItYxDHck2fKhIFcPKI3K/jzH3ZhWzoqxXKz1h:0I+xzfJ13yzpYzxx65h

Score

10^/10

asyncrat default discovery rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

Default

C2

rqwonderworld.ddns.net:6606

rqwonderworld.ddns.net:4782

Mutex

55

Attributes

delay
3
install
false
install_file
WindowsCacher.exe
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Suspicious use of SetThreadContext 1 IoCs

Processes:

27995188901b199243be270c69f32511_JaffaCakes118.exe

description	pid	process	target process
PID 1656 set thread context of 2908	1656	27995188901b199243be270c69f32511_JaffaCakes118.exe	27995188901b199243be270c69f32511_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

27995188901b199243be270c69f32511_JaffaCakes118.exe27995188901b199243be270c69f32511_JaffaCakes118.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	27995188901b199243be270c69f32511_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	27995188901b199243be270c69f32511_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

27995188901b199243be270c69f32511_JaffaCakes118.exe

description	pid	process	target process
PID 1656 wrote to memory of 2908	1656	27995188901b199243be270c69f32511_JaffaCakes118.exe	27995188901b199243be270c69f32511_JaffaCakes118.exe
PID 1656 wrote to memory of 2908	1656	27995188901b199243be270c69f32511_JaffaCakes118.exe	27995188901b199243be270c69f32511_JaffaCakes118.exe
PID 1656 wrote to memory of 2908	1656	27995188901b199243be270c69f32511_JaffaCakes118.exe	27995188901b199243be270c69f32511_JaffaCakes118.exe
PID 1656 wrote to memory of 2908	1656	27995188901b199243be270c69f32511_JaffaCakes118.exe	27995188901b199243be270c69f32511_JaffaCakes118.exe
PID 1656 wrote to memory of 2908	1656	27995188901b199243be270c69f32511_JaffaCakes118.exe	27995188901b199243be270c69f32511_JaffaCakes118.exe
PID 1656 wrote to memory of 2908	1656	27995188901b199243be270c69f32511_JaffaCakes118.exe	27995188901b199243be270c69f32511_JaffaCakes118.exe
PID 1656 wrote to memory of 2908	1656	27995188901b199243be270c69f32511_JaffaCakes118.exe	27995188901b199243be270c69f32511_JaffaCakes118.exe
PID 1656 wrote to memory of 2908	1656	27995188901b199243be270c69f32511_JaffaCakes118.exe	27995188901b199243be270c69f32511_JaffaCakes118.exe
PID 1656 wrote to memory of 2908	1656	27995188901b199243be270c69f32511_JaffaCakes118.exe	27995188901b199243be270c69f32511_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\27995188901b199243be270c69f32511_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\27995188901b199243be270c69f32511_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1656

C:\Users\Admin\AppData\Local\Temp\27995188901b199243be270c69f32511_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\27995188901b199243be270c69f32511_JaffaCakes118.exe"
2⤵
- System Location Discovery: System Language Discovery
PID:2908

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1656-0-0x00000000747DE000-0x00000000747DF000-memory.dmp

Filesize
4KB

Download
memory/1656-1-0x0000000001050000-0x0000000001068000-memory.dmp

Filesize
96KB

Download
memory/1656-2-0x00000000001F0000-0x00000000001FA000-memory.dmp

Filesize
40KB

Download
memory/1656-17-0x00000000747D0000-0x0000000074EBE000-memory.dmp

Filesize
6.9MB

Download
memory/1656-15-0x00000000747D0000-0x0000000074EBE000-memory.dmp

Filesize
6.9MB

Download
memory/2908-6-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2908-9-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2908-7-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2908-11-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2908-5-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2908-4-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2908-14-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2908-16-0x00000000747D0000-0x0000000074EBE000-memory.dmp

Filesize
6.9MB

Download
memory/2908-3-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2908-18-0x00000000747D0000-0x0000000074EBE000-memory.dmp

Filesize
6.9MB

Download
memory/2908-19-0x00000000747D0000-0x0000000074EBE000-memory.dmp

Filesize
6.9MB

Download
memory/2908-20-0x00000000747D0000-0x0000000074EBE000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads