asyncrat | 48980f70da16b59927768b0e3a4d56c8c98e129f05f7f26b81847ffede708428

General

Target

48980f70da16b59927768b0e3a4d56c8c98e129f05f7f26b81847ffede708428.exe
Size

794KB
MD5

95a6d287978fa62ad30f26bae7aec73b
SHA1

759461ef978d1fc7d8a0571980b0065b51a61531
SHA256

48980f70da16b59927768b0e3a4d56c8c98e129f05f7f26b81847ffede708428
SHA512

4b2c702d64893804a803e4414ef22d4eaa8fbb95678d1b9011a46dd5c94fb7d1945cfe49a67dc345f6260f7ee23f4ca6601a60634e977b6b84ca9d02072c6003
SSDEEP

24576:JqmTmwgCof8IO6kh97pa66GbKHA+bEFymZtsnmPI9SflCE9:Jqm67CovO6kr7l9bsA3nfsng9CE

Score

10^/10

asyncrat execution rat

Malware Config

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Loads dropped DLL 3 IoCs

Processes:

regsvr32.exeregsvr32.EXEregsvr32.EXE

pid process

216 regsvr32.exe
440 regsvr32.EXE
3044 regsvr32.EXE
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to execute payload.
execution

PowerShell
T1059.001

Processes:

powershell.exe

pid process

5048 powershell.exe
5048 powershell.exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

powershell.exeregsvr32.exe

pid process

5048 powershell.exe
5048 powershell.exe
216 regsvr32.exe

pid	process
216	regsvr32.exe
440	regsvr32.EXE
3044	regsvr32.EXE

pid	process
5048	powershell.exe
5048	powershell.exe

pid	process
5048	powershell.exe
5048	powershell.exe
216	regsvr32.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

powershell.exe

description	pid	process
Token: SeDebugPrivilege	5048	powershell.exe
Token: SeIncreaseQuotaPrivilege	5048	powershell.exe
Token: SeSecurityPrivilege	5048	powershell.exe
Token: SeTakeOwnershipPrivilege	5048	powershell.exe
Token: SeLoadDriverPrivilege	5048	powershell.exe
Token: SeSystemProfilePrivilege	5048	powershell.exe
Token: SeSystemtimePrivilege	5048	powershell.exe
Token: SeProfSingleProcessPrivilege	5048	powershell.exe
Token: SeIncBasePriorityPrivilege	5048	powershell.exe
Token: SeCreatePagefilePrivilege	5048	powershell.exe
Token: SeBackupPrivilege	5048	powershell.exe
Token: SeRestorePrivilege	5048	powershell.exe
Token: SeShutdownPrivilege	5048	powershell.exe
Token: SeDebugPrivilege	5048	powershell.exe
Token: SeSystemEnvironmentPrivilege	5048	powershell.exe
Token: SeRemoteShutdownPrivilege	5048	powershell.exe
Token: SeUndockPrivilege	5048	powershell.exe
Token: SeManageVolumePrivilege	5048	powershell.exe
Token: 33	5048	powershell.exe
Token: 34	5048	powershell.exe
Token: 35	5048	powershell.exe
Token: 36	5048	powershell.exe
Token: SeIncreaseQuotaPrivilege	5048	powershell.exe
Token: SeSecurityPrivilege	5048	powershell.exe
Token: SeTakeOwnershipPrivilege	5048	powershell.exe
Token: SeLoadDriverPrivilege	5048	powershell.exe
Token: SeSystemProfilePrivilege	5048	powershell.exe
Token: SeSystemtimePrivilege	5048	powershell.exe
Token: SeProfSingleProcessPrivilege	5048	powershell.exe
Token: SeIncBasePriorityPrivilege	5048	powershell.exe
Token: SeCreatePagefilePrivilege	5048	powershell.exe
Token: SeBackupPrivilege	5048	powershell.exe
Token: SeRestorePrivilege	5048	powershell.exe
Token: SeShutdownPrivilege	5048	powershell.exe
Token: SeDebugPrivilege	5048	powershell.exe
Token: SeSystemEnvironmentPrivilege	5048	powershell.exe
Token: SeRemoteShutdownPrivilege	5048	powershell.exe
Token: SeUndockPrivilege	5048	powershell.exe
Token: SeManageVolumePrivilege	5048	powershell.exe
Token: 33	5048	powershell.exe
Token: 34	5048	powershell.exe
Token: 35	5048	powershell.exe
Token: 36	5048	powershell.exe
Token: SeIncreaseQuotaPrivilege	5048	powershell.exe
Token: SeSecurityPrivilege	5048	powershell.exe
Token: SeTakeOwnershipPrivilege	5048	powershell.exe
Token: SeLoadDriverPrivilege	5048	powershell.exe
Token: SeSystemProfilePrivilege	5048	powershell.exe
Token: SeSystemtimePrivilege	5048	powershell.exe
Token: SeProfSingleProcessPrivilege	5048	powershell.exe
Token: SeIncBasePriorityPrivilege	5048	powershell.exe
Token: SeCreatePagefilePrivilege	5048	powershell.exe
Token: SeBackupPrivilege	5048	powershell.exe
Token: SeRestorePrivilege	5048	powershell.exe
Token: SeShutdownPrivilege	5048	powershell.exe
Token: SeDebugPrivilege	5048	powershell.exe
Token: SeSystemEnvironmentPrivilege	5048	powershell.exe
Token: SeRemoteShutdownPrivilege	5048	powershell.exe
Token: SeUndockPrivilege	5048	powershell.exe
Token: SeManageVolumePrivilege	5048	powershell.exe
Token: 33	5048	powershell.exe
Token: 34	5048	powershell.exe
Token: 35	5048	powershell.exe
Token: 36	5048	powershell.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

48980f70da16b59927768b0e3a4d56c8c98e129f05f7f26b81847ffede708428.exe

description	pid	process	target process
PID 4724 wrote to memory of 5048	4724	48980f70da16b59927768b0e3a4d56c8c98e129f05f7f26b81847ffede708428.exe	powershell.exe
PID 4724 wrote to memory of 5048	4724	48980f70da16b59927768b0e3a4d56c8c98e129f05f7f26b81847ffede708428.exe	powershell.exe
PID 4724 wrote to memory of 216	4724	48980f70da16b59927768b0e3a4d56c8c98e129f05f7f26b81847ffede708428.exe	regsvr32.exe
PID 4724 wrote to memory of 216	4724	48980f70da16b59927768b0e3a4d56c8c98e129f05f7f26b81847ffede708428.exe	regsvr32.exe

C:\Users\Admin\AppData\Local\Temp\48980f70da16b59927768b0e3a4d56c8c98e129f05f7f26b81847ffede708428.exe
"C:\Users\Admin\AppData\Local\Temp\48980f70da16b59927768b0e3a4d56c8c98e129f05f7f26b81847ffede708428.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4724

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" "Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute \"regsvr32\" -Argument \"/s /i:INSTALL C:\Users\Admin\AppData/Roaming/cIwy.ini\") -Trigger (New-ScheduledTaskTrigger -Once -At (Get-Date).AddMinutes(1) -RepetitionInterval (New-TimeSpan -Minutes 1)) -TaskName 'MicrosoftEdgeUpdateTaskMachineUA{4C808080-0808-44C0-8080-84C4C4C80080}' -Description 'Default' -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries)"
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5048

C:\Windows\system32\regsvr32.exe
"regsvr32" /s /i:INSTALL C:\Users\Admin\AppData/Roaming/cIwy.ini
2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:216

C:\Windows\system32\regsvr32.EXE
C:\Windows\system32\regsvr32.EXE /s /i:INSTALL C:\Users\Admin\AppData/Roaming/cIwy.ini
1⤵
- Loads dropped DLL
PID:440

C:\Windows\system32\regsvr32.EXE
C:\Windows\system32\regsvr32.EXE /s /i:INSTALL C:\Users\Admin\AppData/Roaming/cIwy.ini
1⤵
- Loads dropped DLL
PID:3044

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_kmpeyscl.myl.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\cIwy.ini

Filesize
552KB

MD5
3215cd0c5b1a3c9fa3507e56d987372e

SHA1
b0ebbccae5b02e287eafceac9d7d69785928c0df

SHA256
8e5abd89e9823c6be5c6d149f15434fb84760a008f2034a0d17f8c0094f738cf

SHA512
ab32f2e6c72f46afa16edf7dd4f7f2df684751f94b7e2b81452e2af7ceae29888ff93ce55bd0007df4168f7f42588ebcdc553c1c724962aa37603ec1b7ad2cf0

Download Submit
memory/216-28-0x0000000002F30000-0x0000000003030000-memory.dmp

Filesize
1024KB

Download
memory/216-27-0x00007FFBD4E70000-0x00007FFBD4F01000-memory.dmp

Filesize
580KB

Download
memory/216-25-0x00000000032D0000-0x0000000003318000-memory.dmp

Filesize
288KB

Download
memory/216-24-0x0000000002F30000-0x0000000003030000-memory.dmp

Filesize
1024KB

Download
memory/4724-26-0x00007FF7B64C0000-0x00007FF7B658E000-memory.dmp

Filesize
824KB

Download
memory/5048-12-0x00007FFBC5130000-0x00007FFBC5BF1000-memory.dmp

Filesize
10.8MB

Download
memory/5048-18-0x00007FFBC5130000-0x00007FFBC5BF1000-memory.dmp

Filesize
10.8MB

Download
memory/5048-14-0x00007FFBC5130000-0x00007FFBC5BF1000-memory.dmp

Filesize
10.8MB

Download
memory/5048-13-0x00007FFBC5130000-0x00007FFBC5BF1000-memory.dmp

Filesize
10.8MB

Download
memory/5048-1-0x00007FFBC5133000-0x00007FFBC5135000-memory.dmp

Filesize
8KB

Download
memory/5048-11-0x0000018425A00000-0x0000018425A22000-memory.dmp

Filesize
136KB

Download

Analysis

Sharing