asyncrat | b1444aaa649bea7bfad1285cadf4286d8cc04b3e595644d3e3b43faf6bb83e8e

General

Target

MT 103 PAYMENT SLIP.pdf.exe
Size

469KB
MD5

3c69297a420b00c660113d44eb039254
SHA1

dc8212328e6dd88e713efb161ecaa3fe25d1eb0f
SHA256

142873db547e46701d0630bf254b6e4d7570a37e62194e89264b53410682d9a8
SHA512

70c3e84356bfc0798cb35b42907a64428d08b5816da7b30c7fe365f1c63f6312c68569b3b58e19f90539cc1bdb9a553346c92705ab0363c321b2ae16f3077e63
SSDEEP

12288:9JRUxMAcD2Im3x3I1luJwZrFhwJbAWqpI0:9JRUxjcD2Igh2lj20I0

Score

10^/10

asyncrat default discovery execution rat

Malware Config

Extracted

Family

asyncrat

Version

Venom RAT + HVNC + Stealer + Grabber v6.0.3

Botnet

Default

C2

185.106.92.86:4040

Mutex

xcjujxywyntbavbe

Attributes

delay
1
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
execution

PowerShell
T1059.001

Processes:

powershell.exe

pid process

2604 powershell.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

MT 103 PAYMENT SLIP.pdf.exe

description pid process target process

PID 2668 set thread context of 2612 2668 MT 103 PAYMENT SLIP.pdf.exe RegSvcs.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2604	powershell.exe

description	pid	process	target process
PID 2668 set thread context of 2612	2668	MT 103 PAYMENT SLIP.pdf.exe	RegSvcs.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

MT 103 PAYMENT SLIP.pdf.exepowershell.exeRegSvcs.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MT 103 PAYMENT SLIP.pdf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

Processes:

MT 103 PAYMENT SLIP.pdf.exepowershell.exeRegSvcs.exe

pid	process
2668	MT 103 PAYMENT SLIP.pdf.exe
2668	MT 103 PAYMENT SLIP.pdf.exe
2604	powershell.exe
2612	RegSvcs.exe
2612	RegSvcs.exe
2612	RegSvcs.exe
2612	RegSvcs.exe
2612	RegSvcs.exe
2612	RegSvcs.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

MT 103 PAYMENT SLIP.pdf.exeRegSvcs.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	2668	MT 103 PAYMENT SLIP.pdf.exe
Token: SeDebugPrivilege	2612	RegSvcs.exe
Token: SeDebugPrivilege	2604	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

RegSvcs.exe

pid process

2612 RegSvcs.exe

pid	process
2612	RegSvcs.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

MT 103 PAYMENT SLIP.pdf.exe

description	pid	process	target process
PID 2668 wrote to memory of 2604	2668	MT 103 PAYMENT SLIP.pdf.exe	powershell.exe
PID 2668 wrote to memory of 2604	2668	MT 103 PAYMENT SLIP.pdf.exe	powershell.exe
PID 2668 wrote to memory of 2604	2668	MT 103 PAYMENT SLIP.pdf.exe	powershell.exe
PID 2668 wrote to memory of 2604	2668	MT 103 PAYMENT SLIP.pdf.exe	powershell.exe
PID 2668 wrote to memory of 2612	2668	MT 103 PAYMENT SLIP.pdf.exe	RegSvcs.exe
PID 2668 wrote to memory of 2612	2668	MT 103 PAYMENT SLIP.pdf.exe	RegSvcs.exe
PID 2668 wrote to memory of 2612	2668	MT 103 PAYMENT SLIP.pdf.exe	RegSvcs.exe
PID 2668 wrote to memory of 2612	2668	MT 103 PAYMENT SLIP.pdf.exe	RegSvcs.exe
PID 2668 wrote to memory of 2612	2668	MT 103 PAYMENT SLIP.pdf.exe	RegSvcs.exe
PID 2668 wrote to memory of 2612	2668	MT 103 PAYMENT SLIP.pdf.exe	RegSvcs.exe
PID 2668 wrote to memory of 2612	2668	MT 103 PAYMENT SLIP.pdf.exe	RegSvcs.exe
PID 2668 wrote to memory of 2612	2668	MT 103 PAYMENT SLIP.pdf.exe	RegSvcs.exe
PID 2668 wrote to memory of 2612	2668	MT 103 PAYMENT SLIP.pdf.exe	RegSvcs.exe
PID 2668 wrote to memory of 2612	2668	MT 103 PAYMENT SLIP.pdf.exe	RegSvcs.exe
PID 2668 wrote to memory of 2612	2668	MT 103 PAYMENT SLIP.pdf.exe	RegSvcs.exe
PID 2668 wrote to memory of 2612	2668	MT 103 PAYMENT SLIP.pdf.exe	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\MT 103 PAYMENT SLIP.pdf.exe
"C:\Users\Admin\AppData\Local\Temp\MT 103 PAYMENT SLIP.pdf.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2668

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\MT 103 PAYMENT SLIP.pdf.exe"
2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2604

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2612

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2612-19-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2612-17-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2612-9-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2612-22-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2612-25-0x0000000074D70000-0x000000007545E000-memory.dmp

Filesize
6.9MB

Download
memory/2612-24-0x0000000074D70000-0x000000007545E000-memory.dmp

Filesize
6.9MB

Download
memory/2612-15-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2612-11-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2612-7-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2612-29-0x0000000074D70000-0x000000007545E000-memory.dmp

Filesize
6.9MB

Download
memory/2612-13-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2668-2-0x0000000074D70000-0x000000007545E000-memory.dmp

Filesize
6.9MB

Download
memory/2668-0-0x0000000074D7E000-0x0000000074D7F000-memory.dmp

Filesize
4KB

Download
memory/2668-1-0x0000000000BE0000-0x0000000000C5A000-memory.dmp

Filesize
488KB

Download
memory/2668-6-0x0000000005DC0000-0x0000000005E1A000-memory.dmp

Filesize
360KB

Download
memory/2668-5-0x00000000005A0000-0x00000000005B2000-memory.dmp

Filesize
72KB

Download
memory/2668-4-0x0000000074D70000-0x000000007545E000-memory.dmp

Filesize
6.9MB

Download
memory/2668-28-0x0000000074D70000-0x000000007545E000-memory.dmp

Filesize
6.9MB

Download
memory/2668-3-0x0000000074D7E000-0x0000000074D7F000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads