asyncrat | c40a6434008cf6fb6738f64bc52b5aa0f93cf50dec65c3d84e34174cfd3e962d

General

Target

Johnnyspanel.exe
Size

63KB
MD5

e6b3b8ea39d8bc6eea1c703295d17ef2
SHA1

34babad08af3f8ae9f4e6507625167038d479dd7
SHA256

c40a6434008cf6fb6738f64bc52b5aa0f93cf50dec65c3d84e34174cfd3e962d
SHA512

24a5505feddfe229304fd4c15af49e81e02cddbc0bc1612daa9a670fa13faab90a729079cdf1fbec176cda88c8ffcb6822d1f6aafeb5be774b15d7e45d829563
SSDEEP

768:S+BAGkPhz/n78FoC8A+Xk+YDT8JHy31+T4ySBGHmDbDgps0oXnoIIjzsSukdpqKX:Tq/bL2h39YUbWs9oVzrukdpqKmY7

Score

10^/10

asyncrat default rat

Malware Config

Extracted

Family

asyncrat

Botnet

Default

C2

127.0.0.1:3232

Attributes

delay
1
install
true
install_file
Run.exe
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Roaming\Run.exe	family_asyncrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Johnnyspanel.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	Johnnyspanel.exe

Executes dropped EXE 1 IoCs

Processes:

Run.exe

pid process

2896 Run.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

932 timeout.exe
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exe

pid process

3152 schtasks.exe

pid	process
2896	Run.exe

pid	process
932	timeout.exe

pid	process
3152	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

Johnnyspanel.exeRun.exe

pid	process
2032	Johnnyspanel.exe
2032	Johnnyspanel.exe
2032	Johnnyspanel.exe
2032	Johnnyspanel.exe
2032	Johnnyspanel.exe
2032	Johnnyspanel.exe
2032	Johnnyspanel.exe
2032	Johnnyspanel.exe
2032	Johnnyspanel.exe
2032	Johnnyspanel.exe
2032	Johnnyspanel.exe
2032	Johnnyspanel.exe
2032	Johnnyspanel.exe
2032	Johnnyspanel.exe
2032	Johnnyspanel.exe
2032	Johnnyspanel.exe
2032	Johnnyspanel.exe
2032	Johnnyspanel.exe
2032	Johnnyspanel.exe
2032	Johnnyspanel.exe
2032	Johnnyspanel.exe
2032	Johnnyspanel.exe
2032	Johnnyspanel.exe
2032	Johnnyspanel.exe
2032	Johnnyspanel.exe
2032	Johnnyspanel.exe
2032	Johnnyspanel.exe
2896	Run.exe
2896	Run.exe
2896	Run.exe
2896	Run.exe
2896	Run.exe
2896	Run.exe
2896	Run.exe
2896	Run.exe
2896	Run.exe
2896	Run.exe
2896	Run.exe
2896	Run.exe
2896	Run.exe
2896	Run.exe
2896	Run.exe
2896	Run.exe
2896	Run.exe
2896	Run.exe
2896	Run.exe
2896	Run.exe
2896	Run.exe
2896	Run.exe
2896	Run.exe
2896	Run.exe
2896	Run.exe
2896	Run.exe
2896	Run.exe
2896	Run.exe
2896	Run.exe
2896	Run.exe
2896	Run.exe
2896	Run.exe
2896	Run.exe
2896	Run.exe
2896	Run.exe
2896	Run.exe
2896	Run.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

Johnnyspanel.exeRun.exe

description	pid	process
Token: SeDebugPrivilege	2032	Johnnyspanel.exe
Token: SeDebugPrivilege	2032	Johnnyspanel.exe
Token: SeDebugPrivilege	2896	Run.exe
Token: SeDebugPrivilege	2896	Run.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

Johnnyspanel.execmd.execmd.exe

description	pid	process	target process
PID 2032 wrote to memory of 3004	2032	Johnnyspanel.exe	cmd.exe
PID 2032 wrote to memory of 3004	2032	Johnnyspanel.exe	cmd.exe
PID 2032 wrote to memory of 4284	2032	Johnnyspanel.exe	cmd.exe
PID 2032 wrote to memory of 4284	2032	Johnnyspanel.exe	cmd.exe
PID 3004 wrote to memory of 3152	3004	cmd.exe	schtasks.exe
PID 3004 wrote to memory of 3152	3004	cmd.exe	schtasks.exe
PID 4284 wrote to memory of 932	4284	cmd.exe	timeout.exe
PID 4284 wrote to memory of 932	4284	cmd.exe	timeout.exe
PID 4284 wrote to memory of 2896	4284	cmd.exe	Run.exe
PID 4284 wrote to memory of 2896	4284	cmd.exe	Run.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Johnnyspanel.exe
"C:\Users\Admin\AppData\Local\Temp\Johnnyspanel.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2032

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Run" /tr '"C:\Users\Admin\AppData\Roaming\Run.exe"' & exit
2⤵
- Suspicious use of WriteProcessMemory
PID:3004

C:\Windows\system32\schtasks.exe
schtasks /create /f /sc onlogon /rl highest /tn "Run" /tr '"C:\Users\Admin\AppData\Roaming\Run.exe"'
3⤵
- Scheduled Task/Job: Scheduled Task
PID:3152

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpABE0.tmp.bat""
2⤵
- Suspicious use of WriteProcessMemory
PID:4284

C:\Windows\system32\timeout.exe
timeout 3
3⤵
- Delays execution with timeout.exe
PID:932

C:\Users\Admin\AppData\Roaming\Run.exe
"C:\Users\Admin\AppData\Roaming\Run.exe"
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2896

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpABE0.tmp.bat

Filesize
147B

MD5
36902daa52399ed00cad5654b52834c6

SHA1
8c5a0ea3b240dd1953dee6719288fd5bf0e7a561

SHA256
27533062b114fbc3bcae4ce893013c82d7fb130e39e9bed179e489ace7952731

SHA512
363af9ac027d56db3e06b54d237a5e6b59698a0edfb2804f7a46b34cf8286d571292a464559d8e08c26e1b65cf8cdb8920a1a5f9edffbc216c6093bcf0799b49

Download Submit
C:\Users\Admin\AppData\Roaming\Run.exe

Filesize
63KB

MD5
e6b3b8ea39d8bc6eea1c703295d17ef2

SHA1
34babad08af3f8ae9f4e6507625167038d479dd7

SHA256
c40a6434008cf6fb6738f64bc52b5aa0f93cf50dec65c3d84e34174cfd3e962d

SHA512
24a5505feddfe229304fd4c15af49e81e02cddbc0bc1612daa9a670fa13faab90a729079cdf1fbec176cda88c8ffcb6822d1f6aafeb5be774b15d7e45d829563

Download Submit
memory/2032-0-0x00007FFD9EAD3000-0x00007FFD9EAD5000-memory.dmp

Filesize
8KB

Download
memory/2032-1-0x0000000000B00000-0x0000000000B16000-memory.dmp

Filesize
88KB

Download
memory/2032-2-0x00007FFD9EAD0000-0x00007FFD9F591000-memory.dmp

Filesize
10.8MB

Download
memory/2032-7-0x00007FFD9EAD0000-0x00007FFD9F591000-memory.dmp

Filesize
10.8MB

Download
memory/2032-8-0x00007FFD9EAD0000-0x00007FFD9F591000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads