asyncrat | 5dc7c78773f8da9ae20096d51ead4b4a79007252010215120522bec5118ef1aa

Analysis

max time kernel
139s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
17-10-2024 14:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Acuerdo_Legal.N21237..exe
Size

2.5MB
MD5

49ec7b0a10c0c2fddf8ee9931e220a87
SHA1

54389b474b33191afaf45fb464199f1a3089154a
SHA256

edd192a65b9a5d7df1076294077e896a872bf8c6c1ab8799415f1ddaf32e0144
SHA512

12b51b3782016b178b963ac7d598baf66b1c14bd04d5171c568ee82eea5f5e51fadace586053f726eb894c8f8a1dc2027e80d1e8aab5284c00c55f0705ff83a0
SSDEEP

24576:oaF026oYvOqQcttZV3XzAsBahnBiSjNUwauYGA7oQb7dTcb+f9Gj4cEpFCkhzrE9:POOwtpahnESjNGv77TkmGSXEhN3U9o

Score

10^/10

asyncrat z-oct-16 discovery persistence rat

Malware Config

Extracted

Family

asyncrat

Version

1.0.7

Botnet

Z-Oct-16

pt4040.4cloud.click:4004

Mutex

DcRatMutex_qwqdanchun

Attributes

delay
1
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

Acuerdo_Legal.N21237..exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\TechDesignerEditor = "C:\\Users\\Admin\\Music\\TechDesignerUpdater\\TechConvertVideo.exe䴀"	Acuerdo_Legal.N21237..exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

Acuerdo_Legal.N21237..exe

description pid process target process

PID 2356 set thread context of 836 2356 Acuerdo_Legal.N21237..exe csc.exe

description	pid	process	target process
PID 2356 set thread context of 836	2356	Acuerdo_Legal.N21237..exe	csc.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

csc.exeAcuerdo_Legal.N21237..exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Acuerdo_Legal.N21237..exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

csc.exe

description pid process

Token: SeDebugPrivilege 836 csc.exe

description	pid	process
Token: SeDebugPrivilege	836	csc.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

Acuerdo_Legal.N21237..exe

description	pid	process	target process
PID 2356 wrote to memory of 836	2356	Acuerdo_Legal.N21237..exe	csc.exe
PID 2356 wrote to memory of 836	2356	Acuerdo_Legal.N21237..exe	csc.exe
PID 2356 wrote to memory of 836	2356	Acuerdo_Legal.N21237..exe	csc.exe
PID 2356 wrote to memory of 836	2356	Acuerdo_Legal.N21237..exe	csc.exe
PID 2356 wrote to memory of 836	2356	Acuerdo_Legal.N21237..exe	csc.exe

C:\Users\Admin\AppData\Local\Temp\Acuerdo_Legal.N21237..exe
"C:\Users\Admin\AppData\Local\Temp\Acuerdo_Legal.N21237..exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2356

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:836

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/836-20-0x00000000058B0000-0x0000000005916000-memory.dmp

Filesize
408KB

Download
memory/836-13-0x0000000073B50000-0x0000000074300000-memory.dmp

Filesize
7.7MB

Download
memory/836-23-0x0000000073B50000-0x0000000074300000-memory.dmp

Filesize
7.7MB

Download
memory/836-21-0x0000000073B50000-0x0000000074300000-memory.dmp

Filesize
7.7MB

Download
memory/836-19-0x0000000005E60000-0x0000000006404000-memory.dmp

Filesize
5.6MB

Download
memory/836-16-0x0000000005810000-0x00000000058AC000-memory.dmp

Filesize
624KB

Download
memory/836-8-0x0000000000A80000-0x0000000000A92000-memory.dmp

Filesize
72KB

Download
memory/836-12-0x0000000073B5E000-0x0000000073B5F000-memory.dmp

Filesize
4KB

Download
memory/836-24-0x0000000073B50000-0x0000000074300000-memory.dmp

Filesize
7.7MB

Download
memory/836-22-0x0000000073B5E000-0x0000000073B5F000-memory.dmp

Filesize
4KB

Download
memory/2356-6-0x0000000000400000-0x00000000006A5000-memory.dmp

Filesize
2.6MB

Download
memory/2356-9-0x0000000000400000-0x00000000006A5000-memory.dmp

Filesize
2.6MB

Download
memory/2356-2-0x0000000000511000-0x0000000000529000-memory.dmp

Filesize
96KB

Download
memory/2356-18-0x0000000000511000-0x0000000000529000-memory.dmp

Filesize
96KB

Download
memory/2356-7-0x0000000000400000-0x00000000006A5000-memory.dmp

Filesize
2.6MB

Download
memory/2356-0-0x0000000000400000-0x00000000006A5000-memory.dmp

Filesize
2.6MB

Download
memory/2356-4-0x0000000000400000-0x00000000006A5000-memory.dmp

Filesize
2.6MB

Download
memory/2356-1-0x0000000000400000-0x00000000006A5000-memory.dmp

Filesize
2.6MB

Download
memory/2356-3-0x0000000000400000-0x00000000006A5000-memory.dmp

Filesize
2.6MB

Download
memory/2356-11-0x0000000000400000-0x00000000006A5000-memory.dmp

Filesize
2.6MB

Download