asyncrat | 0271a11d382e2ba93002760a085e7dcfa33d60bbf220c4df1dc0f5a42d4421ae

General

Target

VoidX.exe
Size

63KB
MD5

7b22144c81358e8d69e6022bb85c5731
SHA1

ff3c1b7d6732698adcb020057f8882636b015a6f
SHA256

0271a11d382e2ba93002760a085e7dcfa33d60bbf220c4df1dc0f5a42d4421ae
SHA512

5b4270492c4fae229f1b4eaf972978c523912020a91e96c89afd1b1997b331592e723c7897e8cb7e3762faa845dd09a31a29464bea1db6b95128b508f56f27db
SSDEEP

1536:Bj3dvh8YWRTRN+eUb/h9zAjruIdpqKmY7:BZJSRTR4eUb/Xu5Gz

Score

10^/10

asyncrat default rat

Malware Config

Extracted

Family

asyncrat

Botnet

Default

C2

127.0.0.1:3232

45.88.91.31:3232

Attributes

delay
1
install
true
install_file
super sigma.exe
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Roaming\super sigma.exe	family_asyncrat

Executes dropped EXE 1 IoCs

Processes:

super sigma.exe

pid process

2288 super sigma.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

2740 timeout.exe
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exe

pid process

2688 schtasks.exe

pid	process
2288	super sigma.exe

pid	process
2740	timeout.exe

pid	process
2688	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

VoidX.exesuper sigma.exe

pid	process
2772	VoidX.exe
2772	VoidX.exe
2772	VoidX.exe
2772	VoidX.exe
2772	VoidX.exe
2772	VoidX.exe
2772	VoidX.exe
2772	VoidX.exe
2772	VoidX.exe
2772	VoidX.exe
2772	VoidX.exe
2772	VoidX.exe
2772	VoidX.exe
2772	VoidX.exe
2772	VoidX.exe
2772	VoidX.exe
2772	VoidX.exe
2772	VoidX.exe
2772	VoidX.exe
2772	VoidX.exe
2772	VoidX.exe
2772	VoidX.exe
2772	VoidX.exe
2772	VoidX.exe
2772	VoidX.exe
2772	VoidX.exe
2772	VoidX.exe
2772	VoidX.exe
2772	VoidX.exe
2772	VoidX.exe
2772	VoidX.exe
2772	VoidX.exe
2772	VoidX.exe
2772	VoidX.exe
2772	VoidX.exe
2772	VoidX.exe
2772	VoidX.exe
2772	VoidX.exe
2772	VoidX.exe
2772	VoidX.exe
2772	VoidX.exe
2772	VoidX.exe
2772	VoidX.exe
2772	VoidX.exe
2288	super sigma.exe
2288	super sigma.exe
2288	super sigma.exe
2288	super sigma.exe
2288	super sigma.exe
2288	super sigma.exe
2288	super sigma.exe
2288	super sigma.exe
2288	super sigma.exe
2288	super sigma.exe
2288	super sigma.exe
2288	super sigma.exe
2288	super sigma.exe
2288	super sigma.exe
2288	super sigma.exe
2288	super sigma.exe
2288	super sigma.exe
2288	super sigma.exe
2288	super sigma.exe
2288	super sigma.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

VoidX.exesuper sigma.exe

description	pid	process
Token: SeDebugPrivilege	2772	VoidX.exe
Token: SeDebugPrivilege	2772	VoidX.exe
Token: SeDebugPrivilege	2288	super sigma.exe
Token: SeDebugPrivilege	2288	super sigma.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

VoidX.execmd.execmd.exe

description	pid	process	target process
PID 2772 wrote to memory of 3028	2772	VoidX.exe	cmd.exe
PID 2772 wrote to memory of 3028	2772	VoidX.exe	cmd.exe
PID 2772 wrote to memory of 3028	2772	VoidX.exe	cmd.exe
PID 2772 wrote to memory of 1412	2772	VoidX.exe	cmd.exe
PID 2772 wrote to memory of 1412	2772	VoidX.exe	cmd.exe
PID 2772 wrote to memory of 1412	2772	VoidX.exe	cmd.exe
PID 3028 wrote to memory of 2688	3028	cmd.exe	schtasks.exe
PID 3028 wrote to memory of 2688	3028	cmd.exe	schtasks.exe
PID 3028 wrote to memory of 2688	3028	cmd.exe	schtasks.exe
PID 1412 wrote to memory of 2740	1412	cmd.exe	timeout.exe
PID 1412 wrote to memory of 2740	1412	cmd.exe	timeout.exe
PID 1412 wrote to memory of 2740	1412	cmd.exe	timeout.exe
PID 1412 wrote to memory of 2288	1412	cmd.exe	super sigma.exe
PID 1412 wrote to memory of 2288	1412	cmd.exe	super sigma.exe
PID 1412 wrote to memory of 2288	1412	cmd.exe	super sigma.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\VoidX.exe
"C:\Users\Admin\AppData\Local\Temp\VoidX.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2772

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "super sigma" /tr '"C:\Users\Admin\AppData\Roaming\super sigma.exe"' & exit
2⤵
- Suspicious use of WriteProcessMemory
PID:3028

C:\Windows\system32\schtasks.exe
schtasks /create /f /sc onlogon /rl highest /tn "super sigma" /tr '"C:\Users\Admin\AppData\Roaming\super sigma.exe"'
3⤵
- Scheduled Task/Job: Scheduled Task
PID:2688

C:\Windows\system32\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp6F56.tmp.bat""
2⤵
- Suspicious use of WriteProcessMemory
PID:1412

C:\Windows\system32\timeout.exe
timeout 3
3⤵
- Delays execution with timeout.exe
PID:2740

C:\Users\Admin\AppData\Roaming\super sigma.exe
"C:\Users\Admin\AppData\Roaming\super sigma.exe"
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2288

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp6F56.tmp.bat

Filesize
155B

MD5
3df6f86e9663a59da81aa0c76c501e04

SHA1
6b6a56cce264a8f2b35e62733b05efe7f3aa3eac

SHA256
e492369d63239beef2313aeaf25412cea759a823d48ab808ead265691957a324

SHA512
aa97176d1c489b75da7d3d28a5bb3a27b813e9dd3ac4e17a34a48dc0dc23b1e0b4588dd9720c725f5af25a612fd25c33da1c6af51b73d5ccf4345d15628c607e

Download Submit
C:\Users\Admin\AppData\Roaming\super sigma.exe

Filesize
63KB

MD5
7b22144c81358e8d69e6022bb85c5731

SHA1
ff3c1b7d6732698adcb020057f8882636b015a6f

SHA256
0271a11d382e2ba93002760a085e7dcfa33d60bbf220c4df1dc0f5a42d4421ae

SHA512
5b4270492c4fae229f1b4eaf972978c523912020a91e96c89afd1b1997b331592e723c7897e8cb7e3762faa845dd09a31a29464bea1db6b95128b508f56f27db

Download Submit
memory/2288-17-0x0000000000A30000-0x0000000000A46000-memory.dmp

Filesize
88KB

Download
memory/2772-0-0x000007FEF6383000-0x000007FEF6384000-memory.dmp

Filesize
4KB

Download
memory/2772-1-0x0000000001360000-0x0000000001376000-memory.dmp

Filesize
88KB

Download
memory/2772-2-0x000007FEF6380000-0x000007FEF6D6C000-memory.dmp

Filesize
9.9MB

Download
memory/2772-3-0x000007FEF6380000-0x000007FEF6D6C000-memory.dmp

Filesize
9.9MB

Download
memory/2772-13-0x000007FEF6380000-0x000007FEF6D6C000-memory.dmp

Filesize
9.9MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads