asyncrat | 0271a11d382e2ba93002760a085e7dcfa33d60bbf220c4df1dc0f5a42d4421ae

General

Target

VoidX.exe
Size

63KB
MD5

7b22144c81358e8d69e6022bb85c5731
SHA1

ff3c1b7d6732698adcb020057f8882636b015a6f
SHA256

0271a11d382e2ba93002760a085e7dcfa33d60bbf220c4df1dc0f5a42d4421ae
SHA512

5b4270492c4fae229f1b4eaf972978c523912020a91e96c89afd1b1997b331592e723c7897e8cb7e3762faa845dd09a31a29464bea1db6b95128b508f56f27db
SSDEEP

1536:Bj3dvh8YWRTRN+eUb/h9zAjruIdpqKmY7:BZJSRTR4eUb/Xu5Gz

Score

10^/10

asyncrat default rat

Malware Config

Extracted

Family

asyncrat

Botnet

Default

C2

127.0.0.1:3232

45.88.91.31:3232

Attributes

delay
1
install
true
install_file
super sigma.exe
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Roaming\super sigma.exe	family_asyncrat

Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

VoidX.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation VoidX.exe
Executes dropped EXE 1 IoCs

Processes:

super sigma.exe

pid process

4004 super sigma.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

4516 timeout.exe
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exe

pid process

4592 schtasks.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	VoidX.exe

pid	process
4004	super sigma.exe

pid	process
4516	timeout.exe

pid	process
4592	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

VoidX.exesuper sigma.exe

pid	process
1164	VoidX.exe
1164	VoidX.exe
1164	VoidX.exe
1164	VoidX.exe
1164	VoidX.exe
1164	VoidX.exe
1164	VoidX.exe
1164	VoidX.exe
1164	VoidX.exe
1164	VoidX.exe
1164	VoidX.exe
1164	VoidX.exe
1164	VoidX.exe
1164	VoidX.exe
1164	VoidX.exe
1164	VoidX.exe
1164	VoidX.exe
1164	VoidX.exe
1164	VoidX.exe
1164	VoidX.exe
1164	VoidX.exe
1164	VoidX.exe
1164	VoidX.exe
1164	VoidX.exe
1164	VoidX.exe
1164	VoidX.exe
1164	VoidX.exe
1164	VoidX.exe
1164	VoidX.exe
4004	super sigma.exe
4004	super sigma.exe
4004	super sigma.exe
4004	super sigma.exe
4004	super sigma.exe
4004	super sigma.exe
4004	super sigma.exe
4004	super sigma.exe
4004	super sigma.exe
4004	super sigma.exe
4004	super sigma.exe
4004	super sigma.exe
4004	super sigma.exe
4004	super sigma.exe
4004	super sigma.exe
4004	super sigma.exe
4004	super sigma.exe
4004	super sigma.exe
4004	super sigma.exe
4004	super sigma.exe
4004	super sigma.exe
4004	super sigma.exe
4004	super sigma.exe
4004	super sigma.exe
4004	super sigma.exe
4004	super sigma.exe
4004	super sigma.exe
4004	super sigma.exe
4004	super sigma.exe
4004	super sigma.exe
4004	super sigma.exe
4004	super sigma.exe
4004	super sigma.exe
4004	super sigma.exe
4004	super sigma.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

VoidX.exesuper sigma.exe

description	pid	process
Token: SeDebugPrivilege	1164	VoidX.exe
Token: SeDebugPrivilege	1164	VoidX.exe
Token: SeDebugPrivilege	4004	super sigma.exe
Token: SeDebugPrivilege	4004	super sigma.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

VoidX.execmd.execmd.exe

description	pid	process	target process
PID 1164 wrote to memory of 2044	1164	VoidX.exe	cmd.exe
PID 1164 wrote to memory of 2044	1164	VoidX.exe	cmd.exe
PID 1164 wrote to memory of 2844	1164	VoidX.exe	cmd.exe
PID 1164 wrote to memory of 2844	1164	VoidX.exe	cmd.exe
PID 2044 wrote to memory of 4592	2044	cmd.exe	schtasks.exe
PID 2044 wrote to memory of 4592	2044	cmd.exe	schtasks.exe
PID 2844 wrote to memory of 4516	2844	cmd.exe	timeout.exe
PID 2844 wrote to memory of 4516	2844	cmd.exe	timeout.exe
PID 2844 wrote to memory of 4004	2844	cmd.exe	super sigma.exe
PID 2844 wrote to memory of 4004	2844	cmd.exe	super sigma.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\VoidX.exe
"C:\Users\Admin\AppData\Local\Temp\VoidX.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1164

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "super sigma" /tr '"C:\Users\Admin\AppData\Roaming\super sigma.exe"' & exit
2⤵
- Suspicious use of WriteProcessMemory
PID:2044

C:\Windows\system32\schtasks.exe
schtasks /create /f /sc onlogon /rl highest /tn "super sigma" /tr '"C:\Users\Admin\AppData\Roaming\super sigma.exe"'
3⤵
- Scheduled Task/Job: Scheduled Task
PID:4592

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpAC6C.tmp.bat""
2⤵
- Suspicious use of WriteProcessMemory
PID:2844

C:\Windows\system32\timeout.exe
timeout 3
3⤵
- Delays execution with timeout.exe
PID:4516

C:\Users\Admin\AppData\Roaming\super sigma.exe
"C:\Users\Admin\AppData\Roaming\super sigma.exe"
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4004

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpAC6C.tmp.bat

Filesize
155B

MD5
d7bd2cfd6d8aba4b1cdb4f594ba03e13

SHA1
02d0fad601b690dd90cb836e7b729c5c71b67258

SHA256
5e6707d317465e9961fc96c5a5185d49b1a05255ce33820dc493c0b7bc159782

SHA512
e8d5048ce57d888f2f098d8d67fa6e0e812ae8722e6e512985d2491b7c113c41cbafa60a17b2b70e0eb2ed728856073363015984018a273951f482d1b66f400c

Download Submit
C:\Users\Admin\AppData\Roaming\super sigma.exe

Filesize
63KB

MD5
7b22144c81358e8d69e6022bb85c5731

SHA1
ff3c1b7d6732698adcb020057f8882636b015a6f

SHA256
0271a11d382e2ba93002760a085e7dcfa33d60bbf220c4df1dc0f5a42d4421ae

SHA512
5b4270492c4fae229f1b4eaf972978c523912020a91e96c89afd1b1997b331592e723c7897e8cb7e3762faa845dd09a31a29464bea1db6b95128b508f56f27db

Download Submit
memory/1164-0-0x00007FFB99D13000-0x00007FFB99D15000-memory.dmp

Filesize
8KB

Download
memory/1164-1-0x0000000000680000-0x0000000000696000-memory.dmp

Filesize
88KB

Download
memory/1164-2-0x00007FFB99D10000-0x00007FFB9A7D1000-memory.dmp

Filesize
10.8MB

Download
memory/1164-7-0x00007FFB99D10000-0x00007FFB9A7D1000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads