asyncrat | 300838a1445ba35fcf31f65018293d8cb9a7bfe0c4859b26205c09be3a7b3b3d

General

Target

skibidirat.exe
Size

16.4MB
MD5

266764b1328dfba596ec0fbf5feca39a
SHA1

099c1d1750238b9e6ab0979c9cff8493c4f3c373
SHA256

300838a1445ba35fcf31f65018293d8cb9a7bfe0c4859b26205c09be3a7b3b3d
SHA512

f6f69498be690023553f4aabba26f27a0cdf3c68f405ffc76637eb6c933c1061bb92c40934276cb7751f6061de515e4f8ded12fef1c93a533dbbfb1c395ceea8
SSDEEP

196608:EVCpPOu8P5G2eee0yMRs4vkmXaU7aIObk9fcdHJDLscmZk36zOAE2A1cZF7sL9YR:2kr0TaZ1LmZ+F1cby9YN/X

Score

10^/10

asyncrat default rat

Malware Config

Extracted

Family

asyncrat

Botnet

Default

C2

natural-familiar.gl.at.ply.gg:65030

Attributes

delay
1
install
true
install_file
search.exe
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Contains code to disable Windows Defender 1 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

Processes:

resource	yara_rule
behavioral1/memory/4428-1-0x000002801E680000-0x000002801F6E6000-memory.dmp	disable_win_def

Async RAT payload 1 IoCs

rat

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\temp.exe	family_asyncrat

Executes dropped EXE 2 IoCs

Processes:

temp.exesearch.exe

pid process

3776 temp.exe
1672 search.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

1776 timeout.exe
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exe

pid process

3008 schtasks.exe

pid	process
3776	temp.exe
1672	search.exe

pid	process
1776	timeout.exe

pid	process
3008	schtasks.exe

Suspicious behavior: EnumeratesProcesses 40 IoCs

Processes:

skibidirat.exetemp.exe

pid	process
4428	skibidirat.exe
4428	skibidirat.exe
4428	skibidirat.exe
4428	skibidirat.exe
4428	skibidirat.exe
4428	skibidirat.exe
4428	skibidirat.exe
4428	skibidirat.exe
3776	temp.exe
3776	temp.exe
3776	temp.exe
4428	skibidirat.exe
4428	skibidirat.exe
3776	temp.exe
3776	temp.exe
4428	skibidirat.exe
4428	skibidirat.exe
3776	temp.exe
3776	temp.exe
4428	skibidirat.exe
4428	skibidirat.exe
4428	skibidirat.exe
4428	skibidirat.exe
4428	skibidirat.exe
4428	skibidirat.exe
4428	skibidirat.exe
4428	skibidirat.exe
4428	skibidirat.exe
4428	skibidirat.exe
4428	skibidirat.exe
3776	temp.exe
3776	temp.exe
3776	temp.exe
3776	temp.exe
3776	temp.exe
3776	temp.exe
3776	temp.exe
3776	temp.exe
4428	skibidirat.exe
4428	skibidirat.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

temp.exeskibidirat.exesearch.exe

description	pid	process
Token: SeDebugPrivilege	3776	temp.exe
Token: SeDebugPrivilege	3776	temp.exe
Token: SeDebugPrivilege	4428	skibidirat.exe
Token: SeDebugPrivilege	1672	search.exe
Token: SeDebugPrivilege	1672	search.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

skibidirat.exe

pid process

4428 skibidirat.exe
Suspicious use of SendNotifyMessage 1 IoCs

Processes:

skibidirat.exe

pid process

4428 skibidirat.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

skibidirat.exetemp.execmd.execmd.exe

description	pid	process	target process
PID 4428 wrote to memory of 3776	4428	skibidirat.exe	temp.exe
PID 4428 wrote to memory of 3776	4428	skibidirat.exe	temp.exe
PID 3776 wrote to memory of 1892	3776	temp.exe	cmd.exe
PID 3776 wrote to memory of 1892	3776	temp.exe	cmd.exe
PID 3776 wrote to memory of 648	3776	temp.exe	cmd.exe
PID 3776 wrote to memory of 648	3776	temp.exe	cmd.exe
PID 1892 wrote to memory of 3008	1892	cmd.exe	schtasks.exe
PID 1892 wrote to memory of 3008	1892	cmd.exe	schtasks.exe
PID 648 wrote to memory of 1776	648	cmd.exe	timeout.exe
PID 648 wrote to memory of 1776	648	cmd.exe	timeout.exe
PID 648 wrote to memory of 1672	648	cmd.exe	search.exe
PID 648 wrote to memory of 1672	648	cmd.exe	search.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\skibidirat.exe
"C:\Users\Admin\AppData\Local\Temp\skibidirat.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4428

C:\Users\Admin\AppData\Local\Temp\temp.exe
"C:\Users\Admin\AppData\Local\Temp\temp.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3776

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "search" /tr '"C:\Users\Admin\AppData\Roaming\search.exe"' & exit
3⤵
- Suspicious use of WriteProcessMemory
PID:1892

C:\Windows\system32\schtasks.exe
schtasks /create /f /sc onlogon /rl highest /tn "search" /tr '"C:\Users\Admin\AppData\Roaming\search.exe"'
4⤵
- Scheduled Task/Job: Scheduled Task
PID:3008

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp90D6.tmp.bat""
3⤵
- Suspicious use of WriteProcessMemory
PID:648

C:\Windows\system32\timeout.exe
timeout 3
4⤵
- Delays execution with timeout.exe
PID:1776

C:\Users\Admin\AppData\Roaming\search.exe
"C:\Users\Admin\AppData\Roaming\search.exe"
4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1672

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:2868

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\temp.exe

Filesize
63KB

MD5
4a3d7bd2084b48024bf8f459b10aa913

SHA1
ed47940c8e00f846e0656bd95ca14ddd8d157ba0

SHA256
7c15fa68e1ae83f81c98a2c616753777ccd720a8a2a1adda490e08be9369a3c8

SHA512
94e00110aa23f713e099039b027d01e7ea1c5521b4f9b6563cebf537eafb226a3aa840d7f3f4ec08872ec098bd57567c3fd8c3694ea62468139ae84ee5cc5b35

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp90D6.tmp.bat

Filesize
150B

MD5
eb7b53c9b0dc8cc85e02334b3b28ad1b

SHA1
ee7e06ff91f35bbc645e6b82f2e458bcb63275c8

SHA256
dd56118bb06d9ca2a6e35bb97b88f81e6bc67f14d30b7476833b5ff3755521d7

SHA512
70ca84ace4a18457921af5c57c056a8997e818192b4c8db7fb98f31b46653a0a5206825b094259760225dfff016ef17d597c0b04a3f7cc3da2f6c90b26c3b6b8

Download Submit
memory/3776-10-0x00007FFF8D650000-0x00007FFF8E03C000-memory.dmp

Filesize
9.9MB

Download
memory/3776-6-0x0000000000050000-0x0000000000066000-memory.dmp

Filesize
88KB

Download
memory/3776-20-0x00007FFF8D650000-0x00007FFF8E03C000-memory.dmp

Filesize
9.9MB

Download
memory/3776-15-0x00007FFF8D650000-0x00007FFF8E03C000-memory.dmp

Filesize
9.9MB

Download
memory/3776-13-0x00007FFF8D650000-0x00007FFF8E03C000-memory.dmp

Filesize
9.9MB

Download
memory/4428-7-0x0000028039BA0000-0x0000028039DF2000-memory.dmp

Filesize
2.3MB

Download
memory/4428-9-0x000002803A210000-0x000002803A404000-memory.dmp

Filesize
2.0MB

Download
memory/4428-12-0x0000028021420000-0x0000028021434000-memory.dmp

Filesize
80KB

Download
memory/4428-11-0x0000028039FB0000-0x000002803A0FE000-memory.dmp

Filesize
1.3MB

Download
memory/4428-14-0x00007FFF8D650000-0x00007FFF8E03C000-memory.dmp

Filesize
9.9MB

Download
memory/4428-8-0x00007FFF8D650000-0x00007FFF8E03C000-memory.dmp

Filesize
9.9MB

Download
memory/4428-0-0x00007FFF8D653000-0x00007FFF8D654000-memory.dmp

Filesize
4KB

Download
memory/4428-1-0x000002801E680000-0x000002801F6E6000-memory.dmp

Filesize
16.4MB

Download
memory/4428-22-0x000002803DBE0000-0x000002803E1C8000-memory.dmp

Filesize
5.9MB

Download
memory/4428-27-0x00007FFF8D650000-0x00007FFF8E03C000-memory.dmp

Filesize
9.9MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads