asyncrat | ec1801ff79dcf59dfaf2a22c69769a9482edbe46847d9944f27105b2634e9807

General

Target

PG03360126-ES6378027-GH093773S68-56372227.exe
Size

1003KB
MD5

b44079d5d3715e31a4dd4c13ad899fd4
SHA1

9fbcddfebfd05586a7b31703e4ad110c066078eb
SHA256

06b9d622ecd26a0f75180459d60b4b1554d173f20b81c59b63c7b920fb0d03d8
SHA512

92890be215c9591cab70b27b0bad722a6b272b4689b4a893c81092b3fae67923ca7ca8f624958b05feae9998e5544c43d2b80d1cccd7c69a1275dd6b0f7bddb2
SSDEEP

24576:gAHnh+eWsN3skA4RV1Hom2KXMmHa3Asa74d3xM95:Xh+ZkldoPK8Ya3AT8VxW

Score

10^/10

asyncrat default discovery rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

Default

C2

zaragoza.ddns.net:5480

Mutex

AsyncMutex_6SI8OkPnk

Attributes

delay
3
install
true
install_file
fwqoouQWEGr.exe
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Executes dropped EXE 1 IoCs

Processes:

fwqoouQWEGr.exe

pid process

1980 fwqoouQWEGr.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

PG03360126-ES6378027-GH093773S68-56372227.exe

description pid process target process

PID 3472 set thread context of 2072 3472 PG03360126-ES6378027-GH093773S68-56372227.exe RegSvcs.exe

pid	process
1980	fwqoouQWEGr.exe

description	pid	process	target process
PID 3472 set thread context of 2072	3472	PG03360126-ES6378027-GH093773S68-56372227.exe	RegSvcs.exe

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

timeout.exefwqoouQWEGr.exePG03360126-ES6378027-GH093773S68-56372227.exeRegSvcs.execmd.execmd.exeschtasks.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fwqoouQWEGr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PG03360126-ES6378027-GH093773S68-56372227.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

376 timeout.exe
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exe

pid process

940 schtasks.exe

pid	process
376	timeout.exe

pid	process
940	schtasks.exe

Suspicious behavior: EnumeratesProcesses 23 IoCs

Processes:

RegSvcs.exe

pid	process
2072	RegSvcs.exe
2072	RegSvcs.exe
2072	RegSvcs.exe
2072	RegSvcs.exe
2072	RegSvcs.exe
2072	RegSvcs.exe
2072	RegSvcs.exe
2072	RegSvcs.exe
2072	RegSvcs.exe
2072	RegSvcs.exe
2072	RegSvcs.exe
2072	RegSvcs.exe
2072	RegSvcs.exe
2072	RegSvcs.exe
2072	RegSvcs.exe
2072	RegSvcs.exe
2072	RegSvcs.exe
2072	RegSvcs.exe
2072	RegSvcs.exe
2072	RegSvcs.exe
2072	RegSvcs.exe
2072	RegSvcs.exe
2072	RegSvcs.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

PG03360126-ES6378027-GH093773S68-56372227.exe

pid process

3472 PG03360126-ES6378027-GH093773S68-56372227.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

RegSvcs.exe

description pid process

Token: SeDebugPrivilege 2072 RegSvcs.exe
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

PG03360126-ES6378027-GH093773S68-56372227.exe

pid process

3472 PG03360126-ES6378027-GH093773S68-56372227.exe
3472 PG03360126-ES6378027-GH093773S68-56372227.exe
Suspicious use of SendNotifyMessage 2 IoCs

Processes:

PG03360126-ES6378027-GH093773S68-56372227.exe

pid process

3472 PG03360126-ES6378027-GH093773S68-56372227.exe
3472 PG03360126-ES6378027-GH093773S68-56372227.exe

pid	process
3472	PG03360126-ES6378027-GH093773S68-56372227.exe

description	pid	process
Token: SeDebugPrivilege	2072	RegSvcs.exe

pid	process
3472	PG03360126-ES6378027-GH093773S68-56372227.exe
3472	PG03360126-ES6378027-GH093773S68-56372227.exe

pid	process
3472	PG03360126-ES6378027-GH093773S68-56372227.exe
3472	PG03360126-ES6378027-GH093773S68-56372227.exe

Suspicious use of WriteProcessMemory 19 IoCs

Processes:

PG03360126-ES6378027-GH093773S68-56372227.exeRegSvcs.execmd.execmd.exe

description	pid	process	target process
PID 3472 wrote to memory of 2072	3472	PG03360126-ES6378027-GH093773S68-56372227.exe	RegSvcs.exe
PID 3472 wrote to memory of 2072	3472	PG03360126-ES6378027-GH093773S68-56372227.exe	RegSvcs.exe
PID 3472 wrote to memory of 2072	3472	PG03360126-ES6378027-GH093773S68-56372227.exe	RegSvcs.exe
PID 3472 wrote to memory of 2072	3472	PG03360126-ES6378027-GH093773S68-56372227.exe	RegSvcs.exe
PID 2072 wrote to memory of 4828	2072	RegSvcs.exe	cmd.exe
PID 2072 wrote to memory of 4828	2072	RegSvcs.exe	cmd.exe
PID 2072 wrote to memory of 4828	2072	RegSvcs.exe	cmd.exe
PID 2072 wrote to memory of 1608	2072	RegSvcs.exe	cmd.exe
PID 2072 wrote to memory of 1608	2072	RegSvcs.exe	cmd.exe
PID 2072 wrote to memory of 1608	2072	RegSvcs.exe	cmd.exe
PID 4828 wrote to memory of 940	4828	cmd.exe	schtasks.exe
PID 4828 wrote to memory of 940	4828	cmd.exe	schtasks.exe
PID 4828 wrote to memory of 940	4828	cmd.exe	schtasks.exe
PID 1608 wrote to memory of 376	1608	cmd.exe	timeout.exe
PID 1608 wrote to memory of 376	1608	cmd.exe	timeout.exe
PID 1608 wrote to memory of 376	1608	cmd.exe	timeout.exe
PID 1608 wrote to memory of 1980	1608	cmd.exe	fwqoouQWEGr.exe
PID 1608 wrote to memory of 1980	1608	cmd.exe	fwqoouQWEGr.exe
PID 1608 wrote to memory of 1980	1608	cmd.exe	fwqoouQWEGr.exe

C:\Users\Admin\AppData\Local\Temp\PG03360126-ES6378027-GH093773S68-56372227.exe
"C:\Users\Admin\AppData\Local\Temp\PG03360126-ES6378027-GH093773S68-56372227.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3472

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Users\Admin\AppData\Local\Temp\PG03360126-ES6378027-GH093773S68-56372227.exe"
2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2072

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "fwqoouQWEGr" /tr '"C:\Users\Admin\AppData\Roaming\fwqoouQWEGr.exe"' & exit
3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4828

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /f /sc onlogon /rl highest /tn "fwqoouQWEGr" /tr '"C:\Users\Admin\AppData\Roaming\fwqoouQWEGr.exe"'
4⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:940

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp89C1.tmp.bat""
3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1608

C:\Windows\SysWOW64\timeout.exe
timeout 3
4⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:376

C:\Users\Admin\AppData\Roaming\fwqoouQWEGr.exe
"C:\Users\Admin\AppData\Roaming\fwqoouQWEGr.exe"
4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1980

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp89C1.tmp.bat

Filesize
155B

MD5
7be1a8e349a2eb9b692ace900e842494

SHA1
ac29b7a94c10c28527d9a74e115597e65b79b0b8

SHA256
ac7b4c29c9116c0c1fd7d6306893255f41f3749ee622d27e61dd971aab25d183

SHA512
96efb603b7db0a4dcb3941af2fa1a5cf08b7867f97ff8d218ebdce6120677cf87775eaddbdb29acc439ed418a796139418e25bf439f1693f42b5f4fe271524e0

Download Submit
C:\Users\Admin\AppData\Roaming\fwqoouQWEGr.exe

Filesize
44KB

MD5
9d352bc46709f0cb5ec974633a0c3c94

SHA1
1969771b2f022f9a86d77ac4d4d239becdf08d07

SHA256
2c1eeb7097023c784c2bd040a2005a5070ed6f3a4abf13929377a9e39fab1390

SHA512
13c714244ec56beeb202279e4109d59c2a43c3cf29f90a374a751c04fd472b45228ca5a0178f41109ed863dbd34e0879e4a21f5e38ae3d89559c57e6be990a9b

Download Submit
memory/1980-25-0x00000000030D0000-0x000000000310C000-memory.dmp

Filesize
240KB

Download
memory/1980-24-0x0000000000E10000-0x0000000000E1E000-memory.dmp

Filesize
56KB

Download
memory/1980-26-0x0000000002F80000-0x0000000002FA1000-memory.dmp

Filesize
132KB

Download
memory/2072-11-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2072-12-0x0000000073A5E000-0x0000000073A5F000-memory.dmp

Filesize
4KB

Download
memory/2072-13-0x0000000073A50000-0x0000000074200000-memory.dmp

Filesize
7.7MB

Download
memory/2072-14-0x0000000004F20000-0x0000000004FBC000-memory.dmp

Filesize
624KB

Download
memory/2072-19-0x0000000073A50000-0x0000000074200000-memory.dmp

Filesize
7.7MB

Download
memory/3472-10-0x0000000004520000-0x0000000004524000-memory.dmp

Filesize
16KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads