asyncrat | bc0c79ef32bdd9bc48f70b700a69fc8453678211cdda9564cdd8c9124e5cd8fc

General

Target

PROCESO_JUDICIAL_POR _DEMANDA_LABORAL_RDO 40032021-00235/1 DEMANDA.exe
Size

1.6MB
MD5

8f0717916432e1e4f3313c8ebde55210
SHA1

41456cd9c3b66cfb22f9bbeefb6750cce516bf3a
SHA256

8dc4d5deef19fb4da195c270819a6ee283b67408fc9ee187216a0ce80ee61bab
SHA512

d1c4696541ec1d8d44e820902828bfbbd16afbb9c4a251080fc62262fbf879b268ed0fff80ea84aacdc58f424c516a979bb8fa82f0dfe920d71cad92f17bcfee
SSDEEP

12288:N2EDigMo6E50Hmy00qEEmxnA7ECCXuiAK6xXHDJBIMQV2:bFaky0wEmxAQCCXuiA3XH8N2

Score

10^/10

asyncrat server discovery rat

Malware Config

Extracted

Family

asyncrat

Version

| CRACKED BY https://t.me/xworm_v2

Botnet

SERVER

C2

asyys.duckdns.org:52350

Mutex

AsyncMutex_6SI6TOGjnk

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Asyncrat family
asyncrat

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2040 set thread context of 1404	2040	1 DEMANDA.exe	91
PID 1404 set thread context of 1440	1404	cmd.exe	106

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2040	1 DEMANDA.exe
2040	1 DEMANDA.exe
1404	cmd.exe
1404	cmd.exe

Suspicious behavior: MapViewOfSection 3 IoCs

pid	Process
2040	1 DEMANDA.exe
1404	cmd.exe
1404	cmd.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1440	MSBuild.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2040 wrote to memory of 1404	2040	1 DEMANDA.exe	91
PID 2040 wrote to memory of 1404	2040	1 DEMANDA.exe	91
PID 2040 wrote to memory of 1404	2040	1 DEMANDA.exe	91
PID 2040 wrote to memory of 1404	2040	1 DEMANDA.exe	91
PID 1404 wrote to memory of 1440	1404	cmd.exe	106
PID 1404 wrote to memory of 1440	1404	cmd.exe	106
PID 1404 wrote to memory of 1440	1404	cmd.exe	106
PID 1404 wrote to memory of 1440	1404	cmd.exe	106
PID 1404 wrote to memory of 1440	1404	cmd.exe	106

C:\Users\Admin\AppData\Local\Temp\PROCESO_JUDICIAL_POR _DEMANDA_LABORAL_RDO 40032021-00235\1 DEMANDA.exe
"C:\Users\Admin\AppData\Local\Temp\PROCESO_JUDICIAL_POR _DEMANDA_LABORAL_RDO 40032021-00235\1 DEMANDA.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2040
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\SysWOW64\cmd.exe
  2⤵
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:1404
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1440

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\32d3ba58

Filesize
777KB

MD5
89293939114dada52e9a969edcb2a6fe

SHA1
36ecd43423c660679bfef594339a6424f6e315dc

SHA256
c127b3b46dd021051f69167d88b56ca80eab9b3da053cb96685c18e99dd26ebf

SHA512
79353835c5d11187de4dbd86757e5cbba3394aba6b52262afc3a6f2b3ed1eeb9c78bcc9dc41c150f6f97418d1c46ea09abacd12806d7dc60e520d8c85095aea3

Download Submit
memory/1404-13-0x0000000074DC0000-0x0000000074F3B000-memory.dmp

Filesize
1.5MB

Download
memory/1404-12-0x0000000074DCE000-0x0000000074DD0000-memory.dmp

Filesize
8KB

Download
memory/1404-15-0x0000000074DC0000-0x0000000074F3B000-memory.dmp

Filesize
1.5MB

Download
memory/1404-11-0x0000000074DC0000-0x0000000074F3B000-memory.dmp

Filesize
1.5MB

Download
memory/1404-9-0x00007FFA1D970000-0x00007FFA1DB65000-memory.dmp

Filesize
2.0MB

Download
memory/1440-24-0x00000000054E0000-0x000000000557C000-memory.dmp

Filesize
624KB

Download
memory/1440-19-0x000000007460E000-0x000000007460F000-memory.dmp

Filesize
4KB

Download
memory/1440-28-0x0000000074600000-0x0000000074DB0000-memory.dmp

Filesize
7.7MB

Download
memory/1440-20-0x0000000000750000-0x0000000000766000-memory.dmp

Filesize
88KB

Download
memory/1440-21-0x0000000074600000-0x0000000074DB0000-memory.dmp

Filesize
7.7MB

Download
memory/1440-25-0x0000000005B30000-0x00000000060D4000-memory.dmp

Filesize
5.6MB

Download
memory/1440-26-0x00000000055F0000-0x0000000005656000-memory.dmp

Filesize
408KB

Download
memory/1440-27-0x000000007460E000-0x000000007460F000-memory.dmp

Filesize
4KB

Download
memory/1440-16-0x0000000073340000-0x0000000074594000-memory.dmp

Filesize
18.3MB

Download
memory/2040-0-0x00007FF9FF060000-0x00007FF9FF1D2000-memory.dmp

Filesize
1.4MB

Download
memory/2040-6-0x00007FF9FF060000-0x00007FF9FF1D2000-memory.dmp

Filesize
1.4MB

Download
memory/2040-4-0x00007FF9FF079000-0x00007FF9FF07A000-memory.dmp

Filesize
4KB

Download
memory/2040-5-0x00007FF9FF060000-0x00007FF9FF1D2000-memory.dmp

Filesize
1.4MB

Download

Analysis

Sharing