asyncrat | 63e39d16245e776d15a48a23e20ecd21f758ed482965c549463ec5417562979d

General

Target

63e39d16245e776d15a48a23e20ecd21f758ed482965c549463ec5417562979d.exe
Size

72KB
MD5

bcec7faeb8082a9519433044e2e2d75d
SHA1

66a7b76862878df7fe5007413d164e6e9161f723
SHA256

63e39d16245e776d15a48a23e20ecd21f758ed482965c549463ec5417562979d
SHA512

4cfaeabcd161a6982ecc1aa3a9f048527fdb0780ce5ebdca9d6edc7bc44f2ca1f65374e781df0652c73bbbad81c4f6d339b268d83a6848a5c347620bbe2e3e7b
SSDEEP

768:EoB7Mxx0Fs4G7WHNwwYGsNmCx2jbogr3ieBr3LOtCoP0w4ClZJ2tYcFmVc6K:EoB7MxmPIN/6b/rSGLcC2VrJKmVcl

Score

10^/10

asyncrat default rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.6D

Botnet

Default

C2

seznam.zapto.org:6606

seznam.zapto.org:7707

seznam.zapto.org:8808

milla.publicvm.com:6606

milla.publicvm.com:7707

milla.publicvm.com:8808

Mutex

tibhzadmqmdah

Attributes

delay
4
install
true
install_file
sezneml.exe
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Asyncrat family
asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral1/files/0x00090000000120f9-14.dat	family_asyncrat

Executes dropped EXE 1 IoCs

pid	Process
2448	sezneml.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
2332	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1952	schtasks.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1500	63e39d16245e776d15a48a23e20ecd21f758ed482965c549463ec5417562979d.exe
1500	63e39d16245e776d15a48a23e20ecd21f758ed482965c549463ec5417562979d.exe
1500	63e39d16245e776d15a48a23e20ecd21f758ed482965c549463ec5417562979d.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1500	63e39d16245e776d15a48a23e20ecd21f758ed482965c549463ec5417562979d.exe
Token: SeDebugPrivilege	2448	sezneml.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 1500 wrote to memory of 2328	1500	63e39d16245e776d15a48a23e20ecd21f758ed482965c549463ec5417562979d.exe	30
PID 1500 wrote to memory of 2328	1500	63e39d16245e776d15a48a23e20ecd21f758ed482965c549463ec5417562979d.exe	30
PID 1500 wrote to memory of 2328	1500	63e39d16245e776d15a48a23e20ecd21f758ed482965c549463ec5417562979d.exe	30
PID 1500 wrote to memory of 1904	1500	63e39d16245e776d15a48a23e20ecd21f758ed482965c549463ec5417562979d.exe	32
PID 1500 wrote to memory of 1904	1500	63e39d16245e776d15a48a23e20ecd21f758ed482965c549463ec5417562979d.exe	32
PID 1500 wrote to memory of 1904	1500	63e39d16245e776d15a48a23e20ecd21f758ed482965c549463ec5417562979d.exe	32
PID 2328 wrote to memory of 1952	2328	cmd.exe	34
PID 2328 wrote to memory of 1952	2328	cmd.exe	34
PID 2328 wrote to memory of 1952	2328	cmd.exe	34
PID 1904 wrote to memory of 2332	1904	cmd.exe	35
PID 1904 wrote to memory of 2332	1904	cmd.exe	35
PID 1904 wrote to memory of 2332	1904	cmd.exe	35
PID 1904 wrote to memory of 2448	1904	cmd.exe	36
PID 1904 wrote to memory of 2448	1904	cmd.exe	36
PID 1904 wrote to memory of 2448	1904	cmd.exe	36

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\63e39d16245e776d15a48a23e20ecd21f758ed482965c549463ec5417562979d.exe
"C:\Users\Admin\AppData\Local\Temp\63e39d16245e776d15a48a23e20ecd21f758ed482965c549463ec5417562979d.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1500
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /ru system /rl highest /tn 63e39d16245e776d15a48a23e20ecd21f758ed482965c549463ec5417562979d /tr '"C:\Users\Admin\AppData\Roaming\sezneml.exe"' & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2328
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc onlogon /ru system /rl highest /tn 63e39d16245e776d15a48a23e20ecd21f758ed482965c549463ec5417562979d /tr '"C:\Users\Admin\AppData\Roaming\sezneml.exe"'
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1952
- C:\Windows\system32\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpB451.tmp.bat""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1904
- - C:\Windows\system32\timeout.exe
    timeout 3
    3⤵
    - Delays execution with timeout.exe
    PID:2332
- - C:\Users\Admin\AppData\Roaming\sezneml.exe
    "C:\Users\Admin\AppData\Roaming\sezneml.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:2448

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpB451.tmp.bat

Filesize
151B

MD5
dee2c2db6992737c80707fb0ed33b398

SHA1
025b243a3d8067be58cb8a7391dac4417c292050

SHA256
8cec90f9ebfd4c0c5151593ef110a385fbf27c28b88caad638a8591000c330a7

SHA512
b0523eb6b9c3c31e715beb6670a034d44450f718e09fda1b2b4df4954091b39cf5072e46531ead3b74ec3d82f5a547862001583d6cc46aec7ac2fb825dfcf990

Download Submit
C:\Users\Admin\AppData\Roaming\sezneml.exe

Filesize
72KB

MD5
bcec7faeb8082a9519433044e2e2d75d

SHA1
66a7b76862878df7fe5007413d164e6e9161f723

SHA256
63e39d16245e776d15a48a23e20ecd21f758ed482965c549463ec5417562979d

SHA512
4cfaeabcd161a6982ecc1aa3a9f048527fdb0780ce5ebdca9d6edc7bc44f2ca1f65374e781df0652c73bbbad81c4f6d339b268d83a6848a5c347620bbe2e3e7b

Download Submit
memory/1500-0-0x000007FEF5BC3000-0x000007FEF5BC4000-memory.dmp

Filesize
4KB

Download
memory/1500-1-0x00000000002E0000-0x00000000002F2000-memory.dmp

Filesize
72KB

Download
memory/1500-2-0x000007FEF5BC0000-0x000007FEF65AC000-memory.dmp

Filesize
9.9MB

Download
memory/1500-12-0x000007FEF5BC0000-0x000007FEF65AC000-memory.dmp

Filesize
9.9MB

Download
memory/2448-16-0x0000000001130000-0x0000000001142000-memory.dmp

Filesize
72KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads