asyncrat | 94d46e8b9788023fe37638002c39e84c3f00c473e69eb8a48efc4f4c058ff100

General

Target

lec.exe
Size

262KB
MD5

6afe340c4109d4dc85f4816047d7e036
SHA1

f1895f5c5e735ad4164f089567907350f4a0e093
SHA256

94d46e8b9788023fe37638002c39e84c3f00c473e69eb8a48efc4f4c058ff100
SHA512

9d0149848d18c3637d64b20457df098d2adf5f9d50ea4d591fa266d08083e253c9b81ae0aea8c930331aa32d992060817ccceda4a9fbb5e2b487a605e649ba50
SSDEEP

3072:STMdJz1z8Ub7OPk6JEYZTuSEzvi0oqn/YX+hYz:HdPbyPFEYZTuSEzvHvnAOS

Score

10^/10

asyncrat default rat

Malware Config

Extracted

Family

asyncrat

Botnet

Default

Attributes

delay
1
install
true
install_file
update.exe
install_folder
%AppData%
pastebin_config
https://pastebin.com/raw/7FziSYnf

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Asyncrat family
asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral2/files/0x000c000000023c39-10.dat	family_asyncrat

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	lec.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	update.exe

Executes dropped EXE 1 IoCs

pid	Process
4268	update.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
15	pastebin.com
16	pastebin.com
17	6.tcp.eu.ngrok.io

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Delays execution with timeout.exe 2 IoCs

evasion

pid	Process
4808	timeout.exe
3656	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3076	schtasks.exe

Suspicious behavior: EnumeratesProcesses 23 IoCs

pid	Process
3620	lec.exe
3620	lec.exe
3620	lec.exe
3620	lec.exe
3620	lec.exe
3620	lec.exe
3620	lec.exe
3620	lec.exe
3620	lec.exe
3620	lec.exe
3620	lec.exe
3620	lec.exe
3620	lec.exe
3620	lec.exe
3620	lec.exe
3620	lec.exe
3620	lec.exe
3620	lec.exe
3620	lec.exe
3620	lec.exe
3620	lec.exe
3620	lec.exe
3620	lec.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	3620	lec.exe
Token: SeDebugPrivilege	3620	lec.exe
Token: SeDebugPrivilege	4268	update.exe
Token: SeDebugPrivilege	4268	update.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 3620 wrote to memory of 2840	3620	lec.exe	84
PID 3620 wrote to memory of 2840	3620	lec.exe	84
PID 3620 wrote to memory of 5076	3620	lec.exe	86
PID 3620 wrote to memory of 5076	3620	lec.exe	86
PID 5076 wrote to memory of 4808	5076	cmd.exe	88
PID 5076 wrote to memory of 4808	5076	cmd.exe	88
PID 2840 wrote to memory of 3076	2840	cmd.exe	89
PID 2840 wrote to memory of 3076	2840	cmd.exe	89
PID 5076 wrote to memory of 4268	5076	cmd.exe	93
PID 5076 wrote to memory of 4268	5076	cmd.exe	93
PID 4268 wrote to memory of 4184	4268	update.exe	108
PID 4268 wrote to memory of 4184	4268	update.exe	108
PID 4268 wrote to memory of 4864	4268	update.exe	110
PID 4268 wrote to memory of 4864	4268	update.exe	110
PID 4864 wrote to memory of 3656	4864	cmd.exe	112
PID 4864 wrote to memory of 3656	4864	cmd.exe	112
PID 4184 wrote to memory of 3828	4184	cmd.exe	113
PID 4184 wrote to memory of 3828	4184	cmd.exe	113

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\lec.exe
"C:\Users\Admin\AppData\Local\Temp\lec.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3620
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "update" /tr '"C:\Users\Admin\AppData\Roaming\update.exe"' & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2840
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc onlogon /rl highest /tn "update" /tr '"C:\Users\Admin\AppData\Roaming\update.exe"'
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3076
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp953B.tmp.bat""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5076
- - C:\Windows\system32\timeout.exe
    timeout 3
    3⤵
    - Delays execution with timeout.exe
    PID:4808
- - C:\Users\Admin\AppData\Roaming\update.exe
    "C:\Users\Admin\AppData\Roaming\update.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4268
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /delete /f /tn "update"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4184
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /delete /f /tn "update"
        5⤵
        
        PID:3828
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp3E09.tmp.bat""
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4864
    - - C:\Windows\system32\timeout.exe
        
        timeout 3
        5⤵
        Delays execution with timeout.exe
        
        PID:3656

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp3E09.tmp.bat

Filesize
155B

MD5
3321ae2a9c5a251f7769e969396bfdb9

SHA1
6d7a7ce944a9cf7b1514d82b07b4d2aedb083775

SHA256
5a573c43ac3799b99d2321e06b560d85736cee81c9c4aa1cd604a47639bccc11

SHA512
34e2c9ce78bbd42fe96508c45dbc742c9ddc6aaf883144c1a821a08399873a00e0b3d629f5a2134507fb40c9ff260b463acd909d4354585a52f1b8a02aaf3185

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp953B.tmp.bat

Filesize
150B

MD5
761fe6a194724a53cc5a2a0e4238bc61

SHA1
ea1321e578dc86658bc0924301bd45299c100f7e

SHA256
d7ac23d2e1f6fa17692bce677acde6efa609035cffb86541f7ed5e7f0aef1efb

SHA512
d3d9348ae8ac3c375560f07a5d99ee1615e725733a0ce64579c9c12de9b13dbec21d97e7312cc5aa38b898f04478cc24b6c49a1483969465f92fd099fb1815fa

Download Submit
C:\Users\Admin\AppData\Roaming\update.exe

Filesize
262KB

MD5
6afe340c4109d4dc85f4816047d7e036

SHA1
f1895f5c5e735ad4164f089567907350f4a0e093

SHA256
94d46e8b9788023fe37638002c39e84c3f00c473e69eb8a48efc4f4c058ff100

SHA512
9d0149848d18c3637d64b20457df098d2adf5f9d50ea4d591fa266d08083e253c9b81ae0aea8c930331aa32d992060817ccceda4a9fbb5e2b487a605e649ba50

Download Submit
memory/3620-0-0x00007FFC5A983000-0x00007FFC5A985000-memory.dmp

Filesize
8KB

Download
memory/3620-1-0x0000000000D80000-0x0000000000DC8000-memory.dmp

Filesize
288KB

Download
memory/3620-2-0x00007FFC5A980000-0x00007FFC5B441000-memory.dmp

Filesize
10.8MB

Download
memory/3620-7-0x00007FFC5A980000-0x00007FFC5B441000-memory.dmp

Filesize
10.8MB

Download
memory/3620-8-0x00007FFC5A980000-0x00007FFC5B441000-memory.dmp

Filesize
10.8MB

Download
memory/4268-15-0x000000001D2D0000-0x000000001D346000-memory.dmp

Filesize
472KB

Download
memory/4268-16-0x000000001D250000-0x000000001D284000-memory.dmp

Filesize
208KB

Download
memory/4268-17-0x000000001B570000-0x000000001B58E000-memory.dmp

Filesize
120KB

Download
memory/4268-18-0x000000001D150000-0x000000001D202000-memory.dmp

Filesize
712KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads