asyncrat | e84377f181936074f6b29c1ed84acb4409bb199e4e02b71bf4fb43781f803a28

General

Target

e84377f181936074f6b29c1ed84acb4409bb199e4e02b71bf4fb43781f803a28.ps1
Size

1.9MB
MD5

05ca50471d9f5c01b66e448ea589c149
SHA1

889ba922194d17cc453bf5a48505a570b9e9b609
SHA256

e84377f181936074f6b29c1ed84acb4409bb199e4e02b71bf4fb43781f803a28
SHA512

cae798186c385752728cf9b63e8eac4672ebc57d3ef3aa83ceeacf9b5e91924fe994047c4c9f0024cee062e6d1fdcba238076beb72478fd7f8621f6aabd7dac9
SSDEEP

24576:bSgmuyXfET5YN3b2LLG1z/7E4/KpdMJczdsrbIB:biMSNKLq1zjAj

Score

10^/10

asyncrat s2 execution rat

Malware Config

Extracted

Family

asyncrat

Version

AWS | 3Losh

Botnet

s2

C2

menitalnewways.webredirect.org:6606

menitalnewways.webredirect.org:7707

menitalnewways.webredirect.org:8808

menitalnewways.webredirect.org:333

Mutex

winter1

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Asyncrat family
asyncrat

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2368	powershell.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2312	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2368	powershell.exe
2368	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2368	powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\e84377f181936074f6b29c1ed84acb4409bb199e4e02b71bf4fb43781f803a28.ps1
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2368
- C:\Users\Public\Documents\AutoHotkey64.exe
  "C:\Users\Public\Documents\AutoHotkey64.exe"
  2⤵
  PID:2156
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
    3⤵
    PID:2640
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
    3⤵
    PID:4512
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
    3⤵
    PID:3668
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
    3⤵
    PID:3336
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
    3⤵
    PID:1304
- C:\Windows\system32\schtasks.exe
  "C:\Windows\system32\schtasks.exe" /create /tn 3losh /tr C:\Users\Public\Documents\AutoHotkey64.exe /sc minute /mo 2 /st 09:32 /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2312

C:\Users\Public\Documents\AutoHotkey64.exe
C:\Users\Public\Documents\AutoHotkey64.exe
1⤵
PID:1480
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  PID:1836
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  PID:2192
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  PID:4560
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  PID:3712
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  PID:4232

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\AddInProcess32.exe.log

Filesize
425B

MD5
4eaca4566b22b01cd3bc115b9b0b2196

SHA1
e743e0792c19f71740416e7b3c061d9f1336bf94

SHA256
34ba0ab8d1850e7825763f413142a333ccbc05fa2b5499a28a7d27b8a1c5b4bb

SHA512
bc2b1bf45203e3bb3009a7d37617b8f0f7ffa613680b32de2b963e39d2cf1650614d7035a0cf78f35a4f5cb17a2a439e2e07deaefd2a4275a62efd0a5c0184a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2pob0owr.5qc.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Public\Documents\A.txt

Filesize
255KB

MD5
333b12a1b009299e03b34c7972d8de9c

SHA1
804acd0591d6fe8507cb20d7b2da9de52ee35be3

SHA256
7b4f5e1c35fa4c7c0082bdb107ef27438053dca0ac1393cdbed71c01984fb039

SHA512
f4d9af4a0dd2b20ee88a54c09f32b70b5734318df2b4390eaec05b21bd6534eed7e24e686add8960aff18b9ab744a08353249a250639d48b2dba53ee3af7f225

Download Submit
C:\Users\Public\Documents\AutoHotkey64.ahk

Filesize
6KB

MD5
a51d3cc02396652ac39de494e7d725d6

SHA1
e4659a4561ac38659f7786f78485086aa1573036

SHA256
d2fb28bbafa9b105bed3334225778451529cbb2f847594021cccfab7f7d69c5d

SHA512
a4d2d3ca7d4d7ca7dcdcd8f7a46004ade1cff22f335b488972070d83602fb30d0b684fda4cd2677ccefb7afdabceb1d642152759b2f6c1796f3011dad272dda8

Download Submit
C:\Users\Public\Documents\AutoHotkey64.exe

Filesize
1.3MB

MD5
2d0600fe2b1b3bdc45d833ca32a37fdb

SHA1
e9a7411bfef54050de3b485833556f84cabd6e41

SHA256
effdea83c6b7a1dc2ce9e9d40e91dfd59bed9fcbd580903423648b7ca97d9696

SHA512
9891cd6d2140c3a5c20d5c2d6600f3655df437b99b09ae0f9daf1983190dc73385cc87f02508997bb696ac921eee43fccdf1dc210cc602938807bdb062ce1703

Download Submit
memory/1304-33-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/1304-37-0x0000000005D90000-0x0000000005E22000-memory.dmp

Filesize
584KB

Download
memory/1304-38-0x0000000005D80000-0x0000000005D8A000-memory.dmp

Filesize
40KB

Download
memory/1304-36-0x0000000006180000-0x0000000006724000-memory.dmp

Filesize
5.6MB

Download
memory/2368-14-0x00007FFF96930000-0x00007FFF973F1000-memory.dmp

Filesize
10.8MB

Download
memory/2368-15-0x000001FFD1300000-0x000001FFD131E000-memory.dmp

Filesize
120KB

Download
memory/2368-13-0x000001FFD13B0000-0x000001FFD1426000-memory.dmp

Filesize
472KB

Download
memory/2368-12-0x00007FFF96930000-0x00007FFF973F1000-memory.dmp

Filesize
10.8MB

Download
memory/2368-32-0x00007FFF96930000-0x00007FFF973F1000-memory.dmp

Filesize
10.8MB

Download
memory/2368-11-0x00007FFF96930000-0x00007FFF973F1000-memory.dmp

Filesize
10.8MB

Download
memory/2368-0-0x00007FFF96933000-0x00007FFF96935000-memory.dmp

Filesize
8KB

Download
memory/2368-10-0x000001FFD1090000-0x000001FFD10B2000-memory.dmp

Filesize
136KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads