asyncrat | e5bcb2a1cdf6cab62da5b7c8e8d78c25acb5627be5028fd5499df561fd4f24df

Analysis

max time kernel
122s
max time network
154s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
31-12-2024 19:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

436B2F74CD97649E20CED1DC65FB0B95.exe
Size

992KB
MD5

436b2f74cd97649e20ced1dc65fb0b95
SHA1

f96367071a2f3aa91a6c82968d542c80e670f1fe
SHA256

e5bcb2a1cdf6cab62da5b7c8e8d78c25acb5627be5028fd5499df561fd4f24df
SHA512

5535daf34f0e8d19f95ebf084fdfcf63f3e56f7dc8c562ca2b38212f8b3ad697e250a98d389722f673621201ff29e31c039b1a8e38504c55890993b38e734937
SSDEEP

24576:hN/BUBb+tYjBFHL68/C6SnugzXiM0hD6di/AD:jpUlRhT/5OXiM0hDTc

Score

10^/10

asyncrat default discovery rat

Malware Config

Extracted

Family

asyncrat

Version

| Edit by Vinom Rat

Botnet

Default

195.26.255.81:6606

195.26.255.81:7707

195.26.255.81:8808

195.26.255.81:0077

195.26.255.81:1996

195.26.255.81:2106

195.26.255.81:7777

Mutex

AsyncMutex_6SI8OkPnk

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Asyncrat family
asyncrat

Executes dropped EXE 1 IoCs

pid	Process
2692	pjcvfvnncx.icm

Loads dropped DLL 1 IoCs

pid	Process
2600	cmd.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2692 set thread context of 2936	2692	pjcvfvnncx.icm	38

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	436B2F74CD97649E20CED1DC65FB0B95.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ipconfig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pjcvfvnncx.icm
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ipconfig.exe

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2836	ipconfig.exe
2604	ipconfig.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
2692	pjcvfvnncx.icm
2692	pjcvfvnncx.icm
2692	pjcvfvnncx.icm
2692	pjcvfvnncx.icm
2692	pjcvfvnncx.icm
2692	pjcvfvnncx.icm
2692	pjcvfvnncx.icm
2692	pjcvfvnncx.icm
2936	RegSvcs.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2936	RegSvcs.exe
Token: SeDebugPrivilege	2936	RegSvcs.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2936	RegSvcs.exe

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 2288 wrote to memory of 3012	2288	436B2F74CD97649E20CED1DC65FB0B95.exe	28
PID 2288 wrote to memory of 3012	2288	436B2F74CD97649E20CED1DC65FB0B95.exe	28
PID 2288 wrote to memory of 3012	2288	436B2F74CD97649E20CED1DC65FB0B95.exe	28
PID 2288 wrote to memory of 3012	2288	436B2F74CD97649E20CED1DC65FB0B95.exe	28
PID 3012 wrote to memory of 2488	3012	WScript.exe	29
PID 3012 wrote to memory of 2488	3012	WScript.exe	29
PID 3012 wrote to memory of 2488	3012	WScript.exe	29
PID 3012 wrote to memory of 2488	3012	WScript.exe	29
PID 3012 wrote to memory of 2600	3012	WScript.exe	30
PID 3012 wrote to memory of 2600	3012	WScript.exe	30
PID 3012 wrote to memory of 2600	3012	WScript.exe	30
PID 3012 wrote to memory of 2600	3012	WScript.exe	30
PID 2488 wrote to memory of 2836	2488	cmd.exe	33
PID 2488 wrote to memory of 2836	2488	cmd.exe	33
PID 2488 wrote to memory of 2836	2488	cmd.exe	33
PID 2488 wrote to memory of 2836	2488	cmd.exe	33
PID 2600 wrote to memory of 2692	2600	cmd.exe	34
PID 2600 wrote to memory of 2692	2600	cmd.exe	34
PID 2600 wrote to memory of 2692	2600	cmd.exe	34
PID 2600 wrote to memory of 2692	2600	cmd.exe	34
PID 3012 wrote to memory of 2500	3012	WScript.exe	35
PID 3012 wrote to memory of 2500	3012	WScript.exe	35
PID 3012 wrote to memory of 2500	3012	WScript.exe	35
PID 3012 wrote to memory of 2500	3012	WScript.exe	35
PID 2500 wrote to memory of 2604	2500	cmd.exe	37
PID 2500 wrote to memory of 2604	2500	cmd.exe	37
PID 2500 wrote to memory of 2604	2500	cmd.exe	37
PID 2500 wrote to memory of 2604	2500	cmd.exe	37
PID 2692 wrote to memory of 2936	2692	pjcvfvnncx.icm	38
PID 2692 wrote to memory of 2936	2692	pjcvfvnncx.icm	38
PID 2692 wrote to memory of 2936	2692	pjcvfvnncx.icm	38
PID 2692 wrote to memory of 2936	2692	pjcvfvnncx.icm	38
PID 2692 wrote to memory of 2936	2692	pjcvfvnncx.icm	38
PID 2692 wrote to memory of 2936	2692	pjcvfvnncx.icm	38
PID 2692 wrote to memory of 2936	2692	pjcvfvnncx.icm	38
PID 2692 wrote to memory of 2936	2692	pjcvfvnncx.icm	38
PID 2692 wrote to memory of 2936	2692	pjcvfvnncx.icm	38

C:\Users\Admin\AppData\Local\Temp\436B2F74CD97649E20CED1DC65FB0B95.exe
"C:\Users\Admin\AppData\Local\Temp\436B2F74CD97649E20CED1DC65FB0B95.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2288
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\tmsf.vbe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3012
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c ipconfig /release
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2488
  - - C:\Windows\SysWOW64\ipconfig.exe
      ipconfig /release
      4⤵
      System Location Discovery: System Language Discovery
      Gathers network information
      PID:2836
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c pjcvfvnncx.icm vvcrvhm.bmp
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2600
  - - C:\Users\Admin\AppData\Local\Temp\RarSFX0\pjcvfvnncx.icm
      pjcvfvnncx.icm vvcrvhm.bmp
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:2692
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:2936
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c ipconfig /renew
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2500
  - - C:\Windows\SysWOW64\ipconfig.exe
      ipconfig /renew
      4⤵
      System Location Discovery: System Language Discovery
      Gathers network information
      PID:2604

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\CabDB15.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\ogjh.bin

Filesize
39KB

MD5
14ef93269646d40310ceea92ae9339b4

SHA1
b61363e6db7307acbfe6bbf8230f754f5eee6c88

SHA256
40dbc8112e05344401ea3f49652e14c23ab129c39678bf508ae99b7ea4226a73

SHA512
dcc9e187e565184dd12c22eb292911a8cbee6f65cc4f3b66355578f68cfa8cb723843e8b21b3cf6b12a998acd7062a47927cf57b33a12af5bfdfb056a6ff6335

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\pjcvfvnncx.icm

Filesize
925KB

MD5
0adb9b817f1df7807576c2d7068dd931

SHA1
4a1b94a9a5113106f40cd8ea724703734d15f118

SHA256
98e4f904f7de1644e519d09371b8afcbbf40ff3bd56d76ce4df48479a4ab884b

SHA512
883aa88f2dba4214bb534fbdaf69712127357a3d0f5666667525db3c1fa351598f067068dfc9e7c7a45fed4248d7dca729ba4f75764341e47048429f9ca8846a

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\smmetgr.fqg

Filesize
109KB

MD5
ee0b6dcb2323fe5047de83c300be5c00

SHA1
57510c2089062a35b49dcefad5f3552501698940

SHA256
8a7a595f49c43f8054f757a9fae31d7d10177638eca9d8060fc3a902a02785ea

SHA512
31d8af76ef4b9992adf5a4d78ed0c7231f35339efa484d137519ab219ee76197669cbb18f1947d9a940e89a6a4655ba5d9757a68d604670f6134bab83637358c

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\tmsf.vbe

Filesize
62KB

MD5
b94ddfc39c8e33d472bd5a2810f4e10d

SHA1
c2a8f8c29df1ddb170b8fa8fab5170784f4a6da7

SHA256
f97221732861050bd9dd4337fe23d51323336844a1aa68272aac47e13840a734

SHA512
47606282d701241d934051390d41f31270d230c164b849ca741e59308d8749f0baf137439d1814a61fd1ad79012fe14bb27b5290676f9bf0155f448188008946

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarF05D.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
memory/2936-72-0x0000000000310000-0x00000000007CA000-memory.dmp

Filesize
4.7MB

Download
memory/2936-74-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2936-75-0x0000000000310000-0x00000000007CA000-memory.dmp

Filesize
4.7MB

Download
memory/2936-77-0x0000000000310000-0x00000000007CA000-memory.dmp

Filesize
4.7MB

Download
memory/2936-76-0x0000000000310000-0x00000000007CA000-memory.dmp

Filesize
4.7MB

Download
memory/2936-78-0x0000000000310000-0x0000000000326000-memory.dmp

Filesize
88KB

Download