asyncrat | e5bcb2a1cdf6cab62da5b7c8e8d78c25acb5627be5028fd5499df561fd4f24df

General

Target

436B2F74CD97649E20CED1DC65FB0B95.exe
Size

992KB
MD5

436b2f74cd97649e20ced1dc65fb0b95
SHA1

f96367071a2f3aa91a6c82968d542c80e670f1fe
SHA256

e5bcb2a1cdf6cab62da5b7c8e8d78c25acb5627be5028fd5499df561fd4f24df
SHA512

5535daf34f0e8d19f95ebf084fdfcf63f3e56f7dc8c562ca2b38212f8b3ad697e250a98d389722f673621201ff29e31c039b1a8e38504c55890993b38e734937
SSDEEP

24576:hN/BUBb+tYjBFHL68/C6SnugzXiM0hD6di/AD:jpUlRhT/5OXiM0hDTc

Score

10^/10

asyncrat default discovery rat

Malware Config

Extracted

Family

asyncrat

Version

| Edit by Vinom Rat

Botnet

Default

C2

195.26.255.81:6606

195.26.255.81:7707

195.26.255.81:8808

195.26.255.81:0077

195.26.255.81:1996

195.26.255.81:2106

195.26.255.81:7777

Mutex

AsyncMutex_6SI8OkPnk

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Asyncrat family
asyncrat

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	436B2F74CD97649E20CED1DC65FB0B95.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	WScript.exe

Executes dropped EXE 1 IoCs

pid	Process
4992	pjcvfvnncx.icm

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4992 set thread context of 3200	4992	pjcvfvnncx.icm	101

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ipconfig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ipconfig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pjcvfvnncx.icm
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	436B2F74CD97649E20CED1DC65FB0B95.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4832	ipconfig.exe
1820	ipconfig.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	436B2F74CD97649E20CED1DC65FB0B95.exe

Suspicious behavior: EnumeratesProcesses 17 IoCs

pid	Process
4992	pjcvfvnncx.icm
4992	pjcvfvnncx.icm
4992	pjcvfvnncx.icm
4992	pjcvfvnncx.icm
4992	pjcvfvnncx.icm
4992	pjcvfvnncx.icm
4992	pjcvfvnncx.icm
4992	pjcvfvnncx.icm
4992	pjcvfvnncx.icm
4992	pjcvfvnncx.icm
4992	pjcvfvnncx.icm
4992	pjcvfvnncx.icm
4992	pjcvfvnncx.icm
4992	pjcvfvnncx.icm
4992	pjcvfvnncx.icm
4992	pjcvfvnncx.icm
3200	RegSvcs.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3200	RegSvcs.exe
Token: SeDebugPrivilege	3200	RegSvcs.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3200	RegSvcs.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 4028 wrote to memory of 3324	4028	436B2F74CD97649E20CED1DC65FB0B95.exe	83
PID 4028 wrote to memory of 3324	4028	436B2F74CD97649E20CED1DC65FB0B95.exe	83
PID 4028 wrote to memory of 3324	4028	436B2F74CD97649E20CED1DC65FB0B95.exe	83
PID 3324 wrote to memory of 1068	3324	WScript.exe	87
PID 3324 wrote to memory of 1068	3324	WScript.exe	87
PID 3324 wrote to memory of 1068	3324	WScript.exe	87
PID 3324 wrote to memory of 2168	3324	WScript.exe	89
PID 3324 wrote to memory of 2168	3324	WScript.exe	89
PID 3324 wrote to memory of 2168	3324	WScript.exe	89
PID 1068 wrote to memory of 4832	1068	cmd.exe	91
PID 1068 wrote to memory of 4832	1068	cmd.exe	91
PID 1068 wrote to memory of 4832	1068	cmd.exe	91
PID 2168 wrote to memory of 4992	2168	cmd.exe	92
PID 2168 wrote to memory of 4992	2168	cmd.exe	92
PID 2168 wrote to memory of 4992	2168	cmd.exe	92
PID 3324 wrote to memory of 1888	3324	WScript.exe	96
PID 3324 wrote to memory of 1888	3324	WScript.exe	96
PID 3324 wrote to memory of 1888	3324	WScript.exe	96
PID 1888 wrote to memory of 1820	1888	cmd.exe	98
PID 1888 wrote to memory of 1820	1888	cmd.exe	98
PID 1888 wrote to memory of 1820	1888	cmd.exe	98
PID 4992 wrote to memory of 3200	4992	pjcvfvnncx.icm	101
PID 4992 wrote to memory of 3200	4992	pjcvfvnncx.icm	101
PID 4992 wrote to memory of 3200	4992	pjcvfvnncx.icm	101
PID 4992 wrote to memory of 3200	4992	pjcvfvnncx.icm	101
PID 4992 wrote to memory of 3200	4992	pjcvfvnncx.icm	101

C:\Users\Admin\AppData\Local\Temp\436B2F74CD97649E20CED1DC65FB0B95.exe
"C:\Users\Admin\AppData\Local\Temp\436B2F74CD97649E20CED1DC65FB0B95.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4028
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\tmsf.vbe"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3324
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c ipconfig /release
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1068
  - - C:\Windows\SysWOW64\ipconfig.exe
      ipconfig /release
      4⤵
      System Location Discovery: System Language Discovery
      Gathers network information
      PID:4832
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c pjcvfvnncx.icm vvcrvhm.bmp
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2168
  - - C:\Users\Admin\AppData\Local\Temp\RarSFX0\pjcvfvnncx.icm
      pjcvfvnncx.icm vvcrvhm.bmp
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:4992
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:3200
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c ipconfig /renew
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1888
  - - C:\Windows\SysWOW64\ipconfig.exe
      ipconfig /renew
      4⤵
      System Location Discovery: System Language Discovery
      Gathers network information
      PID:1820

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

3

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RarSFX0\ogjh.bin

Filesize
39KB

MD5
14ef93269646d40310ceea92ae9339b4

SHA1
b61363e6db7307acbfe6bbf8230f754f5eee6c88

SHA256
40dbc8112e05344401ea3f49652e14c23ab129c39678bf508ae99b7ea4226a73

SHA512
dcc9e187e565184dd12c22eb292911a8cbee6f65cc4f3b66355578f68cfa8cb723843e8b21b3cf6b12a998acd7062a47927cf57b33a12af5bfdfb056a6ff6335

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\pjcvfvnncx.icm

Filesize
925KB

MD5
0adb9b817f1df7807576c2d7068dd931

SHA1
4a1b94a9a5113106f40cd8ea724703734d15f118

SHA256
98e4f904f7de1644e519d09371b8afcbbf40ff3bd56d76ce4df48479a4ab884b

SHA512
883aa88f2dba4214bb534fbdaf69712127357a3d0f5666667525db3c1fa351598f067068dfc9e7c7a45fed4248d7dca729ba4f75764341e47048429f9ca8846a

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\smmetgr.fqg

Filesize
109KB

MD5
ee0b6dcb2323fe5047de83c300be5c00

SHA1
57510c2089062a35b49dcefad5f3552501698940

SHA256
8a7a595f49c43f8054f757a9fae31d7d10177638eca9d8060fc3a902a02785ea

SHA512
31d8af76ef4b9992adf5a4d78ed0c7231f35339efa484d137519ab219ee76197669cbb18f1947d9a940e89a6a4655ba5d9757a68d604670f6134bab83637358c

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\tmsf.vbe

Filesize
62KB

MD5
b94ddfc39c8e33d472bd5a2810f4e10d

SHA1
c2a8f8c29df1ddb170b8fa8fab5170784f4a6da7

SHA256
f97221732861050bd9dd4337fe23d51323336844a1aa68272aac47e13840a734

SHA512
47606282d701241d934051390d41f31270d230c164b849ca741e59308d8749f0baf137439d1814a61fd1ad79012fe14bb27b5290676f9bf0155f448188008946

Download Submit
memory/3200-71-0x0000000000560000-0x0000000000A0B000-memory.dmp

Filesize
4.7MB

Download
memory/3200-72-0x0000000000560000-0x0000000000576000-memory.dmp

Filesize
88KB

Download
memory/3200-73-0x0000000004E80000-0x0000000004EE6000-memory.dmp

Filesize
408KB

Download
memory/3200-74-0x0000000005350000-0x00000000053EC000-memory.dmp

Filesize
624KB

Download
memory/3200-75-0x0000000005D80000-0x0000000006324000-memory.dmp

Filesize
5.6MB

Download
memory/3200-76-0x0000000005A70000-0x0000000005B02000-memory.dmp

Filesize
584KB

Download
memory/3200-77-0x0000000005A20000-0x0000000005A2A000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads