asyncrat | 441c8c73ea3f781774e9ee684d4d51127ec736c9fb6423fad0aea20695abd3c3

General

Target

441c8c73ea3f781774e9ee684d4d51127ec736c9fb6423fad0aea20695abd3c3.exe
Size

686KB
MD5

15fe2ac3357c534e280cc8d9de964aed
SHA1

af1e4824a0a4954c69fe91b6ad54e66a4f3a7511
SHA256

441c8c73ea3f781774e9ee684d4d51127ec736c9fb6423fad0aea20695abd3c3
SHA512

c32bfa3d04b1e67b2019afd9ee25b136e1880279f32a17a30128d2e574eb19578996167015cb620b91e3380186bc20b997045db426d4420ea4e1977b730acbdc
SSDEEP

12288:r8dStNKcItS4StNKcItSfl12tZ9uLUxL7HNHJTs2aInH5am38Dj11WWh2fab8fXk:r8yNK1t4NK1tOqLBCIHom383WxfaoXpe

Score

10^/10

asyncrat coke discovery rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

COKE

C2

quin.ydns.eu:1962

quin.ydns.eu:1940

185.38.142.240:1962

185.38.142.240:1940

Mutex

dLOEY8XRq1oB

Attributes

delay
3
install
false
install_file
windowsBook.exe
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Asyncrat family
asyncrat

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1964 set thread context of 4432	1964	441c8c73ea3f781774e9ee684d4d51127ec736c9fb6423fad0aea20695abd3c3.exe	89

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	441c8c73ea3f781774e9ee684d4d51127ec736c9fb6423fad0aea20695abd3c3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	441c8c73ea3f781774e9ee684d4d51127ec736c9fb6423fad0aea20695abd3c3.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4432	441c8c73ea3f781774e9ee684d4d51127ec736c9fb6423fad0aea20695abd3c3.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1964 wrote to memory of 4432	1964	441c8c73ea3f781774e9ee684d4d51127ec736c9fb6423fad0aea20695abd3c3.exe	89
PID 1964 wrote to memory of 4432	1964	441c8c73ea3f781774e9ee684d4d51127ec736c9fb6423fad0aea20695abd3c3.exe	89
PID 1964 wrote to memory of 4432	1964	441c8c73ea3f781774e9ee684d4d51127ec736c9fb6423fad0aea20695abd3c3.exe	89
PID 1964 wrote to memory of 4432	1964	441c8c73ea3f781774e9ee684d4d51127ec736c9fb6423fad0aea20695abd3c3.exe	89
PID 1964 wrote to memory of 4432	1964	441c8c73ea3f781774e9ee684d4d51127ec736c9fb6423fad0aea20695abd3c3.exe	89
PID 1964 wrote to memory of 4432	1964	441c8c73ea3f781774e9ee684d4d51127ec736c9fb6423fad0aea20695abd3c3.exe	89
PID 1964 wrote to memory of 4432	1964	441c8c73ea3f781774e9ee684d4d51127ec736c9fb6423fad0aea20695abd3c3.exe	89
PID 1964 wrote to memory of 4432	1964	441c8c73ea3f781774e9ee684d4d51127ec736c9fb6423fad0aea20695abd3c3.exe	89

C:\Users\Admin\AppData\Local\Temp\441c8c73ea3f781774e9ee684d4d51127ec736c9fb6423fad0aea20695abd3c3.exe
"C:\Users\Admin\AppData\Local\Temp\441c8c73ea3f781774e9ee684d4d51127ec736c9fb6423fad0aea20695abd3c3.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1964
- C:\Users\Admin\AppData\Local\Temp\441c8c73ea3f781774e9ee684d4d51127ec736c9fb6423fad0aea20695abd3c3.exe
  "C:\Users\Admin\AppData\Local\Temp\441c8c73ea3f781774e9ee684d4d51127ec736c9fb6423fad0aea20695abd3c3.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:4432

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\441c8c73ea3f781774e9ee684d4d51127ec736c9fb6423fad0aea20695abd3c3.exe.log

Filesize
1KB

MD5
8ec831f3e3a3f77e4a7b9cd32b48384c

SHA1
d83f09fd87c5bd86e045873c231c14836e76a05c

SHA256
7667e538030e3f8ce2886e47a01af24cb0ea70528b1e821c5d8832c5076cb982

SHA512
26bffa2406b66368bd412bf25869a792631455645992cdcade2dbc13a2e56fb546414a6a9223b94c96c38d89187add6678d4779a88b38b0c9e36be8527b213c3

Download Submit
memory/1964-4-0x0000000004AC0000-0x0000000004ACA000-memory.dmp

Filesize
40KB

Download
memory/1964-15-0x0000000074970000-0x0000000075120000-memory.dmp

Filesize
7.7MB

Download
memory/1964-3-0x0000000004AD0000-0x0000000004B62000-memory.dmp

Filesize
584KB

Download
memory/1964-0-0x000000007497E000-0x000000007497F000-memory.dmp

Filesize
4KB

Download
memory/1964-5-0x0000000074970000-0x0000000075120000-memory.dmp

Filesize
7.7MB

Download
memory/1964-6-0x0000000007C60000-0x0000000007CFC000-memory.dmp

Filesize
624KB

Download
memory/1964-7-0x0000000007820000-0x000000000783A000-memory.dmp

Filesize
104KB

Download
memory/1964-8-0x000000007497E000-0x000000007497F000-memory.dmp

Filesize
4KB

Download
memory/1964-2-0x0000000004FE0000-0x0000000005584000-memory.dmp

Filesize
5.6MB

Download
memory/1964-9-0x0000000074970000-0x0000000075120000-memory.dmp

Filesize
7.7MB

Download
memory/1964-10-0x0000000007ED0000-0x0000000007F26000-memory.dmp

Filesize
344KB

Download
memory/1964-1-0x0000000000140000-0x00000000001F2000-memory.dmp

Filesize
712KB

Download
memory/4432-14-0x0000000074970000-0x0000000075120000-memory.dmp

Filesize
7.7MB

Download
memory/4432-11-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/4432-16-0x0000000074970000-0x0000000075120000-memory.dmp

Filesize
7.7MB

Download
memory/4432-19-0x0000000005AD0000-0x0000000005B36000-memory.dmp

Filesize
408KB

Download
memory/4432-20-0x0000000074970000-0x0000000075120000-memory.dmp

Filesize
7.7MB

Download
memory/4432-21-0x0000000074970000-0x0000000075120000-memory.dmp

Filesize
7.7MB

Download

Analysis

Sharing