asyncrat | 460e9bf5267cbb9e7eac888d76c56cfe9fc254c31df22a42ab2c9fddcf682915

General

Target

N5WVQ_file.exe
Size

13.4MB
MD5

bdfd72d13ed24048e040fa1ec269ba66
SHA1

92399e6601eafe6ea7ab6016fd84d457f92022d9
SHA256

460e9bf5267cbb9e7eac888d76c56cfe9fc254c31df22a42ab2c9fddcf682915
SHA512

ee6377901f6f5d6d6fe43961e0b34ec215767676b1f51a5f98463abef064ccaeea19fe13ee1b1854c331f164610ec92ee411ef59994b5e249135e0b6f44fb6dd
SSDEEP

196608:sr7MtO4mHJUtcY0RZStCbUOptduI0II2xPs2bgWSr6afW05xU/ZppNVcRFNoh9VD:skOHyP8b6HIZi2vSr6a/5xUhrkQrIFS

Score

10^/10

asyncrat venomrat default discovery rat

Malware Config

Extracted

Family

asyncrat

Version

Esco Private rat

Botnet

Default

C2

195.211.191.181:4449

Mutex

yeqnpswtkul

Attributes

delay
1
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Asyncrat family
asyncrat

VenomRAT 5 IoCs

Detects VenomRAT.

rat

resource	yara_rule
behavioral1/memory/2864-8-0x0000000000400000-0x0000000000418000-memory.dmp	VenomRAT
behavioral1/memory/2864-9-0x0000000000400000-0x0000000000418000-memory.dmp	VenomRAT
behavioral1/memory/2864-12-0x0000000000400000-0x0000000000418000-memory.dmp	VenomRAT
behavioral1/memory/2864-14-0x0000000000400000-0x0000000000418000-memory.dmp	VenomRAT
behavioral1/memory/2864-16-0x0000000000400000-0x0000000000418000-memory.dmp	VenomRAT

Venomrat family
venomrat

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2328 set thread context of 2864	2328	N5WVQ_file.exe	31

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	N5WVQ_file.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InstallUtil.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
2328	N5WVQ_file.exe
2328	N5WVQ_file.exe
2328	N5WVQ_file.exe
2864	InstallUtil.exe
2864	InstallUtil.exe
2864	InstallUtil.exe
2864	InstallUtil.exe
2864	InstallUtil.exe
2864	InstallUtil.exe
2864	InstallUtil.exe
2864	InstallUtil.exe
2864	InstallUtil.exe
2864	InstallUtil.exe
2864	InstallUtil.exe
2864	InstallUtil.exe
2864	InstallUtil.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2328	N5WVQ_file.exe
Token: SeDebugPrivilege	2864	InstallUtil.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2864	InstallUtil.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2328 wrote to memory of 2864	2328	N5WVQ_file.exe	31
PID 2328 wrote to memory of 2864	2328	N5WVQ_file.exe	31
PID 2328 wrote to memory of 2864	2328	N5WVQ_file.exe	31
PID 2328 wrote to memory of 2864	2328	N5WVQ_file.exe	31
PID 2328 wrote to memory of 2864	2328	N5WVQ_file.exe	31
PID 2328 wrote to memory of 2864	2328	N5WVQ_file.exe	31
PID 2328 wrote to memory of 2864	2328	N5WVQ_file.exe	31
PID 2328 wrote to memory of 2864	2328	N5WVQ_file.exe	31
PID 2328 wrote to memory of 2864	2328	N5WVQ_file.exe	31
PID 2328 wrote to memory of 2864	2328	N5WVQ_file.exe	31
PID 2328 wrote to memory of 2864	2328	N5WVQ_file.exe	31
PID 2328 wrote to memory of 2864	2328	N5WVQ_file.exe	31

C:\Users\Admin\AppData\Local\Temp\N5WVQ_file.exe
"C:\Users\Admin\AppData\Local\Temp\N5WVQ_file.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2328
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2864

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2328-0-0x0000000000A90000-0x0000000001800000-memory.dmp

Filesize
13.4MB

Download
memory/2328-1-0x00000000019F0000-0x0000000001A16000-memory.dmp

Filesize
152KB

Download
memory/2328-2-0x0000000001B50000-0x0000000001B6A000-memory.dmp

Filesize
104KB

Download
memory/2328-3-0x0000000001A40000-0x0000000001A46000-memory.dmp

Filesize
24KB

Download
memory/2864-4-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2864-6-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2864-8-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2864-9-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2864-10-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2864-12-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2864-14-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2864-16-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download

Analysis

Sharing