asyncrat | 04e398c95d50638aaa182894dc0209a340421a017cebb8503b024c30b46fba8b

General

Target
tmpfqdcfxj6.exe
Size 4.2MB
Sample260522-y5s8msgw9x
SHA256 04e398c95d50638aaa182894dc0209a340421a017cebb8503b024c30b46fba8b
MD5 e4c4654f3afc6fae6928d956d1a2d7eb
SHA1 2511ac6d76145398f8a3cfdccff9942fe1080d96
SHA512 8b58052b02ff4e2522fb18a5190b6bb2c8230d3da2af0c21b18f93ee94520732f0c1ae754cd59ebdc7b092d08137eeb330e8d36e85b91afef10b3c6d858deeca
SSDEEP 49152:/3UZmvUizUEZMygl+/F3w6E18HzCB4AlgJ+BFIcBYMZfnxYynakWJ0S/3:nuyglOxGusnxYyna/v
TLSH
T11A169E1AB2B901F8C0A7C5798A178D13EA72745903729BEF17E089652F23AF05F7E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery asyncrat rat

Malware Config

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral2/files/0x000a000000024483-4.dat	family_asyncrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	tmpfqdcfxj6.exe

Executes dropped EXE 2 IoCs

pid	Process
2788	3051353302464101.exe
4500	5436522645644613.exe

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery

T1082

ioc	Process
\??\VBoxMiniRdrDN	tmpfqdcfxj6.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3051353302464101.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5436522645644613.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSerialNumber	tmpfqdcfxj6.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSVersion	tmpfqdcfxj6.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardProduct	tmpfqdcfxj6.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	tmpfqdcfxj6.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	tmpfqdcfxj6.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	tmpfqdcfxj6.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	tmpfqdcfxj6.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	tmpfqdcfxj6.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	tmpfqdcfxj6.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	tmpfqdcfxj6.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	tmpfqdcfxj6.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4196	tmpfqdcfxj6.exe
4196	tmpfqdcfxj6.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4196	tmpfqdcfxj6.exe
Token: SeDebugPrivilege	4500	5436522645644613.exe
Token: SeIncBasePriorityPrivilege	4500	5436522645644613.exe
Token: SeSystemEnvironmentPrivilege	2908	tmpfqdcfxj6.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4196 wrote to memory of 2788	4196	tmpfqdcfxj6.exe	88
PID 2908 wrote to memory of 4500	2908	tmpfqdcfxj6.exe	93

C:\Users\Admin\AppData\Local\Temp\tmpfqdcfxj6.exe
"C:\Users\Admin\AppData\Local\Temp\tmpfqdcfxj6.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4196
- C:\Users\Admin\AppData\Local\Temp\3051353302464101.exe
  "C:\Users\Admin\AppData\Local\Temp\3051353302464101.exe" --binder-child
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2788
- C:\Users\Admin\AppData\Local\Temp\tmpfqdcfxj6.exe
  "C:\Users\Admin\AppData\Local\Temp\tmpfqdcfxj6.exe"
  2⤵
  - Checks for VirtualBox DLLs, possible anti-VM trick
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2908
- - C:\Windows\TEMP\5436522645644613.exe
    "C:\Windows\TEMP\5436522645644613.exe" --binder-child
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4500

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

4

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3051353302464101.exe

Path C:\Users\Admin\AppData\Local\Temp\3051353302464101.exe
Size 61KB
SHA256 527b239943089133ddc6b623748b3f0f4da4fed5f0c9c8c92dd5c54e27efc493
MD5 55fbdf79d0be6c36990671595d770ec1
SHA1 4407a0624739d4a6b7f385f2b8791743d222666c
SHA512 b93f6cf9b86d1acd37a3c50421863372b02d5ce99e52de0d274f5b558a7fc779f639b979cda122d7da0c3f8e4fe4127389a74abacc45aae301211c501f33e972
SSDEEP 1536:QmiRkwwZGXEBBBOBa8oHbJEb3aLWQUGrljjFf+:XiQZGXqbJEb3LQ/vm
TLSH
T141535C047BF88529F2FE4F7498F1219046BAF6676A13DA8D1DC410D50A32BC6DA426FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2788-12-0x00000000006A0000-0x00000000006B6000-memory.dmp

Download

memory/2908-25-0x000001ACEE780000-0x000001ACEE781000-memory.dmp

Download

memory/2908-24-0x000001ACEE780000-0x000001ACEE781000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads