asyncrat | 04e398c95d50638aaa182894dc0209a340421a017cebb8503b024c30b46fba8b

General

Target
tmpfqdcfxj6.exe
Size 4.2MB
Sample260522-y5s8msgw9x
SHA256 04e398c95d50638aaa182894dc0209a340421a017cebb8503b024c30b46fba8b
MD5 e4c4654f3afc6fae6928d956d1a2d7eb
SHA1 2511ac6d76145398f8a3cfdccff9942fe1080d96
SHA512 8b58052b02ff4e2522fb18a5190b6bb2c8230d3da2af0c21b18f93ee94520732f0c1ae754cd59ebdc7b092d08137eeb330e8d36e85b91afef10b3c6d858deeca
SSDEEP 49152:/3UZmvUizUEZMygl+/F3w6E18HzCB4AlgJ+BFIcBYMZfnxYynakWJ0S/3:nuyglOxGusnxYyna/v
TLSH
T11A169E1AB2B901F8C0A7C5798A178D13EA72745903729BEF17E089652F23AF05F7E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery asyncrat rat

Malware Config

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral3/files/0x0008000000025f4f-4.dat	family_asyncrat

Executes dropped EXE 2 IoCs

pid	Process
2124	0350115013036651.exe
5496	0646502643144330.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\0646502643144330.exe.log	0646502643144330.exe

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery

T1082

ioc	Process
\??\VBoxMiniRdrDN	tmpfqdcfxj6.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0350115013036651.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0646502643144330.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	tmpfqdcfxj6.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	tmpfqdcfxj6.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSerialNumber	tmpfqdcfxj6.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSVersion	tmpfqdcfxj6.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardProduct	tmpfqdcfxj6.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	tmpfqdcfxj6.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	tmpfqdcfxj6.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	tmpfqdcfxj6.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	tmpfqdcfxj6.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	tmpfqdcfxj6.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	tmpfqdcfxj6.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5112	tmpfqdcfxj6.exe
5112	tmpfqdcfxj6.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	5112	tmpfqdcfxj6.exe
Token: SeDebugPrivilege	2124	0350115013036651.exe
Token: SeIncBasePriorityPrivilege	2124	0350115013036651.exe
Token: SeSystemEnvironmentPrivilege	2588	tmpfqdcfxj6.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5112 wrote to memory of 2124	5112	tmpfqdcfxj6.exe	80
PID 2588 wrote to memory of 5496	2588	tmpfqdcfxj6.exe	83

C:\Users\Admin\AppData\Local\Temp\tmpfqdcfxj6.exe
"C:\Users\Admin\AppData\Local\Temp\tmpfqdcfxj6.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5112
- C:\Users\Admin\AppData\Local\Temp\0350115013036651.exe
  "C:\Users\Admin\AppData\Local\Temp\0350115013036651.exe" --binder-child
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:2124
- C:\Users\Admin\AppData\Local\Temp\tmpfqdcfxj6.exe
  "C:\Users\Admin\AppData\Local\Temp\tmpfqdcfxj6.exe"
  2⤵
  - Checks for VirtualBox DLLs, possible anti-VM trick
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2588
- - C:\Windows\TEMP\0646502643144330.exe
    "C:\Windows\TEMP\0646502643144330.exe" --binder-child
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    PID:5496

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

3

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0350115013036651.exe

Path C:\Users\Admin\AppData\Local\Temp\0350115013036651.exe
Size 61KB
SHA256 527b239943089133ddc6b623748b3f0f4da4fed5f0c9c8c92dd5c54e27efc493
MD5 55fbdf79d0be6c36990671595d770ec1
SHA1 4407a0624739d4a6b7f385f2b8791743d222666c
SHA512 b93f6cf9b86d1acd37a3c50421863372b02d5ce99e52de0d274f5b558a7fc779f639b979cda122d7da0c3f8e4fe4127389a74abacc45aae301211c501f33e972
SSDEEP 1536:QmiRkwwZGXEBBBOBa8oHbJEb3aLWQUGrljjFf+:XiQZGXqbJEb3LQ/vm
TLSH
T141535C047BF88529F2FE4F7498F1219046BAF6676A13DA8D1DC410D50A32BC6DA426FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2124-11-0x0000000000DC0000-0x0000000000DD6000-memory.dmp

Download

memory/2588-24-0x0000023B5B6E0000-0x0000023B5B6E1000-memory.dmp

Download

memory/2588-25-0x0000023B5B6E0000-0x0000023B5B6E1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads