asyncrat | 840240b54e0d65fae573f1d87d4aab67d3960aa915980ff9dfaa924c503bcb24

General

Target
tmpk4b20awd.exe
Size 45KB
Sample260522-yxtjfagw3t
SHA256 840240b54e0d65fae573f1d87d4aab67d3960aa915980ff9dfaa924c503bcb24
MD5 32623acea696efdcb733d4290b631897
SHA1 2a7a9cc92fde887a14be519647657a98eed2f15f
SHA512 77dc4dbed75cb5132d9af48fbb552c0c1ed08de69b6003e676338c413e1062ad4727708d90e25f024d24698f9a34e7dbc574905562dd3f8de71f115c6f492f63
SSDEEP 768:5uuq1TFR2pnFWUFLm/mo2qDw3Xo5EayPIMzjb9gX3iE6+UrKzXcKhABDZLx:5uuq1TFRIG2dQEabM3bqXSE7UChhWdLx
TLSH
T18B231B003BE9816BF2BE4F78ADF26105897AE1B77603D5492CC402D75713FC69A429FA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

C2

viet69z.me:443
viet69z.me:80
viet69z.me:7797
viet69z.me:8707
viet69z.me:6620
www.viet69z.me:443
www.viet69z.me:80
www.viet69z.me:7797
www.viet69z.me:8707
www.viet69z.me:6620
qbot.viet69z.me:443
qbot.viet69z.me:80
qbot.viet69z.me:7797
qbot.viet69z.me:8707
qbot.viet69z.me:6620
rat.viet69z.me:443
rat.viet69z.me:80
rat.viet69z.me:7797
rat.viet69z.me:8707
rat.viet69z.me:6620

Mutex

0rm1MMHafPIj

Attributes

delay
0
install
true
install_file
b9dx0.exe
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral3/files/0x001a00000002b503-8.dat	family_asyncrat

Executes dropped EXE 2 IoCs

pid	Process
5416	b9dx0.exe
3236	b9dx0.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b9dx0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b9dx0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpk4b20awd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
6084	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3648	schtasks.exe

Suspicious behavior: EnumeratesProcesses 17 IoCs

pid	Process
3528	tmpk4b20awd.exe
3528	tmpk4b20awd.exe
3528	tmpk4b20awd.exe
3528	tmpk4b20awd.exe
3528	tmpk4b20awd.exe
3528	tmpk4b20awd.exe
3528	tmpk4b20awd.exe
3528	tmpk4b20awd.exe
3528	tmpk4b20awd.exe
3528	tmpk4b20awd.exe
3528	tmpk4b20awd.exe
3528	tmpk4b20awd.exe
3528	tmpk4b20awd.exe
3528	tmpk4b20awd.exe
3528	tmpk4b20awd.exe
3528	tmpk4b20awd.exe
3528	tmpk4b20awd.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3528	tmpk4b20awd.exe
Token: SeDebugPrivilege	5416	b9dx0.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3528 wrote to memory of 4428	3528	tmpk4b20awd.exe	79
PID 3528 wrote to memory of 2456	3528	tmpk4b20awd.exe	81
PID 4428 wrote to memory of 3648	4428	cmd.exe	83
PID 2456 wrote to memory of 6084	2456	cmd.exe	84
PID 2456 wrote to memory of 3236	2456	cmd.exe	87

C:\Users\Admin\AppData\Local\Temp\tmpk4b20awd.exe
"C:\Users\Admin\AppData\Local\Temp\tmpk4b20awd.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3528
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "b9dx0" /tr '"C:\Users\Admin\AppData\Roaming\b9dx0.exe"' & exit
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4428
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /f /sc onlogon /rl highest /tn "b9dx0" /tr '"C:\Users\Admin\AppData\Roaming\b9dx0.exe"'
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3648
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpE6C6.tmp.bat""
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2456
- - C:\Windows\SysWOW64\timeout.exe
    timeout 3
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:6084
- - C:\Users\Admin\AppData\Roaming\b9dx0.exe
    "C:\Users\Admin\AppData\Roaming\b9dx0.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3236

C:\Users\Admin\AppData\Roaming\b9dx0.exe
"C:\Users\Admin\AppData\Roaming\b9dx0.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:5416

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmpE6C6.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmpE6C6.tmp.bat
Size 149B
SHA256 dea34bb9160f1b517453e76f0508f802ec6818ba504f325479d1559b2585e142
MD5 7572a3df57d1b7027e2974ee259ddac3
SHA1 823a0ac06b25c428102e508d6e156ba0ca86a00c
SHA512 61298cb7979dbfa3e7e0e09df80edcc33c1b9faea2b879d52ca5e371331d5ab6057f536419ff8659df35a39ebd8473c4127f8e3832dc88d85bb121ae3ba65137
TLSH
T10CC08C8691C6AA0E3905181302FB988D91B668193E44AB00C304840A92C044CE09A245
MD5 SHA1 SHA512 TLSH

Submit Download

b9dx0.exe

Path C:\Users\Admin\AppData\Roaming\b9dx0.exe
Size 45KB
SHA256 840240b54e0d65fae573f1d87d4aab67d3960aa915980ff9dfaa924c503bcb24
MD5 32623acea696efdcb733d4290b631897
SHA1 2a7a9cc92fde887a14be519647657a98eed2f15f
SHA512 77dc4dbed75cb5132d9af48fbb552c0c1ed08de69b6003e676338c413e1062ad4727708d90e25f024d24698f9a34e7dbc574905562dd3f8de71f115c6f492f63
SSDEEP 768:5uuq1TFR2pnFWUFLm/mo2qDw3Xo5EayPIMzjb9gX3iE6+UrKzXcKhABDZLx:5uuq1TFRIG2dQEabM3bqXSE7UChhWdLx
TLSH
T18B231B003BE9816BF2BE4F78ADF26105897AE1B77603D5492CC402D75713FC69A429FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3528-0-0x0000000000C30000-0x0000000000C42000-memory.dmp

Download

memory/3528-1-0x0000000005790000-0x00000000057A0000-memory.dmp

Download

memory/3528-2-0x00000000057A0000-0x000000000583C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads