asyncrat | 7af694f5b0ecadde96052c26c6f92142e15a93b0b54e76f0bbc241da3bf09df1

General

Target
7af694f5b0ecadde96052c26c6f92142e15a93b0b54e76f0bbc241da3bf09df1.exe
Size 45KB
Sample260530-xhqcssbt4x
SHA256 7af694f5b0ecadde96052c26c6f92142e15a93b0b54e76f0bbc241da3bf09df1
MD5 c5d62e8b63ae279a7a4eb18d3fea33be
SHA1 3c0aa4a5fa3bc87df66b3439d85927d6237830ff
SHA512 62104574b5dcf9b8cd8e0c26e40dd1fee7a73b2d2308f33081fdf346bffba9e842559689febfb313f0a6ebd70dfa796723d0f6ce20d7e641629458be491aa175
SSDEEP 768:puNA/9T85LafWUzvSdmo2qIhRzMwcOPIxzjbSgX3idMSZmoSXIUEE4BDZ7x:puNA/9T8p72DAd3x3bVXSd0IfE+d7x
TLSH
T123232B003BE8C12BF1BE5F78ADF26145867AE2673603D54E1CC4519B5613FC68A426FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

C2

sexau.blog:443
sexau.blog:80
sexau.blog:7797
sexau.blog:8707
sexau.blog:6620
www.sexau.blog:443
www.sexau.blog:80
www.sexau.blog:7797
www.sexau.blog:8707
www.sexau.blog:6620
trickbot.sexau.blog:443
trickbot.sexau.blog:80
trickbot.sexau.blog:7797
trickbot.sexau.blog:8707
trickbot.sexau.blog:6620
formbook.sexau.blog:443
formbook.sexau.blog:80
formbook.sexau.blog:7797
formbook.sexau.blog:8707
formbook.sexau.blog:6620

Mutex

Z4FLyBAB6uLx

Attributes

delay
0
install
true
install_file
oepzhg.exe
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral2/files/0x000300000002a213-8.dat	family_asyncrat

Executes dropped EXE 2 IoCs

pid	Process
1068	oepzhg.exe
1328	oepzhg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oepzhg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7af694f5b0ecadde96052c26c6f92142e15a93b0b54e76f0bbc241da3bf09df1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oepzhg.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
3752	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1168	schtasks.exe

Suspicious behavior: EnumeratesProcesses 19 IoCs

pid	Process
4832	7af694f5b0ecadde96052c26c6f92142e15a93b0b54e76f0bbc241da3bf09df1.exe
4832	7af694f5b0ecadde96052c26c6f92142e15a93b0b54e76f0bbc241da3bf09df1.exe
4832	7af694f5b0ecadde96052c26c6f92142e15a93b0b54e76f0bbc241da3bf09df1.exe
4832	7af694f5b0ecadde96052c26c6f92142e15a93b0b54e76f0bbc241da3bf09df1.exe
4832	7af694f5b0ecadde96052c26c6f92142e15a93b0b54e76f0bbc241da3bf09df1.exe
4832	7af694f5b0ecadde96052c26c6f92142e15a93b0b54e76f0bbc241da3bf09df1.exe
4832	7af694f5b0ecadde96052c26c6f92142e15a93b0b54e76f0bbc241da3bf09df1.exe
4832	7af694f5b0ecadde96052c26c6f92142e15a93b0b54e76f0bbc241da3bf09df1.exe
4832	7af694f5b0ecadde96052c26c6f92142e15a93b0b54e76f0bbc241da3bf09df1.exe
4832	7af694f5b0ecadde96052c26c6f92142e15a93b0b54e76f0bbc241da3bf09df1.exe
4832	7af694f5b0ecadde96052c26c6f92142e15a93b0b54e76f0bbc241da3bf09df1.exe
4832	7af694f5b0ecadde96052c26c6f92142e15a93b0b54e76f0bbc241da3bf09df1.exe
4832	7af694f5b0ecadde96052c26c6f92142e15a93b0b54e76f0bbc241da3bf09df1.exe
4832	7af694f5b0ecadde96052c26c6f92142e15a93b0b54e76f0bbc241da3bf09df1.exe
4832	7af694f5b0ecadde96052c26c6f92142e15a93b0b54e76f0bbc241da3bf09df1.exe
4832	7af694f5b0ecadde96052c26c6f92142e15a93b0b54e76f0bbc241da3bf09df1.exe
4832	7af694f5b0ecadde96052c26c6f92142e15a93b0b54e76f0bbc241da3bf09df1.exe
4832	7af694f5b0ecadde96052c26c6f92142e15a93b0b54e76f0bbc241da3bf09df1.exe
4832	7af694f5b0ecadde96052c26c6f92142e15a93b0b54e76f0bbc241da3bf09df1.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4832	7af694f5b0ecadde96052c26c6f92142e15a93b0b54e76f0bbc241da3bf09df1.exe
Token: SeDebugPrivilege	1068	oepzhg.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4832 wrote to memory of 4088	4832	7af694f5b0ecadde96052c26c6f92142e15a93b0b54e76f0bbc241da3bf09df1.exe	83
PID 4832 wrote to memory of 5024	4832	7af694f5b0ecadde96052c26c6f92142e15a93b0b54e76f0bbc241da3bf09df1.exe	85
PID 4088 wrote to memory of 1168	4088	cmd.exe	87
PID 5024 wrote to memory of 3752	5024	cmd.exe	88
PID 5024 wrote to memory of 1328	5024	cmd.exe	91

C:\Users\Admin\AppData\Local\Temp\7af694f5b0ecadde96052c26c6f92142e15a93b0b54e76f0bbc241da3bf09df1.exe
"C:\Users\Admin\AppData\Local\Temp\7af694f5b0ecadde96052c26c6f92142e15a93b0b54e76f0bbc241da3bf09df1.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4832
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "oepzhg" /tr '"C:\Users\Admin\AppData\Roaming\oepzhg.exe"' & exit
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4088
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /f /sc onlogon /rl highest /tn "oepzhg" /tr '"C:\Users\Admin\AppData\Roaming\oepzhg.exe"'
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1168
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp4B2D.tmp.bat""
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5024
- - C:\Windows\SysWOW64\timeout.exe
    timeout 3
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:3752
- - C:\Users\Admin\AppData\Roaming\oepzhg.exe
    "C:\Users\Admin\AppData\Roaming\oepzhg.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1328

C:\Users\Admin\AppData\Roaming\oepzhg.exe
"C:\Users\Admin\AppData\Roaming\oepzhg.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1068

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmp4B2D.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmp4B2D.tmp.bat
Size 150B
SHA256 bece123689b8ce92e4b5b694c05149f4ab5f0ea2e8cec20f697e344c0542018c
MD5 48189827a37b2b8ba7ce1c8d5116d40f
SHA1 3b771fb4f832e17b7227db9109e86da730b9510d
SHA512 e052c0ff64cba269533437dd2c7f1aa2757813eac289a2f2220cac79349ea429851bd4fa0751be3ce5ca1887e04c339204e5e11480777bf7d50af82954915595
TLSH
T1C6C08C4261C9EA0E280524230ABED89D95A268193E80AB009704404D6280448E099345
MD5 SHA1 SHA512 TLSH

Submit Download

oepzhg.exe

Path C:\Users\Admin\AppData\Roaming\oepzhg.exe
Size 45KB
SHA256 7af694f5b0ecadde96052c26c6f92142e15a93b0b54e76f0bbc241da3bf09df1
MD5 c5d62e8b63ae279a7a4eb18d3fea33be
SHA1 3c0aa4a5fa3bc87df66b3439d85927d6237830ff
SHA512 62104574b5dcf9b8cd8e0c26e40dd1fee7a73b2d2308f33081fdf346bffba9e842559689febfb313f0a6ebd70dfa796723d0f6ce20d7e641629458be491aa175
SSDEEP 768:puNA/9T85LafWUzvSdmo2qIhRzMwcOPIxzjbSgX3idMSZmoSXIUEE4BDZ7x:puNA/9T8p72DAd3x3bVXSd0IfE+d7x
TLSH
T123232B003BE8C12BF1BE5F78ADF26145867AE2673603D54E1CC4519B5613FC68A426FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4832-0-0x00000000001D0000-0x00000000001E2000-memory.dmp

Download

memory/4832-1-0x0000000004CB0000-0x0000000004CC0000-memory.dmp

Download

memory/4832-2-0x0000000004CC0000-0x0000000004D5C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads