asyncrat | bf67b21b7229d729998ecb892b818b4af55b227fe2efbbc2fb15eb0785fbe804

General

Target
bf67b21b7229d729998ecb892b818b4af55b227fe2efbbc2fb15eb0785fbe804.exe
Size 45KB
Sample260601-pyex1acv5y
SHA256 bf67b21b7229d729998ecb892b818b4af55b227fe2efbbc2fb15eb0785fbe804
MD5 86966ccfc940458bbc60c832243a7156
SHA1 bb2be6b6cf968c772b433003ae3c8cb0a11742e7
SHA512 b3f5432bb416aa68c397bcc8be03fb47c18ac6f5102e7d555fe29cd3f9d4b638ef38caf0de4659e40ea951912f3824a91d03613cce701f48c126b87b88b00721
SSDEEP 768:5uuq1TFR2pnFWUFLm/mo2qDjlsHoPEaMPIGBjbigX3idORVviNvWBDZLx:5uuq1TFRIG2QuuEaxGRbFXSd4wv4dLx
TLSH
T147230A007BE9812BF2BE4FB89DF25205867AF1A36603D54D2CC441975713FC69A42AFE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

C2

heosex.club:443
heosex.club:80
heosex.club:7797
heosex.club:8707
heosex.club:6620
www.heosex.club:443
www.heosex.club:80
www.heosex.club:7797
www.heosex.club:8707
www.heosex.club:6620
qbot.heosex.club:443
qbot.heosex.club:80
qbot.heosex.club:7797
qbot.heosex.club:8707
qbot.heosex.club:6620
dridex.heosex.club:443
dridex.heosex.club:80
dridex.heosex.club:7797
dridex.heosex.club:8707
dridex.heosex.club:6620

Mutex

7PvlbAJdAyai

Attributes

delay
0
install
true
install_file
9s0gc.exe
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral2/files/0x002300000002b30a-8.dat	family_asyncrat

Executes dropped EXE 2 IoCs

pid	Process
3048	9s0gc.exe
4240	9s0gc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9s0gc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bf67b21b7229d729998ecb892b818b4af55b227fe2efbbc2fb15eb0785fbe804.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9s0gc.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
4892	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4748	schtasks.exe

Suspicious behavior: EnumeratesProcesses 19 IoCs

pid	Process
1248	bf67b21b7229d729998ecb892b818b4af55b227fe2efbbc2fb15eb0785fbe804.exe
1248	bf67b21b7229d729998ecb892b818b4af55b227fe2efbbc2fb15eb0785fbe804.exe
1248	bf67b21b7229d729998ecb892b818b4af55b227fe2efbbc2fb15eb0785fbe804.exe
1248	bf67b21b7229d729998ecb892b818b4af55b227fe2efbbc2fb15eb0785fbe804.exe
1248	bf67b21b7229d729998ecb892b818b4af55b227fe2efbbc2fb15eb0785fbe804.exe
1248	bf67b21b7229d729998ecb892b818b4af55b227fe2efbbc2fb15eb0785fbe804.exe
1248	bf67b21b7229d729998ecb892b818b4af55b227fe2efbbc2fb15eb0785fbe804.exe
1248	bf67b21b7229d729998ecb892b818b4af55b227fe2efbbc2fb15eb0785fbe804.exe
1248	bf67b21b7229d729998ecb892b818b4af55b227fe2efbbc2fb15eb0785fbe804.exe
1248	bf67b21b7229d729998ecb892b818b4af55b227fe2efbbc2fb15eb0785fbe804.exe
1248	bf67b21b7229d729998ecb892b818b4af55b227fe2efbbc2fb15eb0785fbe804.exe
1248	bf67b21b7229d729998ecb892b818b4af55b227fe2efbbc2fb15eb0785fbe804.exe
1248	bf67b21b7229d729998ecb892b818b4af55b227fe2efbbc2fb15eb0785fbe804.exe
1248	bf67b21b7229d729998ecb892b818b4af55b227fe2efbbc2fb15eb0785fbe804.exe
1248	bf67b21b7229d729998ecb892b818b4af55b227fe2efbbc2fb15eb0785fbe804.exe
1248	bf67b21b7229d729998ecb892b818b4af55b227fe2efbbc2fb15eb0785fbe804.exe
1248	bf67b21b7229d729998ecb892b818b4af55b227fe2efbbc2fb15eb0785fbe804.exe
1248	bf67b21b7229d729998ecb892b818b4af55b227fe2efbbc2fb15eb0785fbe804.exe
1248	bf67b21b7229d729998ecb892b818b4af55b227fe2efbbc2fb15eb0785fbe804.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1248	bf67b21b7229d729998ecb892b818b4af55b227fe2efbbc2fb15eb0785fbe804.exe
Token: SeDebugPrivilege	3048	9s0gc.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1248 wrote to memory of 1716	1248	bf67b21b7229d729998ecb892b818b4af55b227fe2efbbc2fb15eb0785fbe804.exe	81
PID 1248 wrote to memory of 4236	1248	bf67b21b7229d729998ecb892b818b4af55b227fe2efbbc2fb15eb0785fbe804.exe	83
PID 1716 wrote to memory of 4748	1716	cmd.exe	85
PID 4236 wrote to memory of 4892	4236	cmd.exe	86
PID 4236 wrote to memory of 4240	4236	cmd.exe	89

C:\Users\Admin\AppData\Local\Temp\bf67b21b7229d729998ecb892b818b4af55b227fe2efbbc2fb15eb0785fbe804.exe
"C:\Users\Admin\AppData\Local\Temp\bf67b21b7229d729998ecb892b818b4af55b227fe2efbbc2fb15eb0785fbe804.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1248
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "9s0gc" /tr '"C:\Users\Admin\AppData\Roaming\9s0gc.exe"' & exit
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1716
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /f /sc onlogon /rl highest /tn "9s0gc" /tr '"C:\Users\Admin\AppData\Roaming\9s0gc.exe"'
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4748
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpC464.tmp.bat""
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4236
- - C:\Windows\SysWOW64\timeout.exe
    timeout 3
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:4892
- - C:\Users\Admin\AppData\Roaming\9s0gc.exe
    "C:\Users\Admin\AppData\Roaming\9s0gc.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4240

C:\Users\Admin\AppData\Roaming\9s0gc.exe
"C:\Users\Admin\AppData\Roaming\9s0gc.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3048

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmpC464.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmpC464.tmp.bat
Size 149B
SHA256 6081053fec653b620b41364b340f3e3acdaaa21450b8f05901d85cf47113b649
MD5 79c79a683eee0f1e09b136c5ecb927f4
SHA1 8a4287c646ca6080fecfb52a19affca0dae98709
SHA512 5d3ffb50b2c10ad8cfd4bbc1a2b0cc23c03ec5f3df97343359ba30ab71faa128e894e17837fce1557254f4c5488f1838eddc2cf0c7d0457ec20f1e96d66ac5e3
TLSH
T118C02B4361C6EB8F7C05681312FBE8DDE1737C193F84BB10C354800E2A8045AF0E9342
MD5 SHA1 SHA512 TLSH

Submit Download

9s0gc.exe

Path C:\Users\Admin\AppData\Roaming\9s0gc.exe
Size 45KB
SHA256 bf67b21b7229d729998ecb892b818b4af55b227fe2efbbc2fb15eb0785fbe804
MD5 86966ccfc940458bbc60c832243a7156
SHA1 bb2be6b6cf968c772b433003ae3c8cb0a11742e7
SHA512 b3f5432bb416aa68c397bcc8be03fb47c18ac6f5102e7d555fe29cd3f9d4b638ef38caf0de4659e40ea951912f3824a91d03613cce701f48c126b87b88b00721
SSDEEP 768:5uuq1TFR2pnFWUFLm/mo2qDjlsHoPEaMPIGBjbigX3idORVviNvWBDZLx:5uuq1TFRIG2QuuEaxGRbFXSd4wv4dLx
TLSH
T147230A007BE9812BF2BE4FB89DF25205867AF1A36603D54D2CC441975713FC69A42AFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1248-0-0x0000000000F50000-0x0000000000F62000-memory.dmp

Download

memory/1248-1-0x0000000003400000-0x0000000003410000-memory.dmp

Download

memory/1248-2-0x0000000005A40000-0x0000000005ADC000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads