asyncrat | beab179c9df3993e0a27839ea93b2191b60ca30e054e5a3369ecd3642d4bef00

General

Target
beab179c9df3993e0a27839ea93b2191b60ca30e054e5a3369ecd3642d4bef00.exe
Size 45KB
Sample260601-reyxwaez5v
SHA256 beab179c9df3993e0a27839ea93b2191b60ca30e054e5a3369ecd3642d4bef00
MD5 68535c1c2178b340a4cb11d300dc366e
SHA1 8a6444244445ee93ba36ecdc21bf94bf7990f722
SHA512 32e0b59b79a72a385083938cc952022b7deb2849a58731cad7935fde79e1fbb2b44d05ed000ca0fc814970039ebef321a90f725305d77b2fa723c835b70b1618
SSDEEP 768:Bupk9Tx5PWZZWUvfyRmo2qgnLiE02FjMdjYkkmPIqzjb0XgX3iqddLC+HBDZjx:Bupk9TxtOO2LL9wQPq3b0wXSydm+hdjx
TLSH
T12C231B003BE8812BF5BE4F7459F26145867AF5732603D64E1CC451DB1A23FC69A42AFE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

C2

chichnhau.vip:443
chichnhau.vip:80
chichnhau.vip:7797
chichnhau.vip:8707
chichnhau.vip:6620
www.chichnhau.vip:443
www.chichnhau.vip:80
www.chichnhau.vip:7797
www.chichnhau.vip:8707
www.chichnhau.vip:6620
industroyer.chichnhau.vip:443
industroyer.chichnhau.vip:80
industroyer.chichnhau.vip:7797
industroyer.chichnhau.vip:8707
industroyer.chichnhau.vip:6620
gozi.chichnhau.vip:443
gozi.chichnhau.vip:80
gozi.chichnhau.vip:7797
gozi.chichnhau.vip:8707
gozi.chichnhau.vip:6620

Mutex

D3HiFZqk4WEY

Attributes

delay
0
install
true
install_file
trf4.exe
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral2/files/0x001400000002af32-8.dat	family_asyncrat

Executes dropped EXE 2 IoCs

pid	Process
1876	trf4.exe
5532	trf4.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trf4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trf4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	beab179c9df3993e0a27839ea93b2191b60ca30e054e5a3369ecd3642d4bef00.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
3460	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4664	schtasks.exe

Suspicious behavior: EnumeratesProcesses 19 IoCs

pid	Process
6044	beab179c9df3993e0a27839ea93b2191b60ca30e054e5a3369ecd3642d4bef00.exe
6044	beab179c9df3993e0a27839ea93b2191b60ca30e054e5a3369ecd3642d4bef00.exe
6044	beab179c9df3993e0a27839ea93b2191b60ca30e054e5a3369ecd3642d4bef00.exe
6044	beab179c9df3993e0a27839ea93b2191b60ca30e054e5a3369ecd3642d4bef00.exe
6044	beab179c9df3993e0a27839ea93b2191b60ca30e054e5a3369ecd3642d4bef00.exe
6044	beab179c9df3993e0a27839ea93b2191b60ca30e054e5a3369ecd3642d4bef00.exe
6044	beab179c9df3993e0a27839ea93b2191b60ca30e054e5a3369ecd3642d4bef00.exe
6044	beab179c9df3993e0a27839ea93b2191b60ca30e054e5a3369ecd3642d4bef00.exe
6044	beab179c9df3993e0a27839ea93b2191b60ca30e054e5a3369ecd3642d4bef00.exe
6044	beab179c9df3993e0a27839ea93b2191b60ca30e054e5a3369ecd3642d4bef00.exe
6044	beab179c9df3993e0a27839ea93b2191b60ca30e054e5a3369ecd3642d4bef00.exe
6044	beab179c9df3993e0a27839ea93b2191b60ca30e054e5a3369ecd3642d4bef00.exe
6044	beab179c9df3993e0a27839ea93b2191b60ca30e054e5a3369ecd3642d4bef00.exe
6044	beab179c9df3993e0a27839ea93b2191b60ca30e054e5a3369ecd3642d4bef00.exe
6044	beab179c9df3993e0a27839ea93b2191b60ca30e054e5a3369ecd3642d4bef00.exe
6044	beab179c9df3993e0a27839ea93b2191b60ca30e054e5a3369ecd3642d4bef00.exe
6044	beab179c9df3993e0a27839ea93b2191b60ca30e054e5a3369ecd3642d4bef00.exe
6044	beab179c9df3993e0a27839ea93b2191b60ca30e054e5a3369ecd3642d4bef00.exe
6044	beab179c9df3993e0a27839ea93b2191b60ca30e054e5a3369ecd3642d4bef00.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	6044	beab179c9df3993e0a27839ea93b2191b60ca30e054e5a3369ecd3642d4bef00.exe
Token: SeDebugPrivilege	1876	trf4.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 6044 wrote to memory of 1368	6044	beab179c9df3993e0a27839ea93b2191b60ca30e054e5a3369ecd3642d4bef00.exe	80
PID 6044 wrote to memory of 1708	6044	beab179c9df3993e0a27839ea93b2191b60ca30e054e5a3369ecd3642d4bef00.exe	82
PID 1368 wrote to memory of 4664	1368	cmd.exe	84
PID 1708 wrote to memory of 3460	1708	cmd.exe	85
PID 1708 wrote to memory of 5532	1708	cmd.exe	88

C:\Users\Admin\AppData\Local\Temp\beab179c9df3993e0a27839ea93b2191b60ca30e054e5a3369ecd3642d4bef00.exe
"C:\Users\Admin\AppData\Local\Temp\beab179c9df3993e0a27839ea93b2191b60ca30e054e5a3369ecd3642d4bef00.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6044
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "trf4" /tr '"C:\Users\Admin\AppData\Roaming\trf4.exe"' & exit
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1368
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /f /sc onlogon /rl highest /tn "trf4" /tr '"C:\Users\Admin\AppData\Roaming\trf4.exe"'
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4664
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp3311.tmp.bat""
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1708
- - C:\Windows\SysWOW64\timeout.exe
    timeout 3
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:3460
- - C:\Users\Admin\AppData\Roaming\trf4.exe
    "C:\Users\Admin\AppData\Roaming\trf4.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5532

C:\Users\Admin\AppData\Roaming\trf4.exe
"C:\Users\Admin\AppData\Roaming\trf4.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1876

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmp3311.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmp3311.tmp.bat
Size 148B
SHA256 1bc08211fbf026696675c0833981a42c9a0851a5929374a30cbc749809d04e1d
MD5 5d581570457c8fdfc998eac186919068
SHA1 8e67aaa205aa94f537c7bf530b9a4cdc98175e54
SHA512 1e911f48b0e32233ed92107edd51853e376e20d17bf1ef909fde092ebd06fcebd0e0acb0ea102016c82a6082228bfbdda1a3f6cac9ff163ec0bbc4f9c5d61c51
TLSH
T109C02B42D1C6EE0F6C05149312FBD89CA1B26C9D3F80BB10C304441D268088CF0EE343
MD5 SHA1 SHA512 TLSH

Submit Download

trf4.exe

Path C:\Users\Admin\AppData\Roaming\trf4.exe
Size 45KB
SHA256 beab179c9df3993e0a27839ea93b2191b60ca30e054e5a3369ecd3642d4bef00
MD5 68535c1c2178b340a4cb11d300dc366e
SHA1 8a6444244445ee93ba36ecdc21bf94bf7990f722
SHA512 32e0b59b79a72a385083938cc952022b7deb2849a58731cad7935fde79e1fbb2b44d05ed000ca0fc814970039ebef321a90f725305d77b2fa723c835b70b1618
SSDEEP 768:Bupk9Tx5PWZZWUvfyRmo2qgnLiE02FjMdjYkkmPIqzjb0XgX3iqddLC+HBDZjx:Bupk9TxtOO2LL9wQPq3b0wXSydm+hdjx
TLSH
T12C231B003BE8812BF5BE4F7459F26145867AF5732603D64E1CC451DB1A23FC69A42AFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/6044-0-0x0000000000510000-0x0000000000522000-memory.dmp

Download

memory/6044-1-0x0000000002AC0000-0x0000000002AD0000-memory.dmp

Download

memory/6044-2-0x0000000004FE0000-0x000000000507C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads