asyncrat | f18236854eaa7b849af58d81f6391f15db8ed0ded2998ee14a5f9908486a8ab5

General

Target
f18236854eaa7b849af58d81f6391f15db8ed0ded2998ee14a5f9908486a8ab5.exe
Size 45KB
Sample260601-rfqynaez8w
SHA256 f18236854eaa7b849af58d81f6391f15db8ed0ded2998ee14a5f9908486a8ab5
MD5 17f424a7b078ee87c4ce2c69a077e64a
SHA1 4b2e56bf9784c88c86133ed7c3b86ea5ffa9726a
SHA512 965dfc3da1c3c67573aba61b33c283eacb1d57375bfa153a3a605abc9173aa4bc758ffb4e47f331d697d6f7c1377b87d7d9df254792b1b1452b3cf32666cecfd
SSDEEP 768:4uLoZTUAoOSWUYZL8mo2qFFlspcPEaPPI8njbwgX3iLglR8VjGrBDZbx:4uLoZTUTn2EgaEaI8jb3XSamjG9dbx
TLSH
T1B3232A003BE8826BF2BE4F789DF26105467EF2B72603D58D1CC452974713BC69652AFA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

C2

phimxech.net:443
phimxech.net:80
phimxech.net:7797
phimxech.net:8707
phimxech.net:6620
www.phimxech.net:443
www.phimxech.net:80
www.phimxech.net:7797
www.phimxech.net:8707
www.phimxech.net:6620
conti.phimxech.net:443
conti.phimxech.net:80
conti.phimxech.net:7797
conti.phimxech.net:8707
conti.phimxech.net:6620
dridex.phimxech.net:443
dridex.phimxech.net:80
dridex.phimxech.net:7797
dridex.phimxech.net:8707
dridex.phimxech.net:6620
malware.phimxech.net:443
malware.phimxech.net:80
malware.phimxech.net:7797
malware.phimxech.net:8707
malware.phimxech.net:6620
codered.phimxech.net:443
codered.phimxech.net:80
codered.phimxech.net:7797
codered.phimxech.net:8707
codered.phimxech.net:6620

Mutex

7VoaLJp4DXbK

Attributes

delay
0
install
true
install_file
xxoed.exe
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral2/files/0x001a00000002b4dd-8.dat	family_asyncrat

Executes dropped EXE 2 IoCs

pid	Process
5652	xxoed.exe
5160	xxoed.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xxoed.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xxoed.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f18236854eaa7b849af58d81f6391f15db8ed0ded2998ee14a5f9908486a8ab5.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
4916	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4920	schtasks.exe

Suspicious behavior: EnumeratesProcesses 19 IoCs

pid	Process
1580	f18236854eaa7b849af58d81f6391f15db8ed0ded2998ee14a5f9908486a8ab5.exe
1580	f18236854eaa7b849af58d81f6391f15db8ed0ded2998ee14a5f9908486a8ab5.exe
1580	f18236854eaa7b849af58d81f6391f15db8ed0ded2998ee14a5f9908486a8ab5.exe
1580	f18236854eaa7b849af58d81f6391f15db8ed0ded2998ee14a5f9908486a8ab5.exe
1580	f18236854eaa7b849af58d81f6391f15db8ed0ded2998ee14a5f9908486a8ab5.exe
1580	f18236854eaa7b849af58d81f6391f15db8ed0ded2998ee14a5f9908486a8ab5.exe
1580	f18236854eaa7b849af58d81f6391f15db8ed0ded2998ee14a5f9908486a8ab5.exe
1580	f18236854eaa7b849af58d81f6391f15db8ed0ded2998ee14a5f9908486a8ab5.exe
1580	f18236854eaa7b849af58d81f6391f15db8ed0ded2998ee14a5f9908486a8ab5.exe
1580	f18236854eaa7b849af58d81f6391f15db8ed0ded2998ee14a5f9908486a8ab5.exe
1580	f18236854eaa7b849af58d81f6391f15db8ed0ded2998ee14a5f9908486a8ab5.exe
1580	f18236854eaa7b849af58d81f6391f15db8ed0ded2998ee14a5f9908486a8ab5.exe
1580	f18236854eaa7b849af58d81f6391f15db8ed0ded2998ee14a5f9908486a8ab5.exe
1580	f18236854eaa7b849af58d81f6391f15db8ed0ded2998ee14a5f9908486a8ab5.exe
1580	f18236854eaa7b849af58d81f6391f15db8ed0ded2998ee14a5f9908486a8ab5.exe
1580	f18236854eaa7b849af58d81f6391f15db8ed0ded2998ee14a5f9908486a8ab5.exe
1580	f18236854eaa7b849af58d81f6391f15db8ed0ded2998ee14a5f9908486a8ab5.exe
1580	f18236854eaa7b849af58d81f6391f15db8ed0ded2998ee14a5f9908486a8ab5.exe
1580	f18236854eaa7b849af58d81f6391f15db8ed0ded2998ee14a5f9908486a8ab5.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1580	f18236854eaa7b849af58d81f6391f15db8ed0ded2998ee14a5f9908486a8ab5.exe
Token: SeDebugPrivilege	5652	xxoed.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1580 wrote to memory of 5016	1580	f18236854eaa7b849af58d81f6391f15db8ed0ded2998ee14a5f9908486a8ab5.exe	80
PID 1580 wrote to memory of 4852	1580	f18236854eaa7b849af58d81f6391f15db8ed0ded2998ee14a5f9908486a8ab5.exe	81
PID 5016 wrote to memory of 4920	5016	cmd.exe	84
PID 4852 wrote to memory of 4916	4852	cmd.exe	85
PID 4852 wrote to memory of 5160	4852	cmd.exe	88

C:\Users\Admin\AppData\Local\Temp\f18236854eaa7b849af58d81f6391f15db8ed0ded2998ee14a5f9908486a8ab5.exe
"C:\Users\Admin\AppData\Local\Temp\f18236854eaa7b849af58d81f6391f15db8ed0ded2998ee14a5f9908486a8ab5.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1580
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "xxoed" /tr '"C:\Users\Admin\AppData\Roaming\xxoed.exe"' & exit
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5016
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /f /sc onlogon /rl highest /tn "xxoed" /tr '"C:\Users\Admin\AppData\Roaming\xxoed.exe"'
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4920
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp3D91.tmp.bat""
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4852
- - C:\Windows\SysWOW64\timeout.exe
    timeout 3
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:4916
- - C:\Users\Admin\AppData\Roaming\xxoed.exe
    "C:\Users\Admin\AppData\Roaming\xxoed.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5160

C:\Users\Admin\AppData\Roaming\xxoed.exe
"C:\Users\Admin\AppData\Roaming\xxoed.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:5652

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmp3D91.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmp3D91.tmp.bat
Size 149B
SHA256 2f98988819621c6bde575a4639bd9cdae108824def91d35a781d20d89f659513
MD5 20534b27065b60bfa1dedaffa96a7d3b
SHA1 418b379a6aaa2ce2ed861481435aaef7545fce04
SHA512 d2bfb06788a1d64ecd2dda783e34258db5258c0cff07a4b007fafafb0921f30d0c174812a6bb85523b536d4911c0a52a8457b0f8f81b2f8c8017224738795dc1
TLSH
T1B3C02B4252CAFA0E2C0514A303FBD48C91766D1D3F80FF00D304414D2781C58F0D9382
MD5 SHA1 SHA512 TLSH

Submit Download

xxoed.exe

Path C:\Users\Admin\AppData\Roaming\xxoed.exe
Size 45KB
SHA256 f18236854eaa7b849af58d81f6391f15db8ed0ded2998ee14a5f9908486a8ab5
MD5 17f424a7b078ee87c4ce2c69a077e64a
SHA1 4b2e56bf9784c88c86133ed7c3b86ea5ffa9726a
SHA512 965dfc3da1c3c67573aba61b33c283eacb1d57375bfa153a3a605abc9173aa4bc758ffb4e47f331d697d6f7c1377b87d7d9df254792b1b1452b3cf32666cecfd
SSDEEP 768:4uLoZTUAoOSWUYZL8mo2qFFlspcPEaPPI8njbwgX3iLglR8VjGrBDZbx:4uLoZTUTn2EgaEaI8jb3XSamjG9dbx
TLSH
T1B3232A003BE8826BF2BE4F789DF26105467EF2B72603D58D1CC452974713BC69652AFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1580-0-0x0000000000030000-0x0000000000042000-memory.dmp

Download

memory/1580-1-0x0000000004AE0000-0x0000000004AF0000-memory.dmp

Download

memory/1580-2-0x0000000004AF0000-0x0000000004B8C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads