asyncrat | 5a2274913fcb176fe00e5fc8c34acac73d3546fd54d7a8a7bf909367ba362797

General

Target
5a2274913fcb176fe00e5fc8c34acac73d3546fd54d7a8a7bf909367ba362797.exe
Size 45KB
Sample260601-schnjsgv4x
SHA256 5a2274913fcb176fe00e5fc8c34acac73d3546fd54d7a8a7bf909367ba362797
MD5 6f54ac5690bd2ee905dc93706bb1fe40
SHA1 f8fe12262ea5c8f15d3c717515502010222cefba
SHA512 b9ae24d0d433c0422c0b4b8630123e367121f43e4ea399138955cdb55cdf144cac39694ce340f2a9697c38c161415d0e8f8ee8a7189a102c6828e3f8dc26292c
SSDEEP 768:4uBqJTMUyYUWUWBDimo2qVC0e3NEAKViZPIazjbJgs3iqeQkfPgABDZbx:4uBqJTMpv213exiWa3bGsS79dbx
TLSH
T130232C003BE8812BF2BE4F7498F26245867AF6672503D5491CC451DB5723FC69A43AFE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

C2

lauxanh.co.uk:443
lauxanh.co.uk:80
lauxanh.co.uk:7797
lauxanh.co.uk:8707
lauxanh.co.uk:6620
www.lauxanh.co.uk:443
www.lauxanh.co.uk:80
www.lauxanh.co.uk:7797
www.lauxanh.co.uk:8707
www.lauxanh.co.uk:6620
qbot.lauxanh.co.uk:443
qbot.lauxanh.co.uk:80
qbot.lauxanh.co.uk:7797
qbot.lauxanh.co.uk:8707
qbot.lauxanh.co.uk:6620
nimda.lauxanh.co.uk:443
nimda.lauxanh.co.uk:80
nimda.lauxanh.co.uk:7797
nimda.lauxanh.co.uk:8707
nimda.lauxanh.co.uk:6620
hermeticwiper.lauxanh.co.uk:443
hermeticwiper.lauxanh.co.uk:80
hermeticwiper.lauxanh.co.uk:7797
hermeticwiper.lauxanh.co.uk:8707
hermeticwiper.lauxanh.co.uk:6620

Mutex

ndM042flcv9g

Attributes

delay
0
install
true
install_file
sc0k.exe
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral2/files/0x001400000002af32-8.dat	family_asyncrat

Executes dropped EXE 2 IoCs

pid	Process
6028	sc0k.exe
416	sc0k.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc0k.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc0k.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5a2274913fcb176fe00e5fc8c34acac73d3546fd54d7a8a7bf909367ba362797.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
3820	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4360	schtasks.exe

Suspicious behavior: EnumeratesProcesses 19 IoCs

pid	Process
2096	5a2274913fcb176fe00e5fc8c34acac73d3546fd54d7a8a7bf909367ba362797.exe
2096	5a2274913fcb176fe00e5fc8c34acac73d3546fd54d7a8a7bf909367ba362797.exe
2096	5a2274913fcb176fe00e5fc8c34acac73d3546fd54d7a8a7bf909367ba362797.exe
2096	5a2274913fcb176fe00e5fc8c34acac73d3546fd54d7a8a7bf909367ba362797.exe
2096	5a2274913fcb176fe00e5fc8c34acac73d3546fd54d7a8a7bf909367ba362797.exe
2096	5a2274913fcb176fe00e5fc8c34acac73d3546fd54d7a8a7bf909367ba362797.exe
2096	5a2274913fcb176fe00e5fc8c34acac73d3546fd54d7a8a7bf909367ba362797.exe
2096	5a2274913fcb176fe00e5fc8c34acac73d3546fd54d7a8a7bf909367ba362797.exe
2096	5a2274913fcb176fe00e5fc8c34acac73d3546fd54d7a8a7bf909367ba362797.exe
2096	5a2274913fcb176fe00e5fc8c34acac73d3546fd54d7a8a7bf909367ba362797.exe
2096	5a2274913fcb176fe00e5fc8c34acac73d3546fd54d7a8a7bf909367ba362797.exe
2096	5a2274913fcb176fe00e5fc8c34acac73d3546fd54d7a8a7bf909367ba362797.exe
2096	5a2274913fcb176fe00e5fc8c34acac73d3546fd54d7a8a7bf909367ba362797.exe
2096	5a2274913fcb176fe00e5fc8c34acac73d3546fd54d7a8a7bf909367ba362797.exe
2096	5a2274913fcb176fe00e5fc8c34acac73d3546fd54d7a8a7bf909367ba362797.exe
2096	5a2274913fcb176fe00e5fc8c34acac73d3546fd54d7a8a7bf909367ba362797.exe
2096	5a2274913fcb176fe00e5fc8c34acac73d3546fd54d7a8a7bf909367ba362797.exe
2096	5a2274913fcb176fe00e5fc8c34acac73d3546fd54d7a8a7bf909367ba362797.exe
2096	5a2274913fcb176fe00e5fc8c34acac73d3546fd54d7a8a7bf909367ba362797.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2096	5a2274913fcb176fe00e5fc8c34acac73d3546fd54d7a8a7bf909367ba362797.exe
Token: SeDebugPrivilege	6028	sc0k.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2096 wrote to memory of 1928	2096	5a2274913fcb176fe00e5fc8c34acac73d3546fd54d7a8a7bf909367ba362797.exe	80
PID 2096 wrote to memory of 2816	2096	5a2274913fcb176fe00e5fc8c34acac73d3546fd54d7a8a7bf909367ba362797.exe	82
PID 1928 wrote to memory of 4360	1928	cmd.exe	84
PID 2816 wrote to memory of 3820	2816	cmd.exe	85
PID 2816 wrote to memory of 416	2816	cmd.exe	88

C:\Users\Admin\AppData\Local\Temp\5a2274913fcb176fe00e5fc8c34acac73d3546fd54d7a8a7bf909367ba362797.exe
"C:\Users\Admin\AppData\Local\Temp\5a2274913fcb176fe00e5fc8c34acac73d3546fd54d7a8a7bf909367ba362797.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2096
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "sc0k" /tr '"C:\Users\Admin\AppData\Roaming\sc0k.exe"' & exit
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1928
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /f /sc onlogon /rl highest /tn "sc0k" /tr '"C:\Users\Admin\AppData\Roaming\sc0k.exe"'
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4360
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp33AD.tmp.bat""
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2816
- - C:\Windows\SysWOW64\timeout.exe
    timeout 3
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:3820
- - C:\Users\Admin\AppData\Roaming\sc0k.exe
    "C:\Users\Admin\AppData\Roaming\sc0k.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:416

C:\Users\Admin\AppData\Roaming\sc0k.exe
"C:\Users\Admin\AppData\Roaming\sc0k.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:6028

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmp33AD.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmp33AD.tmp.bat
Size 148B
SHA256 b991b337ca6f4faf8e44bc0178fe9411cda431c0334f58754d54061e8138e1d8
MD5 2ed4c74b62b8b9618f44f4317c003433
SHA1 66118d79b04135e3d385758b935e5828a567db11
SHA512 33bbf3b8022e77268a70de870492df7051176995c9a1f3db5fb0cc41a163eea36093fd4df16251913932ec96dc73aa677d7bf37c424ca176b2dfff2ab27e9b00
TLSH
T1ABC02B8251CEEA0FAC05143302FAD49CD2727C193F40BB00C304400E62C084DFCD93C1
MD5 SHA1 SHA512 TLSH

Submit Download

sc0k.exe

Path C:\Users\Admin\AppData\Roaming\sc0k.exe
Size 45KB
SHA256 5a2274913fcb176fe00e5fc8c34acac73d3546fd54d7a8a7bf909367ba362797
MD5 6f54ac5690bd2ee905dc93706bb1fe40
SHA1 f8fe12262ea5c8f15d3c717515502010222cefba
SHA512 b9ae24d0d433c0422c0b4b8630123e367121f43e4ea399138955cdb55cdf144cac39694ce340f2a9697c38c161415d0e8f8ee8a7189a102c6828e3f8dc26292c
SSDEEP 768:4uBqJTMUyYUWUWBDimo2qVC0e3NEAKViZPIazjbJgs3iqeQkfPgABDZbx:4uBqJTMpv213exiWa3bGsS79dbx
TLSH
T130232C003BE8812BF2BE4F7498F26245867AF6672503D5491CC451DB5723FC69A43AFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2096-0-0x0000000000D10000-0x0000000000D22000-memory.dmp

Download

memory/2096-1-0x0000000005790000-0x00000000057A0000-memory.dmp

Download

memory/2096-2-0x0000000005840000-0x00000000058DC000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads