asyncrat | 27126bcf10d8c1397aacbc9ccbcc7334874d92a52932ed33c786325454e0e37d

General

Target
tmp88px06ug.exe
Size 45KB
Sample260602-jjee2ahv9l
SHA256 27126bcf10d8c1397aacbc9ccbcc7334874d92a52932ed33c786325454e0e37d
MD5 c0eaebf86fb963c0f94b7ab0b49304a5
SHA1 28c63a652ca35834977fd6356b8ce14267747461
SHA512 b22cf950b1ba44936c2a6ce4a15e05e8714ff90dfca5efaa030c381ed20d7c4af649f9a4c56bfb0b39c06a51ad1a050d01601a9c955633fe1b042f084f5a7562
SSDEEP 768:puNA/9T85LafWUzvSdmo2qIm/cYssPJZOPIcvzjbOgXZio29I8kVFOi3BDZ7x:puNA/9T8p72CMIf3cv3bxXo3IHVFOix/
TLSH
T109232C003BD8822BF1BE4F7899F26145467AF2673603D58E1CC451DB5613FC6DA42AED
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

C2

mtcostore.com:443
mtcostore.com:80
mtcostore.com:7797
mtcostore.com:8707
mtcostore.com:6620
www.mtcostore.com:443
www.mtcostore.com:80
www.mtcostore.com:7797
www.mtcostore.com:8707
www.mtcostore.com:6620
blaster.mtcostore.com:443
blaster.mtcostore.com:80
blaster.mtcostore.com:7797
blaster.mtcostore.com:8707
blaster.mtcostore.com:6620
stuxnet.mtcostore.com:443
stuxnet.mtcostore.com:80
stuxnet.mtcostore.com:7797
stuxnet.mtcostore.com:8707
stuxnet.mtcostore.com:6620

Mutex

YHgCaVD0ZDYL

Attributes

delay
0
install
true
install_file
t4tirq.exe
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral3/files/0x001400000002af32-8.dat	family_asyncrat

Executes dropped EXE 2 IoCs

pid	Process
5216	t4tirq.exe
908	t4tirq.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	t4tirq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	t4tirq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp88px06ug.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
1468	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2604	schtasks.exe

Suspicious behavior: EnumeratesProcesses 19 IoCs

pid	Process
6044	tmp88px06ug.exe
6044	tmp88px06ug.exe
6044	tmp88px06ug.exe
6044	tmp88px06ug.exe
6044	tmp88px06ug.exe
6044	tmp88px06ug.exe
6044	tmp88px06ug.exe
6044	tmp88px06ug.exe
6044	tmp88px06ug.exe
6044	tmp88px06ug.exe
6044	tmp88px06ug.exe
6044	tmp88px06ug.exe
6044	tmp88px06ug.exe
6044	tmp88px06ug.exe
6044	tmp88px06ug.exe
6044	tmp88px06ug.exe
6044	tmp88px06ug.exe
6044	tmp88px06ug.exe
6044	tmp88px06ug.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	6044	tmp88px06ug.exe
Token: SeDebugPrivilege	5216	t4tirq.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 6044 wrote to memory of 3508	6044	tmp88px06ug.exe	80
PID 6044 wrote to memory of 1368	6044	tmp88px06ug.exe	82
PID 3508 wrote to memory of 2604	3508	cmd.exe	84
PID 1368 wrote to memory of 1468	1368	cmd.exe	85
PID 1368 wrote to memory of 908	1368	cmd.exe	88

C:\Users\Admin\AppData\Local\Temp\tmp88px06ug.exe
"C:\Users\Admin\AppData\Local\Temp\tmp88px06ug.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6044
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "t4tirq" /tr '"C:\Users\Admin\AppData\Roaming\t4tirq.exe"' & exit
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3508
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /f /sc onlogon /rl highest /tn "t4tirq" /tr '"C:\Users\Admin\AppData\Roaming\t4tirq.exe"'
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2604
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp3311.tmp.bat""
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1368
- - C:\Windows\SysWOW64\timeout.exe
    timeout 3
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:1468
- - C:\Users\Admin\AppData\Roaming\t4tirq.exe
    "C:\Users\Admin\AppData\Roaming\t4tirq.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:908

C:\Users\Admin\AppData\Roaming\t4tirq.exe
"C:\Users\Admin\AppData\Roaming\t4tirq.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:5216

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmp3311.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmp3311.tmp.bat
Size 150B
SHA256 8aa73ae8224c8af67bc21c4c7491a2c2e931727c6d3c4cd4e5f047d414d9635e
MD5 b54bbe701ff0eb0443b2b4342aa3bd84
SHA1 837926fdd83ad8c251410664547996a024b7d609
SHA512 8bdfe55e61d882ffd0b34e224df8d36dd8fe049aedffc367949cb917e3da68683798441795e00fb42516bcebc2d397fef4e5773b1b0d8a7d48948cc1b56f5a48
TLSH
T17AC08C8292C6AA0F6805689302BA989CA16268593E80BB00870444192280858E0EA282
MD5 SHA1 SHA512 TLSH

Submit Download

t4tirq.exe

Path C:\Users\Admin\AppData\Roaming\t4tirq.exe
Size 45KB
SHA256 27126bcf10d8c1397aacbc9ccbcc7334874d92a52932ed33c786325454e0e37d
MD5 c0eaebf86fb963c0f94b7ab0b49304a5
SHA1 28c63a652ca35834977fd6356b8ce14267747461
SHA512 b22cf950b1ba44936c2a6ce4a15e05e8714ff90dfca5efaa030c381ed20d7c4af649f9a4c56bfb0b39c06a51ad1a050d01601a9c955633fe1b042f084f5a7562
SSDEEP 768:puNA/9T85LafWUzvSdmo2qIm/cYssPJZOPIcvzjbOgXZio29I8kVFOi3BDZ7x:puNA/9T8p72CMIf3cv3bxXo3IHVFOix/
TLSH
T109232C003BD8822BF1BE4F7899F26145467AF2673603D58E1CC451DB5613FC6DA42AED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/6044-0-0x0000000000F50000-0x0000000000F62000-memory.dmp

Download

memory/6044-1-0x0000000005960000-0x0000000005970000-memory.dmp

Download

memory/6044-2-0x0000000005A10000-0x0000000005AAC000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads