asyncrat | 2b1841db20ac02610ea456b4650d6a2d296c92d5e29132887c753e354c4fdbf8

General

Target
tmpoi85_2t0.exe
Size 45KB
Sample260602-jnvykshx3j
SHA256 2b1841db20ac02610ea456b4650d6a2d296c92d5e29132887c753e354c4fdbf8
MD5 977fbbb1b684a48e40c5f48a23d4fe11
SHA1 40623fe4507ab071bc17b243ad2ae4efad3b0927
SHA512 615ca3a91e2e7f00bbdc29fe6d29eefeb9df6567919f6d10bf47395585601e6351c5194ec220e99034d710af9a97b0fab28cefbcc00cedea8b7fb4c2da449e89
SSDEEP 768:4uLoZTUAoOSWUYZL8mo2qFym/9GgrOPIRzjbWgX3if6nyaDx9TembwBDZbx:4uLoZTUTn2Zm1b3R3bJXSf6yaDx6dbx
TLSH
T17A232A003BEC822BF2BE4F78ADE25105457AF2A76603D6491CC4529B5723FC69A426FD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

C2

sinhvien18.net:443
sinhvien18.net:80
sinhvien18.net:7797
sinhvien18.net:8707
sinhvien18.net:6620
www.sinhvien18.net:443
www.sinhvien18.net:80
www.sinhvien18.net:7797
www.sinhvien18.net:8707
www.sinhvien18.net:6620
blacklotus.sinhvien18.net:443
blacklotus.sinhvien18.net:80
blacklotus.sinhvien18.net:7797
blacklotus.sinhvien18.net:8707
blacklotus.sinhvien18.net:6620
sodinokibi.sinhvien18.net:443
sodinokibi.sinhvien18.net:80
sodinokibi.sinhvien18.net:7797
sodinokibi.sinhvien18.net:8707
sodinokibi.sinhvien18.net:6620
melissa.sinhvien18.net:443
melissa.sinhvien18.net:80
melissa.sinhvien18.net:7797
melissa.sinhvien18.net:8707
melissa.sinhvien18.net:6620

Mutex

fJGBLhKGW5xf

Attributes

delay
0
install
true
install_file
95q7g.exe
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 2 IoCs

rat

resource	yara_rule
behavioral2/files/0x0007000000023208-8.dat	family_asyncrat
behavioral2/memory/4564-10-0x0000000005310000-0x0000000005320000-memory.dmp	family_asyncrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\International\Geo\Nation	tmpoi85_2t0.exe

Executes dropped EXE 2 IoCs

pid	Process
4564	95q7g.exe
4436	95q7g.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	95q7g.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	95q7g.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpoi85_2t0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
5028	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4696	schtasks.exe

Suspicious behavior: EnumeratesProcesses 23 IoCs

pid	Process
4620	tmpoi85_2t0.exe
4620	tmpoi85_2t0.exe
4620	tmpoi85_2t0.exe
4620	tmpoi85_2t0.exe
4620	tmpoi85_2t0.exe
4620	tmpoi85_2t0.exe
4620	tmpoi85_2t0.exe
4620	tmpoi85_2t0.exe
4620	tmpoi85_2t0.exe
4620	tmpoi85_2t0.exe
4620	tmpoi85_2t0.exe
4620	tmpoi85_2t0.exe
4620	tmpoi85_2t0.exe
4620	tmpoi85_2t0.exe
4620	tmpoi85_2t0.exe
4620	tmpoi85_2t0.exe
4620	tmpoi85_2t0.exe
4620	tmpoi85_2t0.exe
4620	tmpoi85_2t0.exe
4620	tmpoi85_2t0.exe
4620	tmpoi85_2t0.exe
4620	tmpoi85_2t0.exe
4620	tmpoi85_2t0.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4620	tmpoi85_2t0.exe
Token: SeDebugPrivilege	4564	95q7g.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4620 wrote to memory of 3724	4620	tmpoi85_2t0.exe	89
PID 4620 wrote to memory of 4692	4620	tmpoi85_2t0.exe	91
PID 4692 wrote to memory of 5028	4692	cmd.exe	93
PID 3724 wrote to memory of 4696	3724	cmd.exe	94
PID 4692 wrote to memory of 4436	4692	cmd.exe	97

C:\Users\Admin\AppData\Local\Temp\tmpoi85_2t0.exe
"C:\Users\Admin\AppData\Local\Temp\tmpoi85_2t0.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4620
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "95q7g" /tr '"C:\Users\Admin\AppData\Roaming\95q7g.exe"' & exit
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3724
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /f /sc onlogon /rl highest /tn "95q7g" /tr '"C:\Users\Admin\AppData\Roaming\95q7g.exe"'
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4696
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp875B.tmp.bat""
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4692
- - C:\Windows\SysWOW64\timeout.exe
    timeout 3
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:5028
- - C:\Users\Admin\AppData\Roaming\95q7g.exe
    "C:\Users\Admin\AppData\Roaming\95q7g.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4436

C:\Users\Admin\AppData\Roaming\95q7g.exe
"C:\Users\Admin\AppData\Roaming\95q7g.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4564

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmp875B.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmp875B.tmp.bat
Size 149B
SHA256 909702850f98454e4b737b16a239d8a048d2fc62962d970fdd58a66ab21e8ae8
MD5 6072e4d639fca0e5eeb3abaf5286d6b1
SHA1 7ffea0dc51b418812f5f2f8de89834eda6066a40
SHA512 f44268969332cda37344049a299968b121b9eb4f2e45be9fde126e6bd4ea53c2ce9c43c4da9d97d8d995f517f5cec7fd69be47af9424b015c205d9bf80e2ddcc
TLSH
T11DC02B5259C5FA4E3A099C3317FAD68C9172AD593F40BB00C3C4400D2282448F0E9341
MD5 SHA1 SHA512 TLSH

Submit Download

95q7g.exe

Path C:\Users\Admin\AppData\Roaming\95q7g.exe
Size 45KB
SHA256 2b1841db20ac02610ea456b4650d6a2d296c92d5e29132887c753e354c4fdbf8
MD5 977fbbb1b684a48e40c5f48a23d4fe11
SHA1 40623fe4507ab071bc17b243ad2ae4efad3b0927
SHA512 615ca3a91e2e7f00bbdc29fe6d29eefeb9df6567919f6d10bf47395585601e6351c5194ec220e99034d710af9a97b0fab28cefbcc00cedea8b7fb4c2da449e89
SSDEEP 768:4uLoZTUAoOSWUYZL8mo2qFym/9GgrOPIRzjbWgX3if6nyaDx9TembwBDZbx:4uLoZTUTn2Zm1b3R3bJXSf6yaDx6dbx
TLSH
T17A232A003BEC822BF2BE4F78ADE25105457AF2A76603D6491CC4529B5723FC69A426FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4564-10-0x0000000005310000-0x0000000005320000-memory.dmp

Download

memory/4564-13-0x0000000005310000-0x0000000005320000-memory.dmp

Download

memory/4620-0-0x00000000004C0000-0x00000000004D2000-memory.dmp

Download

memory/4620-1-0x0000000004F80000-0x0000000004F90000-memory.dmp

Download

memory/4620-2-0x0000000004E90000-0x0000000004F2C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads