asyncrat | 2b1841db20ac02610ea456b4650d6a2d296c92d5e29132887c753e354c4fdbf8

General

Target
tmpoi85_2t0.exe
Size 45KB
Sample260602-jnvykshx3j
SHA256 2b1841db20ac02610ea456b4650d6a2d296c92d5e29132887c753e354c4fdbf8
MD5 977fbbb1b684a48e40c5f48a23d4fe11
SHA1 40623fe4507ab071bc17b243ad2ae4efad3b0927
SHA512 615ca3a91e2e7f00bbdc29fe6d29eefeb9df6567919f6d10bf47395585601e6351c5194ec220e99034d710af9a97b0fab28cefbcc00cedea8b7fb4c2da449e89
SSDEEP 768:4uLoZTUAoOSWUYZL8mo2qFym/9GgrOPIRzjbWgX3if6nyaDx9TembwBDZbx:4uLoZTUTn2Zm1b3R3bJXSf6yaDx6dbx
TLSH
T17A232A003BEC822BF2BE4F78ADE25105457AF2A76603D6491CC4529B5723FC69A426FD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

C2

sinhvien18.net:443
sinhvien18.net:80
sinhvien18.net:7797
sinhvien18.net:8707
sinhvien18.net:6620
www.sinhvien18.net:443
www.sinhvien18.net:80
www.sinhvien18.net:7797
www.sinhvien18.net:8707
www.sinhvien18.net:6620
blacklotus.sinhvien18.net:443
blacklotus.sinhvien18.net:80
blacklotus.sinhvien18.net:7797
blacklotus.sinhvien18.net:8707
blacklotus.sinhvien18.net:6620
sodinokibi.sinhvien18.net:443
sodinokibi.sinhvien18.net:80
sodinokibi.sinhvien18.net:7797
sodinokibi.sinhvien18.net:8707
sodinokibi.sinhvien18.net:6620
melissa.sinhvien18.net:443
melissa.sinhvien18.net:80
melissa.sinhvien18.net:7797
melissa.sinhvien18.net:8707
melissa.sinhvien18.net:6620

Mutex

fJGBLhKGW5xf

Attributes

delay
0
install
true
install_file
95q7g.exe
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral3/files/0x00180000000256cc-8.dat	family_asyncrat

Executes dropped EXE 2 IoCs

pid	Process
3640	95q7g.exe
3484	95q7g.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpoi85_2t0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	95q7g.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	95q7g.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
4160	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3252	schtasks.exe

Suspicious behavior: EnumeratesProcesses 19 IoCs

pid	Process
3880	tmpoi85_2t0.exe
3880	tmpoi85_2t0.exe
3880	tmpoi85_2t0.exe
3880	tmpoi85_2t0.exe
3880	tmpoi85_2t0.exe
3880	tmpoi85_2t0.exe
3880	tmpoi85_2t0.exe
3880	tmpoi85_2t0.exe
3880	tmpoi85_2t0.exe
3880	tmpoi85_2t0.exe
3880	tmpoi85_2t0.exe
3880	tmpoi85_2t0.exe
3880	tmpoi85_2t0.exe
3880	tmpoi85_2t0.exe
3880	tmpoi85_2t0.exe
3880	tmpoi85_2t0.exe
3880	tmpoi85_2t0.exe
3880	tmpoi85_2t0.exe
3880	tmpoi85_2t0.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3880	tmpoi85_2t0.exe
Token: SeDebugPrivilege	3640	95q7g.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3880 wrote to memory of 4036	3880	tmpoi85_2t0.exe	80
PID 3880 wrote to memory of 4480	3880	tmpoi85_2t0.exe	82
PID 4480 wrote to memory of 4160	4480	cmd.exe	84
PID 4036 wrote to memory of 3252	4036	cmd.exe	85
PID 4480 wrote to memory of 3484	4480	cmd.exe	88

C:\Users\Admin\AppData\Local\Temp\tmpoi85_2t0.exe
"C:\Users\Admin\AppData\Local\Temp\tmpoi85_2t0.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3880
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "95q7g" /tr '"C:\Users\Admin\AppData\Roaming\95q7g.exe"' & exit
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4036
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /f /sc onlogon /rl highest /tn "95q7g" /tr '"C:\Users\Admin\AppData\Roaming\95q7g.exe"'
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3252
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp38FD.tmp.bat""
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4480
- - C:\Windows\SysWOW64\timeout.exe
    timeout 3
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:4160
- - C:\Users\Admin\AppData\Roaming\95q7g.exe
    "C:\Users\Admin\AppData\Roaming\95q7g.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3484

C:\Users\Admin\AppData\Roaming\95q7g.exe
"C:\Users\Admin\AppData\Roaming\95q7g.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3640

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmp38FD.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmp38FD.tmp.bat
Size 149B
SHA256 ddc37faf6e6b595d44ba1b1ff9488ddb4acaaa21fc3296930687b3ea45cf10a2
MD5 a9105956541ba34751b5e16a43b50490
SHA1 fffd1e0f91f2241c702aadab4474a2825acba7d9
SHA512 d74dd4c40b4754977540a23a34782d866760e149990b9765c61ef7d322898822c7986434746d6a370858b121ea7b32fca77fa81ca828bc5a181cca5785c2f4d2
TLSH
T18BC02B4251C5FA4E2C091C3316FED49D9172AC193F40BB00C344410D36C0949F0E9342
MD5 SHA1 SHA512 TLSH

Submit Download

95q7g.exe

Path C:\Users\Admin\AppData\Roaming\95q7g.exe
Size 45KB
SHA256 2b1841db20ac02610ea456b4650d6a2d296c92d5e29132887c753e354c4fdbf8
MD5 977fbbb1b684a48e40c5f48a23d4fe11
SHA1 40623fe4507ab071bc17b243ad2ae4efad3b0927
SHA512 615ca3a91e2e7f00bbdc29fe6d29eefeb9df6567919f6d10bf47395585601e6351c5194ec220e99034d710af9a97b0fab28cefbcc00cedea8b7fb4c2da449e89
SSDEEP 768:4uLoZTUAoOSWUYZL8mo2qFym/9GgrOPIRzjbWgX3if6nyaDx9TembwBDZbx:4uLoZTUTn2Zm1b3R3bJXSf6yaDx6dbx
TLSH
T17A232A003BEC822BF2BE4F78ADE25105457AF2A76603D6491CC4529B5723FC69A426FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3880-0-0x0000000000870000-0x0000000000882000-memory.dmp

Download

memory/3880-1-0x0000000005330000-0x0000000005340000-memory.dmp

Download

memory/3880-2-0x0000000005340000-0x00000000053DC000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads