asyncrat | fed7452c6d43e76da0efdfcdb4a3dfd5f6d1e416d38455ff58a8e0bf8d25391d

General

Target
tngan.exe
Size 450KB
Sample260602-mn12daa16z
SHA256 fed7452c6d43e76da0efdfcdb4a3dfd5f6d1e416d38455ff58a8e0bf8d25391d
MD5 1a95f5de010d5e8f30ce12e205e706c4
SHA1 ce5770ca363b1988becae962888685a2a9c928cc
SHA512 7e7ab916486e3d7e91025717788fca9010929cd7161a0e6c46a1928117d9b87c8078c61dbd7da302434442e09d79123159c23f5c18c0288f6a32a7c902316a37
SSDEEP 1536:iOxatcdohCbkB9aY1vh16OyVQP2Y962Jr3tzDXesmVcl:iEdohCbGQ6h1OPQbJr3tnus8Y
TLSH
T16EA46EF267D6C26CE1BB0B77596651FC427ABD322436D2093C88725F4A32FC6B523462
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

null defense_evasion execution asyncrat persistence rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.6A

Botnet

null

C2

asbriljant.nl:80
asbriljant.nl:8080
asbriljant.nl:443
asbriljant.nl:8443
asbriljant.nl:22
asbriljant.nl:6607
asbriljant.nl:23
www.asbriljant.nl:80
www.asbriljant.nl:8080
www.asbriljant.nl:443
www.asbriljant.nl:8443
www.asbriljant.nl:22
www.asbriljant.nl:6607
www.asbriljant.nl:23

Mutex

lejkytfotaniitj

Attributes

delay
3
install
true
install_file
ChromeUpdate.exe
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Executes dropped EXE 2 IoCs

pid	Process
3228	ChromeUpdate.exe
2576	ChromeUpdate.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
3276	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4768	schtasks.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
2560	tngan.exe
2560	tngan.exe
2560	tngan.exe
2560	tngan.exe
2560	tngan.exe
2560	tngan.exe
2560	tngan.exe
2560	tngan.exe
2560	tngan.exe
2560	tngan.exe
2560	tngan.exe
2560	tngan.exe
2560	tngan.exe
2560	tngan.exe
2560	tngan.exe
2560	tngan.exe
2560	tngan.exe
2560	tngan.exe
2560	tngan.exe
3228	ChromeUpdate.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2560	tngan.exe
Token: SeDebugPrivilege	3228	ChromeUpdate.exe
Token: SeDebugPrivilege	3228	ChromeUpdate.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2560 wrote to memory of 4768	2560	tngan.exe	81
PID 2560 wrote to memory of 1684	2560	tngan.exe	83
PID 1684 wrote to memory of 3276	1684	cmd.exe	85
PID 1684 wrote to memory of 2576	1684	cmd.exe	88

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\tngan.exe
"C:\Users\Admin\AppData\Local\Temp\tngan.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2560
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "'ChromeUpdate"' /tr "'C:\Users\Admin\AppData\Roaming\ChromeUpdate.exe"'
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4768
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp3FE2.tmp.bat""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1684
- - C:\Windows\system32\timeout.exe
    timeout 3
    3⤵
    - Delays execution with timeout.exe
    PID:3276
- - C:\Users\Admin\AppData\Roaming\ChromeUpdate.exe
    "C:\Users\Admin\AppData\Roaming\ChromeUpdate.exe"
    3⤵
    - Executes dropped EXE
    PID:2576

C:\Users\Admin\AppData\Roaming\ChromeUpdate.exe
"C:\Users\Admin\AppData\Roaming\ChromeUpdate.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3228

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmp3FE2.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmp3FE2.tmp.bat
Size 156B
SHA256 199fee1d655c1fc8bcf553ec4572ff88b4b06ff1b530a40a76eb3628b456c8fc
MD5 b02f0d0c81d25fcb6619dedc09a5d97b
SHA1 0f2ab13c4a5647d2c9ffddb055b1e86f288bd470
SHA512 aaa0ffe33ddd8f7ac4a855a2de3f985ef8c156900b78d463154b1852435c2804b3e8ea7505935776eed137750705739dcd45a1ec29bde2bf2e6d1614b2279e6c
TLSH
T199C02B8261C9EF2F2C05741306FAD4CC95B66C9A3F48BF00C304440E7280C48F4DD382
MD5 SHA1 SHA512 TLSH

Submit Download

ChromeUpdate.exe

Path C:\Users\Admin\AppData\Roaming\ChromeUpdate.exe
Size 45.1MB
SHA256 5cbb6ab00d6eb68266d99dfcece0bdf217bbbc26d124d780cd9dd02fa5e0ddad
MD5 12477f51f6bae552045d163e898b58a1
SHA1 caed76fc7699fecdba77b15c5438147a20037523
SHA512 c30bf9a49b0fe5a49da6f5ca5f2f76631851569152c86c572f5bffd2949e679becc06528d38996eca28a1d95c93746a9cf16d85450d8702755a66532bd0046c0
SSDEEP 786432:krVEadz8zlcJd804ZBNlDIXsy6KugLOTuvkLUd4FVDSLO0XE/eArFbNT2O2IyK9p:8ozlE8Pf8+QO6vkLPD50XbAxwOz0/4XX
TLSH
T188A733F20378E65CD117AB3B9E1611FE82787D365A70D2A1CC88396E4532FDB3867489
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2560-0-0x0000000000990000-0x0000000000A06000-memory.dmp

Download

memory/2560-1-0x0000000002B00000-0x0000000002B10000-memory.dmp

Download

memory/2560-2-0x0000000002B00000-0x0000000002B10000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads