asyncrat | fed7452c6d43e76da0efdfcdb4a3dfd5f6d1e416d38455ff58a8e0bf8d25391d

General

Target
tngan.exe
Size 450KB
Sample260602-mps26act5p
SHA256 fed7452c6d43e76da0efdfcdb4a3dfd5f6d1e416d38455ff58a8e0bf8d25391d
MD5 1a95f5de010d5e8f30ce12e205e706c4
SHA1 ce5770ca363b1988becae962888685a2a9c928cc
SHA512 7e7ab916486e3d7e91025717788fca9010929cd7161a0e6c46a1928117d9b87c8078c61dbd7da302434442e09d79123159c23f5c18c0288f6a32a7c902316a37
SSDEEP 1536:iOxatcdohCbkB9aY1vh16OyVQP2Y962Jr3tzDXesmVcl:iEdohCbGQ6h1OPQbJr3tnus8Y
TLSH
T16EA46EF267D6C26CE1BB0B77596651FC427ABD322436D2093C88725F4A32FC6B523462
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

null defense_evasion execution asyncrat persistence rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.6A

Botnet

null

C2

asbriljant.nl:80
asbriljant.nl:8080
asbriljant.nl:443
asbriljant.nl:8443
asbriljant.nl:22
asbriljant.nl:6607
asbriljant.nl:23
www.asbriljant.nl:80
www.asbriljant.nl:8080
www.asbriljant.nl:443
www.asbriljant.nl:8443
www.asbriljant.nl:22
www.asbriljant.nl:6607
www.asbriljant.nl:23

Mutex

lejkytfotaniitj

Attributes

delay
3
install
true
install_file
ChromeUpdate.exe
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Executes dropped EXE 2 IoCs

pid	Process
2524	ChromeUpdate.exe
232	ChromeUpdate.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
2392	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5060	schtasks.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
4316	tngan.exe
4316	tngan.exe
4316	tngan.exe
4316	tngan.exe
4316	tngan.exe
4316	tngan.exe
4316	tngan.exe
4316	tngan.exe
4316	tngan.exe
4316	tngan.exe
4316	tngan.exe
4316	tngan.exe
4316	tngan.exe
4316	tngan.exe
4316	tngan.exe
4316	tngan.exe
4316	tngan.exe
4316	tngan.exe
4316	tngan.exe
2524	ChromeUpdate.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4316	tngan.exe
Token: SeDebugPrivilege	2524	ChromeUpdate.exe
Token: SeDebugPrivilege	2524	ChromeUpdate.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4316 wrote to memory of 5060	4316	tngan.exe	85
PID 4316 wrote to memory of 4672	4316	tngan.exe	87
PID 4672 wrote to memory of 2392	4672	cmd.exe	89
PID 4672 wrote to memory of 232	4672	cmd.exe	92

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\tngan.exe
"C:\Users\Admin\AppData\Local\Temp\tngan.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4316
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "'ChromeUpdate"' /tr "'C:\Users\Admin\AppData\Roaming\ChromeUpdate.exe"'
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5060
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp93A0.tmp.bat""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4672
- - C:\Windows\system32\timeout.exe
    timeout 3
    3⤵
    - Delays execution with timeout.exe
    PID:2392
- - C:\Users\Admin\AppData\Roaming\ChromeUpdate.exe
    "C:\Users\Admin\AppData\Roaming\ChromeUpdate.exe"
    3⤵
    - Executes dropped EXE
    PID:232

C:\Users\Admin\AppData\Roaming\ChromeUpdate.exe
"C:\Users\Admin\AppData\Roaming\ChromeUpdate.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2524

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmp93A0.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmp93A0.tmp.bat
Size 156B
SHA256 058a81315efa01516db6ace9577ba4d51764030e526a9f6af0f35bea18796b29
MD5 d33cd676b2e629063642b3f122fd7def
SHA1 bc11f1e1701b8985b99993181a93e950cff38b02
SHA512 2bbe2338cd3b36ab8b92abf76d18dc0935e092ded197b4f36613e567eab06b41ae9943973ec42f59221d21748ed71e4cd78f30fec458cf8fe6d06ab8eefb3f8c
TLSH
T184C02B5251C6EE1E6805641702FAD4CC95B26C6A3F48BF00D304480E6280C48F4DD3C2
MD5 SHA1 SHA512 TLSH

Submit Download

ChromeUpdate.exe

Path C:\Users\Admin\AppData\Roaming\ChromeUpdate.exe
Size 42.1MB
SHA256 b76d3e75d72b932e04a3c7ef297ae7cf304486c3f42d50ece9ffd9de9910ec67
MD5 c969bb4db0a83fed4c3b2cc7015653bb
SHA1 8de4b2e321cf6d9efbd06046de3c170049af5c89
SHA512 e004127e3ab2038c4ead1345f88474bc99dccb64efbadd94261e836f819c009ab2f867be6ad3d40af4236de3554f3f5d155e9f078f244c6ac54232bcc42199e0
SSDEEP 786432:LZoSSIBeDKwr+Q1HP5KPn5J/PZManklu3MrnY4AZvuH2a/JBHDyimrnpL/qz3Jm:lcHr+Q1v2XPZMa0zY4ARqjy1pu3Jm
TLSH
T1DBA733F25B51D11EE01313F3292A49FCA9726D39AE76C119FC26B25E2C38FE4758B481
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4316-0-0x00000000007A0000-0x0000000000816000-memory.dmp

Download

memory/4316-1-0x0000000001150000-0x0000000001160000-memory.dmp

Download

memory/4316-2-0x0000000001150000-0x0000000001160000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads