asyncrat | f158f171d6f244e4f2434b0370d6f26e9889a9527c3a371c21e19af1ce997295

General

Target
f158f171d6f244e4f2434b0370d6f26e9889a9527c3a371c21e19af1ce997295.exe
Size 42.7MB
Sample260602-xztrjset9q
SHA256 f158f171d6f244e4f2434b0370d6f26e9889a9527c3a371c21e19af1ce997295
MD5 48868e346579ecf0aa4b94bfcf7566d8
SHA1 e9cecc3bb3c751f9b80dd037fd5fcbf399dc0a3a
SHA512 ec92c8acfad46cf34733e8279fb7e18a86cfdf71b8449644d99465d152d8fb7311d131da0379d96adbfbf2e0e5a3bd0ef1a917135ab24c7e4c0f83c2bcaaf3a3
SSDEEP 786432:wyg3MC8D0/0P5gi8eYFytnsZCfNrWgEeFHbYj3wRRzXSl0rK/k:wZ78D0wgxexsiDlF7OwPLRrK/k
TLSH
T1ADA733F62B62C51CD6530BB72DA049FC5631AD729833FB122C69BA1EC2B1FC5B243195
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

null defense_evasion execution asyncrat persistence rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.6A

Botnet

null

C2

asbriljant.nl:80
asbriljant.nl:8080
asbriljant.nl:443
asbriljant.nl:8443
asbriljant.nl:22
asbriljant.nl:6607
asbriljant.nl:23
www.asbriljant.nl:80
www.asbriljant.nl:8080
www.asbriljant.nl:443
www.asbriljant.nl:8443
www.asbriljant.nl:22
www.asbriljant.nl:6607
www.asbriljant.nl:23

Mutex

lejkytfotaniitj

Attributes

delay
3
install
true
install_file
ChromeUpdate.exe
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Executes dropped EXE 2 IoCs

pid	Process
656	ChromeUpdate.exe
4072	ChromeUpdate.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
1084	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3352	schtasks.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
4452	f158f171d6f244e4f2434b0370d6f26e9889a9527c3a371c21e19af1ce997295.exe
4452	f158f171d6f244e4f2434b0370d6f26e9889a9527c3a371c21e19af1ce997295.exe
4452	f158f171d6f244e4f2434b0370d6f26e9889a9527c3a371c21e19af1ce997295.exe
4452	f158f171d6f244e4f2434b0370d6f26e9889a9527c3a371c21e19af1ce997295.exe
4452	f158f171d6f244e4f2434b0370d6f26e9889a9527c3a371c21e19af1ce997295.exe
4452	f158f171d6f244e4f2434b0370d6f26e9889a9527c3a371c21e19af1ce997295.exe
4452	f158f171d6f244e4f2434b0370d6f26e9889a9527c3a371c21e19af1ce997295.exe
4452	f158f171d6f244e4f2434b0370d6f26e9889a9527c3a371c21e19af1ce997295.exe
4452	f158f171d6f244e4f2434b0370d6f26e9889a9527c3a371c21e19af1ce997295.exe
4452	f158f171d6f244e4f2434b0370d6f26e9889a9527c3a371c21e19af1ce997295.exe
4452	f158f171d6f244e4f2434b0370d6f26e9889a9527c3a371c21e19af1ce997295.exe
4452	f158f171d6f244e4f2434b0370d6f26e9889a9527c3a371c21e19af1ce997295.exe
4452	f158f171d6f244e4f2434b0370d6f26e9889a9527c3a371c21e19af1ce997295.exe
4452	f158f171d6f244e4f2434b0370d6f26e9889a9527c3a371c21e19af1ce997295.exe
4452	f158f171d6f244e4f2434b0370d6f26e9889a9527c3a371c21e19af1ce997295.exe
4452	f158f171d6f244e4f2434b0370d6f26e9889a9527c3a371c21e19af1ce997295.exe
4452	f158f171d6f244e4f2434b0370d6f26e9889a9527c3a371c21e19af1ce997295.exe
4452	f158f171d6f244e4f2434b0370d6f26e9889a9527c3a371c21e19af1ce997295.exe
4452	f158f171d6f244e4f2434b0370d6f26e9889a9527c3a371c21e19af1ce997295.exe
656	ChromeUpdate.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4452	f158f171d6f244e4f2434b0370d6f26e9889a9527c3a371c21e19af1ce997295.exe
Token: SeDebugPrivilege	656	ChromeUpdate.exe
Token: SeDebugPrivilege	656	ChromeUpdate.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4452 wrote to memory of 3352	4452	f158f171d6f244e4f2434b0370d6f26e9889a9527c3a371c21e19af1ce997295.exe	85
PID 4452 wrote to memory of 1512	4452	f158f171d6f244e4f2434b0370d6f26e9889a9527c3a371c21e19af1ce997295.exe	87
PID 1512 wrote to memory of 1084	1512	cmd.exe	89
PID 1512 wrote to memory of 4072	1512	cmd.exe	92

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\f158f171d6f244e4f2434b0370d6f26e9889a9527c3a371c21e19af1ce997295.exe
"C:\Users\Admin\AppData\Local\Temp\f158f171d6f244e4f2434b0370d6f26e9889a9527c3a371c21e19af1ce997295.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4452
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "'ChromeUpdate"' /tr "'C:\Users\Admin\AppData\Roaming\ChromeUpdate.exe"'
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3352
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp9C4B.tmp.bat""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1512
- - C:\Windows\system32\timeout.exe
    timeout 3
    3⤵
    - Delays execution with timeout.exe
    PID:1084
- - C:\Users\Admin\AppData\Roaming\ChromeUpdate.exe
    "C:\Users\Admin\AppData\Roaming\ChromeUpdate.exe"
    3⤵
    - Executes dropped EXE
    PID:4072

C:\Users\Admin\AppData\Roaming\ChromeUpdate.exe
"C:\Users\Admin\AppData\Roaming\ChromeUpdate.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:656

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmp9C4B.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmp9C4B.tmp.bat
Size 156B
SHA256 506081d82019ce2930b986cfbfe6958c10b9421142e84a9c497a044b5330a148
MD5 45f32d9b584e13a5e616dbe0c2de20ce
SHA1 a838cdbb927df6264239a53c7d977496b55f4a87
SHA512 65a5b2ce7c3d0e95409504f9bbdbd4f8825ad78045f8e8eeef90c88e48e1392c75474a7461a8899d62b07d5132b334a1b45981d866b1490784cd920723b1fcc9
TLSH
T152C02B5272C5EE1E2A05642302FAD4CC95B26C5A3F48BF40C344441EA280848F4DE382
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4452-0-0x0000000000F20000-0x0000000000F96000-memory.dmp

Download

memory/4452-1-0x000000001D210000-0x000000001D220000-memory.dmp

Download

memory/4452-2-0x000000001D210000-0x000000001D220000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads