asyncrat | ef365c6e229664621c1d1bb560c247183843f75a1041ae9538bc93db685437c8

General

Target
sex-to-name-silo.exe
Size 48KB
Sample260604-jer6bsa16x
SHA256 ef365c6e229664621c1d1bb560c247183843f75a1041ae9538bc93db685437c8
MD5 db19d3403ac5dff61bb12e491f13052c
SHA1 0d177ba78c3fa7cd719374139cefcdd819b87d2b
SHA512 8b439392c3cf08ac04c49e2ec5a6bf1109c674f32ede34cda41d1bf28d6eb51c72c025c95c4ebd2525f38b3d10fef3f98ffc562667826cb6cdd7190458073caa
SSDEEP 1536:4ui4OTQriY2K0u6JPMNHoblbkha22dLHdhp:4ui7TQ2Y2K0u6tMNHoblbkdSnp
TLSH
T175231B003BEDC127F2BE5F74A9F2224546BAF6673603D54E1CC441971613FC69A42AFA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

C2

sextop1.cl:6606
sextop1.cl:7707
sextop1.cl:8808
sextop1.cl:443
sextop1.cl:80
sextop1.cl:8080
sextop1.cool:6606
sextop1.cool:7707
sextop1.cool:8808
sextop1.cool:443
sextop1.cool:80
sextop1.cool:8080
sextop1.net:6606
sextop1.net:7707
sextop1.net:8808
sextop1.net:443
sextop1.net:80
sextop1.net:8080
Sextop1.work:6606
Sextop1.work:7707
Sextop1.work:8808
Sextop1.work:443
Sextop1.work:80
Sextop1.work:8080
sextop1.blue:6606
sextop1.blue:7707
sextop1.blue:8808
sextop1.blue:443
sextop1.blue:80
sextop1.blue:8080
sextop1.moe:6606
sextop1.moe:7707
sextop1.moe:8808
sextop1.moe:443
sextop1.moe:80
sextop1.moe:8080
sextop1.sale:6606
sextop1.sale:7707
sextop1.sale:8808
sextop1.sale:443
sextop1.sale:80
sextop1.sale:8080
sextop1.ing:6606
sextop1.ing:7707
sextop1.ing:8808
sextop1.ing:443
sextop1.ing:80
sextop1.ing:8080
sextop1.cab:6606
sextop1.cab:7707
sextop1.cab:8808
sextop1.cab:443
sextop1.cab:80
sextop1.cab:8080
sextop1.moi:6606
sextop1.moi:7707
sextop1.moi:8808
sextop1.moi:443
sextop1.moi:80
sextop1.moi:8080
sextop1.bid:6606
sextop1.bid:7707
sextop1.bid:8808
sextop1.bid:443
sextop1.bid:80
sextop1.bid:8080
sextop1.dad:6606
sextop1.dad:7707
sextop1.dad:8808
sextop1.dad:443
sextop1.dad:80
sextop1.dad:8080
sextop1.skin:6606
sextop1.skin:7707
sextop1.skin:8808
sextop1.skin:443
sextop1.skin:80
sextop1.skin:8080
sextop1.dance:6606
sextop1.dance:7707
sextop1.dance:8808
sextop1.dance:443
sextop1.dance:80
sextop1.dance:8080

Mutex

aQRAwyqrqBjE

Attributes

delay
3
install
true
install_file
sex-to-name-silo.exe
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral2/files/0x001a00000002b49d-9.dat	family_asyncrat

Executes dropped EXE 2 IoCs

pid	Process
3736	sex-to-name-silo.exe
4116	sex-to-name-silo.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sex-to-name-silo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sex-to-name-silo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sex-to-name-silo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
2568	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5796	schtasks.exe

Suspicious behavior: EnumeratesProcesses 19 IoCs

pid	Process
5012	sex-to-name-silo.exe
5012	sex-to-name-silo.exe
5012	sex-to-name-silo.exe
5012	sex-to-name-silo.exe
5012	sex-to-name-silo.exe
5012	sex-to-name-silo.exe
5012	sex-to-name-silo.exe
5012	sex-to-name-silo.exe
5012	sex-to-name-silo.exe
5012	sex-to-name-silo.exe
5012	sex-to-name-silo.exe
5012	sex-to-name-silo.exe
5012	sex-to-name-silo.exe
5012	sex-to-name-silo.exe
5012	sex-to-name-silo.exe
5012	sex-to-name-silo.exe
5012	sex-to-name-silo.exe
5012	sex-to-name-silo.exe
5012	sex-to-name-silo.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	5012	sex-to-name-silo.exe
Token: SeDebugPrivilege	3736	sex-to-name-silo.exe
Token: SeDebugPrivilege	3736	sex-to-name-silo.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 5012 wrote to memory of 948	5012	sex-to-name-silo.exe	81
PID 5012 wrote to memory of 2936	5012	sex-to-name-silo.exe	83
PID 2936 wrote to memory of 2568	2936	cmd.exe	85
PID 948 wrote to memory of 5796	948	cmd.exe	86
PID 2936 wrote to memory of 4116	2936	cmd.exe	89

C:\Users\Admin\AppData\Local\Temp\sex-to-name-silo.exe
"C:\Users\Admin\AppData\Local\Temp\sex-to-name-silo.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5012
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "sex-to-name-silo" /tr '"C:\Users\Admin\AppData\Roaming\sex-to-name-silo.exe"' & exit
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:948
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /f /sc onlogon /rl highest /tn "sex-to-name-silo" /tr '"C:\Users\Admin\AppData\Roaming\sex-to-name-silo.exe"'
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5796
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp3989.tmp.bat""
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2936
- - C:\Windows\SysWOW64\timeout.exe
    timeout 3
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:2568
- - C:\Users\Admin\AppData\Roaming\sex-to-name-silo.exe
    "C:\Users\Admin\AppData\Roaming\sex-to-name-silo.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4116

C:\Users\Admin\AppData\Roaming\sex-to-name-silo.exe
"C:\Users\Admin\AppData\Roaming\sex-to-name-silo.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3736

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

sex-to-name-silo.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\sex-to-name-silo.exe.log
Size 614B
SHA256 93e03593374ce40bc5d4c57832ebe96d3a6a532766eb6385f568a0383b426d10
MD5 fece27917067365b631bc648c66fe066
SHA1 f12c84b1c2b1296091ee06e8654c7065d22cbb44
SHA512 9b502a6d46b82ccc2c8aff650de664299f0131a82480eb9cec701546e9cd7f1647c0665014035c19da80a6cab267cf896645af827ecdd95287a70994c1ecb662
TLSH
T10BF046303231B1D84D123F52181C6A8952EF0786BBB8DF6C7690631EDC36057AB222E3
MD5 SHA1 SHA512 TLSH

Submit Download

tmp3989.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmp3989.tmp.bat
Size 160B
SHA256 273f5159588e7bc53fc9d0624991bdce85ed0063f3b3ed28f28d63ac7a05e761
MD5 61c3e3e206923b48b707b72522cbcfb4
SHA1 ff5fe4264153458d582b628b3cf24cf8a24f0412
SHA512 394eeee95fe57886d635f6b7620a22f5982b3eeba7c2e0814cda51083de25a74fbd496646ad05129b52041d13ba748a398ff66045b0b77b30e906fc469631862
TLSH
T182C08C4351C6EA1E2809245306FA988F9266BD593F40BB00C704445E778085EE8D9349
MD5 SHA1 SHA512 TLSH

Submit Download

sex-to-name-silo.exe

Path C:\Users\Admin\AppData\Roaming\sex-to-name-silo.exe
Size 48KB
SHA256 ef365c6e229664621c1d1bb560c247183843f75a1041ae9538bc93db685437c8
MD5 db19d3403ac5dff61bb12e491f13052c
SHA1 0d177ba78c3fa7cd719374139cefcdd819b87d2b
SHA512 8b439392c3cf08ac04c49e2ec5a6bf1109c674f32ede34cda41d1bf28d6eb51c72c025c95c4ebd2525f38b3d10fef3f98ffc562667826cb6cdd7190458073caa
SSDEEP 1536:4ui4OTQriY2K0u6JPMNHoblbkha22dLHdhp:4ui7TQ2Y2K0u6tMNHoblbkdSnp
TLSH
T175231B003BEDC127F2BE5F74A9F2224546BAF6673603D54E1CC441971613FC69A42AFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5012-0-0x0000000000E40000-0x0000000000E52000-memory.dmp

Download

memory/5012-1-0x0000000005850000-0x0000000005860000-memory.dmp

Download

memory/5012-2-0x00000000058D0000-0x0000000005936000-memory.dmp

Download

memory/5012-3-0x0000000005D60000-0x0000000005DFC000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads