asyncrat | 6770594bb589a813492fa535aa766a3cfbea84fd34a5b1c5cbb19530e99189d9

General

Target
6770594bb589a813492fa535aa766a3cfbea84fd34a5b1c5cbb19530e99189d9.exe
Size 45KB
Sample260803-l61b5afg86
SHA256 6770594bb589a813492fa535aa766a3cfbea84fd34a5b1c5cbb19530e99189d9
MD5 0d0c12281c237f3aefe1bc2a7f8513be
SHA1 68fefc7bbe055eb27e1cb4d9a04b8991f9675c9b
SHA512 b3a195e18e3df97b7b103ff02b6ba06e9249e16c3620849414d91bf7145e3bc493d6871307cc87eb1b17f878231dcc7a3adf78388b7baa90d9e0d97cf47e70b8
SSDEEP 768:5udApTNctooWUS7C+mo2qtbx1HJhOPIcozjbPgO3iEfJTA9Dw1Ky9NwwhsdJcBD:5udApTNmU2cFj3co3b4OSU1KYwMd0x
TLSH
T1D5231B0037E8822BF2BE4F78ACF26145867AF6673603D58E1CC451DB5613FC69642AED
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

default command_and_control defense_evasion discovery execution asyncrat persistence rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

C2

haysexcdn.net:80
haysexcdn.net:22
haysexcdn.net:8080
haysexcdn.net:8880
haysexcdn.net:2052
haysexcdn.net:2082
haysexcdn.net:2086
haysexcdn.net:2095
haysexcdn.net:443
haysexcdn.net:2053
haysexcdn.net:2083
haysexcdn.net:2087
haysexcdn.net:2096
haysexcdn.net:8443
www.haysexcdn.net:80
www.haysexcdn.net:22
www.haysexcdn.net:8080
www.haysexcdn.net:8880
www.haysexcdn.net:2052
www.haysexcdn.net:2082
www.haysexcdn.net:2086
www.haysexcdn.net:2095
www.haysexcdn.net:443
www.haysexcdn.net:2053
www.haysexcdn.net:2083
www.haysexcdn.net:2087
www.haysexcdn.net:2096
www.haysexcdn.net:8443
trickbot.haysexcdn.net:80
trickbot.haysexcdn.net:22
trickbot.haysexcdn.net:8080
trickbot.haysexcdn.net:8880
trickbot.haysexcdn.net:2052
trickbot.haysexcdn.net:2082
trickbot.haysexcdn.net:2086
trickbot.haysexcdn.net:2095
trickbot.haysexcdn.net:443
trickbot.haysexcdn.net:2053
trickbot.haysexcdn.net:2083
trickbot.haysexcdn.net:2087
trickbot.haysexcdn.net:2096
trickbot.haysexcdn.net:8443
darkside.haysexcdn.net:80
darkside.haysexcdn.net:22
darkside.haysexcdn.net:8080
darkside.haysexcdn.net:8880
darkside.haysexcdn.net:2052
darkside.haysexcdn.net:2082
darkside.haysexcdn.net:2086
darkside.haysexcdn.net:2095
darkside.haysexcdn.net:443
darkside.haysexcdn.net:2053
darkside.haysexcdn.net:2083
darkside.haysexcdn.net:2087
darkside.haysexcdn.net:2096
darkside.haysexcdn.net:8443

Mutex

ADBjM6xvBziS

Attributes

delay
0
install
true
install_file
ez2p2n.exe
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 2 IoCs

rat

resource	yara_rule
behavioral1/files/0x000800000002447a-8.dat	family_asyncrat
behavioral1/memory/1716-10-0x0000000005510000-0x0000000005520000-memory.dmp	family_asyncrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation	6770594bb589a813492fa535aa766a3cfbea84fd34a5b1c5cbb19530e99189d9.exe

Executes dropped EXE 2 IoCs

pid	Process
1716	ez2p2n.exe
1028	ez2p2n.exe

Outbound SSH connection to public host 2 TTPs 3 IoCs

SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

command_and_control

Protocol Tunneling

T1572

Network Service Discovery

T1046

description	flow	ioc	pid	Process
SSH destination	19	172.67.73.19:22	1716	ez2p2n.exe
SSH destination	36	104.26.4.211:22	1716	ez2p2n.exe
SSH destination	42	104.26.5.211:22	1716	ez2p2n.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5036	cmd.exe
3720	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ez2p2n.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6770594bb589a813492fa535aa766a3cfbea84fd34a5b1c5cbb19530e99189d9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ez2p2n.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
4708	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3416	schtasks.exe

Suspicious behavior: EnumeratesProcesses 23 IoCs

pid	Process
2728	6770594bb589a813492fa535aa766a3cfbea84fd34a5b1c5cbb19530e99189d9.exe
2728	6770594bb589a813492fa535aa766a3cfbea84fd34a5b1c5cbb19530e99189d9.exe
2728	6770594bb589a813492fa535aa766a3cfbea84fd34a5b1c5cbb19530e99189d9.exe
2728	6770594bb589a813492fa535aa766a3cfbea84fd34a5b1c5cbb19530e99189d9.exe
2728	6770594bb589a813492fa535aa766a3cfbea84fd34a5b1c5cbb19530e99189d9.exe
2728	6770594bb589a813492fa535aa766a3cfbea84fd34a5b1c5cbb19530e99189d9.exe
2728	6770594bb589a813492fa535aa766a3cfbea84fd34a5b1c5cbb19530e99189d9.exe
2728	6770594bb589a813492fa535aa766a3cfbea84fd34a5b1c5cbb19530e99189d9.exe
2728	6770594bb589a813492fa535aa766a3cfbea84fd34a5b1c5cbb19530e99189d9.exe
2728	6770594bb589a813492fa535aa766a3cfbea84fd34a5b1c5cbb19530e99189d9.exe
2728	6770594bb589a813492fa535aa766a3cfbea84fd34a5b1c5cbb19530e99189d9.exe
2728	6770594bb589a813492fa535aa766a3cfbea84fd34a5b1c5cbb19530e99189d9.exe
2728	6770594bb589a813492fa535aa766a3cfbea84fd34a5b1c5cbb19530e99189d9.exe
2728	6770594bb589a813492fa535aa766a3cfbea84fd34a5b1c5cbb19530e99189d9.exe
2728	6770594bb589a813492fa535aa766a3cfbea84fd34a5b1c5cbb19530e99189d9.exe
2728	6770594bb589a813492fa535aa766a3cfbea84fd34a5b1c5cbb19530e99189d9.exe
2728	6770594bb589a813492fa535aa766a3cfbea84fd34a5b1c5cbb19530e99189d9.exe
2728	6770594bb589a813492fa535aa766a3cfbea84fd34a5b1c5cbb19530e99189d9.exe
2728	6770594bb589a813492fa535aa766a3cfbea84fd34a5b1c5cbb19530e99189d9.exe
2728	6770594bb589a813492fa535aa766a3cfbea84fd34a5b1c5cbb19530e99189d9.exe
2728	6770594bb589a813492fa535aa766a3cfbea84fd34a5b1c5cbb19530e99189d9.exe
2728	6770594bb589a813492fa535aa766a3cfbea84fd34a5b1c5cbb19530e99189d9.exe
2728	6770594bb589a813492fa535aa766a3cfbea84fd34a5b1c5cbb19530e99189d9.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2728	6770594bb589a813492fa535aa766a3cfbea84fd34a5b1c5cbb19530e99189d9.exe
Token: SeDebugPrivilege	1716	ez2p2n.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2728 wrote to memory of 5036	2728	6770594bb589a813492fa535aa766a3cfbea84fd34a5b1c5cbb19530e99189d9.exe	86
PID 2728 wrote to memory of 3720	2728	6770594bb589a813492fa535aa766a3cfbea84fd34a5b1c5cbb19530e99189d9.exe	88
PID 3720 wrote to memory of 4708	3720	cmd.exe	90
PID 5036 wrote to memory of 3416	5036	cmd.exe	91
PID 3720 wrote to memory of 1028	3720	cmd.exe	94

C:\Users\Admin\AppData\Local\Temp\6770594bb589a813492fa535aa766a3cfbea84fd34a5b1c5cbb19530e99189d9.exe
"C:\Users\Admin\AppData\Local\Temp\6770594bb589a813492fa535aa766a3cfbea84fd34a5b1c5cbb19530e99189d9.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2728
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "ez2p2n" /tr '"C:\Users\Admin\AppData\Roaming\ez2p2n.exe"' & exit
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5036
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /f /sc onlogon /rl highest /tn "ez2p2n" /tr '"C:\Users\Admin\AppData\Roaming\ez2p2n.exe"'
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3416
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp5946.tmp.bat""
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3720
- - C:\Windows\SysWOW64\timeout.exe
    timeout 3
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:4708
- - C:\Users\Admin\AppData\Roaming\ez2p2n.exe
    "C:\Users\Admin\AppData\Roaming\ez2p2n.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1028

C:\Users\Admin\AppData\Roaming\ez2p2n.exe
"C:\Users\Admin\AppData\Roaming\ez2p2n.exe"
1⤵
- Executes dropped EXE
- Outbound SSH connection to public host
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1716

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Discovery

Network Service Discovery

Query Registry

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Protocol Tunneling

1

T1572

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmp5946.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmp5946.tmp.bat
Size 150B
SHA256 db53e30cd0136c68b22f2c5e5a868913f3a25d2fa21e5a4fb9dbc1c4654925bf
MD5 97d0763a4a3988c3b107f3a4973d04e2
SHA1 e27fc8dbaefc89b933c954b63461ea3b894690e4
SHA512 32c5448c55c8b13a061fbf8597a2d6bb6a857f0449d3ab66112613f4084a2b5749bb85843b86fdac263e0bf6f94a31c120137ff0f98667fe6b1c4248d6b45367
TLSH
T1C4C02B82B5C9EA4F3805147312FAD98CA1B6AC1A3F40FB00C705841F12C084CF0D93C1
MD5 SHA1 SHA512 TLSH

Submit Download

ez2p2n.exe

Path C:\Users\Admin\AppData\Roaming\ez2p2n.exe
Size 45KB
SHA256 6770594bb589a813492fa535aa766a3cfbea84fd34a5b1c5cbb19530e99189d9
MD5 0d0c12281c237f3aefe1bc2a7f8513be
SHA1 68fefc7bbe055eb27e1cb4d9a04b8991f9675c9b
SHA512 b3a195e18e3df97b7b103ff02b6ba06e9249e16c3620849414d91bf7145e3bc493d6871307cc87eb1b17f878231dcc7a3adf78388b7baa90d9e0d97cf47e70b8
SSDEEP 768:5udApTNctooWUS7C+mo2qtbx1HJhOPIcozjbPgO3iEfJTA9Dw1Ky9NwwhsdJcBD:5udApTNmU2cFj3co3b4OSU1KYwMd0x
TLSH
T1D5231B0037E8822BF2BE4F78ACF26145867AF6673603D58E1CC451DB5613FC69642AED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1716-10-0x0000000005510000-0x0000000005520000-memory.dmp

Download

memory/1716-13-0x0000000005510000-0x0000000005520000-memory.dmp

Download

memory/2728-0-0x0000000000B80000-0x0000000000B92000-memory.dmp

Download

memory/2728-1-0x0000000005520000-0x0000000005530000-memory.dmp

Download

memory/2728-2-0x0000000005530000-0x00000000055CC000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads