asyncrat | 9d632d94f5674748532fca6bfa2856912e73d3e1b63f3e30382ee047994ae485

General

Target
9d632d94f5674748532fca6bfa2856912e73d3e1b63f3e30382ee047994ae485.exe
Size 45KB
Sample260804-yzg87adn5t
SHA256 9d632d94f5674748532fca6bfa2856912e73d3e1b63f3e30382ee047994ae485
MD5 969a179bf6947924959de8d9aa2b2bd7
SHA1 eac85ad85ffa85374a1f7c04e9cafe0fec5a8ab4
SHA512 f86acaed65b2d503d1a29724f1bf51e4ab639951682adfc8f0058ec1db8ef518d49332630d0e62aff501883e9f7a7bba36b6b3d2af867d060e6d06b2fbd89af3
SSDEEP 768:wuZ8pT1Uu4/cWUeT66mo2q1GcP0pycvHPIjzjbQgX3i2X7MKrJ1AJ/t7YuWiBDZO:wuZ8pT1tc2FccMcvgj3bXXS2LMIA6uP8
TLSH
T1B2232A0037E9823BF2BE5F7898F261854A7AF2633603D9491CC451DB5723BC69A426FD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

default command_and_control defense_evasion discovery execution asyncrat persistence rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

C2

glagbo.com:80
glagbo.com:22
glagbo.com:8080
glagbo.com:8880
glagbo.com:2052
glagbo.com:2082
glagbo.com:2086
glagbo.com:2095
glagbo.com:443
glagbo.com:2053
glagbo.com:2083
glagbo.com:2087
glagbo.com:2096
glagbo.com:8443
www.glagbo.com:80
www.glagbo.com:22
www.glagbo.com:8080
www.glagbo.com:8880
www.glagbo.com:2052
www.glagbo.com:2082
www.glagbo.com:2086
www.glagbo.com:2095
www.glagbo.com:443
www.glagbo.com:2053
www.glagbo.com:2083
www.glagbo.com:2087
www.glagbo.com:2096
www.glagbo.com:8443
sobig.glagbo.com:80
sobig.glagbo.com:22
sobig.glagbo.com:8080
sobig.glagbo.com:8880
sobig.glagbo.com:2052
sobig.glagbo.com:2082
sobig.glagbo.com:2086
sobig.glagbo.com:2095
sobig.glagbo.com:443
sobig.glagbo.com:2053
sobig.glagbo.com:2083
sobig.glagbo.com:2087
sobig.glagbo.com:2096
sobig.glagbo.com:8443
clop.glagbo.com:80
clop.glagbo.com:22
clop.glagbo.com:8080
clop.glagbo.com:8880
clop.glagbo.com:2052
clop.glagbo.com:2082
clop.glagbo.com:2086
clop.glagbo.com:2095
clop.glagbo.com:443
clop.glagbo.com:2053
clop.glagbo.com:2083
clop.glagbo.com:2087
clop.glagbo.com:2096
clop.glagbo.com:8443
malware.glagbo.com:80
malware.glagbo.com:22
malware.glagbo.com:8080
malware.glagbo.com:8880
malware.glagbo.com:2052
malware.glagbo.com:2082
malware.glagbo.com:2086
malware.glagbo.com:2095
malware.glagbo.com:443
malware.glagbo.com:2053
malware.glagbo.com:2083
malware.glagbo.com:2087
malware.glagbo.com:2096
malware.glagbo.com:8443

Mutex

mi2X4QYLu72X

Attributes

delay
0
install
true
install_file
8wcz.exe
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral2/files/0x000e00000001c500-10.dat	family_asyncrat

Outbound SSH connection to public host 2 TTPs 3 IoCs

SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

command_and_control

Protocol Tunneling

T1572

Network Service Discovery

T1046

description	flow	ioc
SSH destination	8	172.67.71.120:22
SSH destination	10	104.26.8.174:22
SSH destination	12	104.26.9.174:22

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2164	cmd.exe
2512	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9d632d94f5674748532fca6bfa2856912e73d3e1b63f3e30382ee047994ae485.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
4928	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4912	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\9d632d94f5674748532fca6bfa2856912e73d3e1b63f3e30382ee047994ae485.exe
"C:\Users\Admin\AppData\Local\Temp\9d632d94f5674748532fca6bfa2856912e73d3e1b63f3e30382ee047994ae485.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1448
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "8wcz" /tr '"C:\Users\Admin\AppData\Roaming\8wcz.exe"' & exit
  2⤵
  - Executes a command shell one-liner
  PID:2164
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /f /sc onlogon /rl highest /tn "8wcz" /tr '"C:\Users\Admin\AppData\Roaming\8wcz.exe"'
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4912
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp4A6D.tmp.bat""
  2⤵
  - Executes a command shell one-liner
  PID:2512
- - C:\Windows\SysWOW64\timeout.exe
    timeout 3
    3⤵
    - Delays execution with timeout.exe
    PID:4928
- - C:\Users\Admin\AppData\Roaming\8wcz.exe
    "C:\Users\Admin\AppData\Roaming\8wcz.exe"
    3⤵
    PID:5252

C:\Users\Admin\AppData\Roaming\8wcz.exe
"C:\Users\Admin\AppData\Roaming\8wcz.exe"
1⤵
PID:3904

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Discovery

Network Service Discovery

1

T1046

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Protocol Tunneling

1

T1572

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmp4A6D.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmp4A6D.tmp.bat
Size 148B
SHA256 81cb80e716dbe2413523effd78bd43b412cca1700f95dab560a2f131a82435f0
MD5 861dd9f1d85d9823f3061469c3432720
SHA1 67dfc5a696183c296a9fbf3dae2b72a455102f04
SHA512 226486345718e83ca1748dbf0e6242200d8c08f5f173645f14932e66a0fb7c4bd2f42475f8466200bffffeec4bc0655493ff37dbd5f5634126f08f81e7540f35
TLSH
T1CEC02B4251C5EE5E3805642306FBD48DE3726C193F44BB00C304C48D138044CF0D9341
MD5 SHA1 SHA512 TLSH

Submit Download

8wcz.exe

Path C:\Users\Admin\AppData\Roaming\8wcz.exe
Size 45KB
SHA256 9d632d94f5674748532fca6bfa2856912e73d3e1b63f3e30382ee047994ae485
MD5 969a179bf6947924959de8d9aa2b2bd7
SHA1 eac85ad85ffa85374a1f7c04e9cafe0fec5a8ab4
SHA512 f86acaed65b2d503d1a29724f1bf51e4ab639951682adfc8f0058ec1db8ef518d49332630d0e62aff501883e9f7a7bba36b6b3d2af867d060e6d06b2fbd89af3
SSDEEP 768:wuZ8pT1Uu4/cWUeT66mo2q1GcP0pycvHPIjzjbQgX3i2X7MKrJ1AJ/t7YuWiBDZO:wuZ8pT1tc2FccMcvgj3bXXS2LMIA6uP8
TLSH
T1B2232A0037E9823BF2BE5F7898F261854A7AF2633603D9491CC451DB5723BC69A426FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1448-0-0x0000000074782000-0x0000000074783000-memory.dmp

Download

memory/1448-1-0x00000000005E0000-0x00000000005F2000-memory.dmp

Download

memory/1448-2-0x0000000074770000-0x0000000074F2C000-memory.dmp

Download

memory/1448-3-0x0000000004FF0000-0x000000000508C000-memory.dmp

Download

memory/1448-8-0x0000000074770000-0x0000000074F2C000-memory.dmp

Download

memory/3904-12-0x0000000073ED2000-0x0000000073ED3000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads