asyncrat | 3fd383d14f95fdb789ec1f0f97ce32c618d0f65dcf091b44f00d4fafe9f6dcb3

General

Target
Client.exe
Size 46KB
Sample260904-e8645asapc
SHA256 3fd383d14f95fdb789ec1f0f97ce32c618d0f65dcf091b44f00d4fafe9f6dcb3
MD5 54fa1f3d9e12b767513b3281297d84bd
SHA1 580100921a40711c58b7d9f91cecd7f94c1ad0bd
SHA512 41a54cd845ae1e77404fa7993f698053d675569db1b05d0c8bff945dbc42583269dc4070e7689bcdf40dd88d714015ddc446a7d420601d3c15a6820342059bea
SSDEEP 768:fqh/TbXX0u84kOicvHk3eHlWMPbPgF0quyJyfuUEIb1kYI6OC82tYcFmVc6K:fm84XvZH0ub4FruyIfpEIx06OZKmVcl
TLSH
T131231A003BD98136E2BE5FB89DF1514187BAE6233603C65D3CC841DA5B13BCACA51AF6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

null defense_evasion execution asyncrat persistence rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.6A

Botnet

null

C2

789win91.cyou:8080
789win91.cyou:443
789win91.cyou:80
789win91.cyou:8443
turbogram.co:8080
turbogram.co:443
turbogram.co:80
turbogram.co:8443
refuel-casino.co:8080
refuel-casino.co:443
refuel-casino.co:80
refuel-casino.co:8443
vavada-tq.buzz:8080
vavada-tq.buzz:443
vavada-tq.buzz:80
vavada-tq.buzz:8443
v52casino.co:8080
v52casino.co:443
v52casino.co:80
v52casino.co:8443
bedefiant.gg:8080
bedefiant.gg:443
bedefiant.gg:80
bedefiant.gg:8443
qh88hcm.com:8080
qh88hcm.com:443
qh88hcm.com:80
qh88hcm.com:8443
xoilacchamtv.ú:8080
xoilacchamtv.ú:443
xoilacchamtv.ú:80
xoilacchamtv.ú:8443
8xbets.cáino:8080
8xbets.cáino:443
8xbets.cáino:80
8xbets.cáino:8443
xoilacchamtv.us:8080
xoilacchamtv.us:443
xoilacchamtv.us:80
xoilacchamtv.us:8443

Mutex

CloudFlare, Inc. (Cloudflare, Inc.)

Attributes

delay
5
install
true
install_file
system.exe
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	Client.exe

Executes dropped EXE 2 IoCs

pid	Process
3892	system.exe
2112	system.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1028	cmd.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
1084	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1612	schtasks.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
3948	Client.exe
3948	Client.exe
3948	Client.exe
3948	Client.exe
3948	Client.exe
3948	Client.exe
3948	Client.exe
3948	Client.exe
3948	Client.exe
3948	Client.exe
3948	Client.exe
3948	Client.exe
3948	Client.exe
3948	Client.exe
3948	Client.exe
3948	Client.exe
3948	Client.exe
3948	Client.exe
3948	Client.exe
3948	Client.exe
3948	Client.exe
3948	Client.exe
3948	Client.exe
3892	system.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3948	Client.exe
Token: SeDebugPrivilege	3892	system.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3948 wrote to memory of 1612	3948	Client.exe	86
PID 3948 wrote to memory of 1028	3948	Client.exe	89
PID 1028 wrote to memory of 1084	1028	cmd.exe	91
PID 1028 wrote to memory of 2112	1028	cmd.exe	93

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Client.exe
"C:\Users\Admin\AppData\Local\Temp\Client.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3948
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "'system"' /tr "'C:\Users\Admin\AppData\Roaming\system.exe"'
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1612
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp5D3E.tmp.bat""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1028
- - C:\Windows\system32\timeout.exe
    timeout 3
    3⤵
    - Delays execution with timeout.exe
    PID:1084
- - C:\Users\Admin\AppData\Roaming\system.exe
    "C:\Users\Admin\AppData\Roaming\system.exe"
    3⤵
    - Executes dropped EXE
    PID:2112

C:\Users\Admin\AppData\Roaming\system.exe
"C:\Users\Admin\AppData\Roaming\system.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3892

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmp5D3E.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmp5D3E.tmp.bat
Size 150B
SHA256 0c0feb4c5de76c96ed5e387e5a9d21c8cd821782fdc14340c90b329b19702bfc
MD5 8903b921f996f064cebc15e81296a9d4
SHA1 86f51b539e3052f32058420271c90fa2eee8fe89
SHA512 a434faa0bd27d6bf42c4b7305be0982da72ff5f1349c3bf2558de8d84de152328ae6caf2134490d3b85b41a78420e35d8ddbb604549d0ee4b41e4d369e2ab9cf
TLSH
T160C08C4252CAAA1F2805241302BAA98C9576695A3E44AB009384400AA28144CF4AA241
MD5 SHA1 SHA512 TLSH

Submit Download

system.exe

Path C:\Users\Admin\AppData\Roaming\system.exe
Size 43.2MB
SHA256 d00bb9f9e9fe6a60e3c4f714f3b5c0d02ba9fd41135c71ccd7c4e03fd58d21bf
MD5 10a97f7f9775e8edb9db8ff3880b1975
SHA1 86cba5913ea2c419f66c97015fa04d7ebe42ef0b
SHA512 5d5ea520e4e1169dc0d3b0db0bf1d5df81d8bc4fa033ddb0b6e442dbcfbc29dafbc18fd0757de973261a1f756f1ade37ee705015d7369aa8ff073865b7e2fd5a
SSDEEP 786432:8U+ja108CDAEE/6gybu9IKWXcpJXbMm0xNrZtdw14SyE+eI4C4UrIz6Ui4/s:zwa10lDA0graKJpZMm+rHFyHUu6j
TLSH
T17AA733262E74663CEE3E236AC35AF25CF87D549B6E1196140CE543ECAF3D51EAD0C608
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3948-0-0x0000000000D70000-0x0000000000D82000-memory.dmp

Download

memory/3948-1-0x000000001B880000-0x000000001B890000-memory.dmp

Download

memory/3948-2-0x000000001B880000-0x000000001B890000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads