asyncrat | 8e3701429ef163b9c3408743bfae61eab798711bebe35d34bfbaa1ad2f4f974d

General

Target
8e3701429ef163b9c3408743bfae61eab798711bebe35d34bfbaa1ad2f4f974d.exe
Size 45KB
Sample260913-x2eemssdkd
SHA256 8e3701429ef163b9c3408743bfae61eab798711bebe35d34bfbaa1ad2f4f974d
MD5 8051e890a2e39b61517d563bd66e30f3
SHA1 d174f739e8676d8d77f35ad83dfb353c57132a5f
SHA512 dad1c465be8e3e164366346469f154f046c68d3d77a11ac80130345cdf7eac253c17955c022da1055e146c63b48985287413914af01724fafa690a6102587e7b
SSDEEP 768:xuRONT9gGHBWUZohrmo2q9q9Yq3q3hOPI2zjbQgX3i3dFmQetUlPaTBDZzx:xuRONT9Bw2HaCq323bXXStFvTPkdzx
TLSH
T18A232B003BE9C12BF2BF5F78ADF25105467AF1633603D64A1CC4529B5623BC69A42AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

admin defense_evasion discovery execution asyncrat persistence rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Admin

C2

phimsexxxx.net:80
phimsexxxx.net:443
phimsexxxx.net:7788
phimsexxxx.net:7879
phimsexxxx.net:3577
phimsexxxx.net:8888
phimsexxxx.net:3306
phimsexxxx.net:21
phimsexxxx.net:22
www.phimsexxxx.net:80
www.phimsexxxx.net:443
www.phimsexxxx.net:7788
www.phimsexxxx.net:7879
www.phimsexxxx.net:3577
www.phimsexxxx.net:8888
www.phimsexxxx.net:3306
www.phimsexxxx.net:21
www.phimsexxxx.net:22
malware.phimsexxxx.net:80
malware.phimsexxxx.net:443
malware.phimsexxxx.net:7788
malware.phimsexxxx.net:7879
malware.phimsexxxx.net:3577
malware.phimsexxxx.net:8888
malware.phimsexxxx.net:3306
malware.phimsexxxx.net:21
malware.phimsexxxx.net:22
ftp.phimsexxxx.net:80
ftp.phimsexxxx.net:443
ftp.phimsexxxx.net:7788
ftp.phimsexxxx.net:7879
ftp.phimsexxxx.net:3577
ftp.phimsexxxx.net:8888
ftp.phimsexxxx.net:3306
ftp.phimsexxxx.net:21
ftp.phimsexxxx.net:22

Mutex

aSJZCkdIy8ne

Attributes

delay
3
install
true
install_file
vcxvsdf.exe
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral2/files/0x00160000000115c4-10.dat	family_asyncrat

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2528	cmd.exe
2136	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8e3701429ef163b9c3408743bfae61eab798711bebe35d34bfbaa1ad2f4f974d.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
4112	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4592	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\8e3701429ef163b9c3408743bfae61eab798711bebe35d34bfbaa1ad2f4f974d.exe
"C:\Users\Admin\AppData\Local\Temp\8e3701429ef163b9c3408743bfae61eab798711bebe35d34bfbaa1ad2f4f974d.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1800
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "vcxvsdf" /tr '"C:\Users\Admin\AppData\Roaming\vcxvsdf.exe"' & exit
  2⤵
  - Executes a command shell one-liner
  PID:2528
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /f /sc onlogon /rl highest /tn "vcxvsdf" /tr '"C:\Users\Admin\AppData\Roaming\vcxvsdf.exe"'
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4592
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp31F3.tmp.bat""
  2⤵
  - Executes a command shell one-liner
  PID:2136
- - C:\Windows\SysWOW64\timeout.exe
    timeout 3
    3⤵
    - Delays execution with timeout.exe
    PID:4112
- - C:\Users\Admin\AppData\Roaming\vcxvsdf.exe
    "C:\Users\Admin\AppData\Roaming\vcxvsdf.exe"
    3⤵
    PID:3432

C:\Users\Admin\AppData\Roaming\vcxvsdf.exe
"C:\Users\Admin\AppData\Roaming\vcxvsdf.exe"
1⤵
PID:4640

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmp31F3.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmp31F3.tmp.bat
Size 151B
SHA256 bcc465fae879e19850afb12f7eaa5483422261b32f6a13736b9bbcdbda2b7194
MD5 3069e6d53e1649b718ff8227a325ebf6
SHA1 a30e7750a1174baaf9df8698450219150328a9f0
SHA512 951692141b40abd2db989b335141228809d39b5ccc6797584760a8b44cdd9cbae5cf20c22772357a1d5122dda06fba8b9587069b0c51be10b3e40059d3785853
TLSH
T1DFC02B9251C5FB1E3C05146302FAD58DF2726D5A3F44FF50C348411D23C0868F0D9381
MD5 SHA1 SHA512 TLSH

Submit Download

vcxvsdf.exe

Path C:\Users\Admin\AppData\Roaming\vcxvsdf.exe
Size 45KB
SHA256 8e3701429ef163b9c3408743bfae61eab798711bebe35d34bfbaa1ad2f4f974d
MD5 8051e890a2e39b61517d563bd66e30f3
SHA1 d174f739e8676d8d77f35ad83dfb353c57132a5f
SHA512 dad1c465be8e3e164366346469f154f046c68d3d77a11ac80130345cdf7eac253c17955c022da1055e146c63b48985287413914af01724fafa690a6102587e7b
SSDEEP 768:xuRONT9gGHBWUZohrmo2q9q9Yq3q3hOPI2zjbQgX3i3dFmQetUlPaTBDZzx:xuRONT9Bw2HaCq323bXXStFvTPkdzx
TLSH
T18A232B003BE9C12BF2BF5F78ADF25105467AF1633603D64A1CC4529B5623BC69A42AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1800-0-0x0000000074E92000-0x0000000074E93000-memory.dmp

Download

memory/1800-1-0x0000000000990000-0x00000000009A2000-memory.dmp

Download

memory/1800-2-0x0000000074E80000-0x000000007563C000-memory.dmp

Download

memory/1800-3-0x0000000005590000-0x000000000562C000-memory.dmp

Download

memory/1800-8-0x0000000074E80000-0x000000007563C000-memory.dmp

Download

memory/4640-12-0x0000000074672000-0x0000000074673000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads