asyncrat | 46d709fbb5edc1f78cb3e5514507d0fdc1a7fb2aaf9081d56a9e9e1166df18bf

General

Target
defense3.exe
Size 45KB
Sample260922-whe2dsca47
SHA256 46d709fbb5edc1f78cb3e5514507d0fdc1a7fb2aaf9081d56a9e9e1166df18bf
MD5 472b45983e4194a4bcc2221e672ad3d5
SHA1 09e571188aa921ff0e08e6c30c335d3f07e1a6d4
SHA512 deec223ecb9070d229cd456031e6eeda1ea534e552942c3ddf2fe3d973233321dcd4bdcfc19e8a6338a8b534f94f020ead8b1d8de87de5e3536c7bdc2888bf04
SSDEEP 768:9uCgNTAolrhWU5ieLmo2qrvw0QbKXPIBzjbzgX3i1dJncuBDZXx:9uCgNTA2Z268B3bsXS1digdXx
TLSH
T156231A003BE9823AF2BE5FB8ACF26145467AF1632603D6492CC451DB5723BC696426FD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

C2

8kbetny.com:8080
8kbetny.com:443
c2.8kbetny.com:8080
c2.8kbetny.com:443
www.8kbetny.com:8080
www.8kbetny.com:443

Mutex

Mc0POwUZvWok

Attributes

delay
3
install
true
install_file
s8 ghe choi.exe
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral1/files/0x000300000002146a-8.dat	family_asyncrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Control Panel\International\Geo\Nation	defense3.exe

Executes dropped EXE 2 IoCs

pid	Process
2440	s8 ghe choi.exe
8	s8 ghe choi.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1160	cmd.exe
3152	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	s8 ghe choi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	s8 ghe choi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	defense3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
4176	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
456	schtasks.exe

Suspicious behavior: EnumeratesProcesses 21 IoCs

pid	Process
4620	defense3.exe
4620	defense3.exe
4620	defense3.exe
4620	defense3.exe
4620	defense3.exe
4620	defense3.exe
4620	defense3.exe
4620	defense3.exe
4620	defense3.exe
4620	defense3.exe
4620	defense3.exe
4620	defense3.exe
4620	defense3.exe
4620	defense3.exe
4620	defense3.exe
4620	defense3.exe
4620	defense3.exe
4620	defense3.exe
4620	defense3.exe
4620	defense3.exe
4620	defense3.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4620	defense3.exe
Token: SeDebugPrivilege	2440	s8 ghe choi.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4620 wrote to memory of 1160	4620	defense3.exe	89
PID 4620 wrote to memory of 3152	4620	defense3.exe	91
PID 3152 wrote to memory of 4176	3152	cmd.exe	93
PID 1160 wrote to memory of 456	1160	cmd.exe	94
PID 3152 wrote to memory of 8	3152	cmd.exe	97

C:\Users\Admin\AppData\Local\Temp\defense3.exe
"C:\Users\Admin\AppData\Local\Temp\defense3.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4620
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "s8 ghe choi" /tr '"C:\Users\Admin\AppData\Roaming\s8 ghe choi.exe"' & exit
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1160
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /f /sc onlogon /rl highest /tn "s8 ghe choi" /tr '"C:\Users\Admin\AppData\Roaming\s8 ghe choi.exe"'
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:456
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpCE19.tmp.bat""
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3152
- - C:\Windows\SysWOW64\timeout.exe
    timeout 3
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:4176
- - C:\Users\Admin\AppData\Roaming\s8 ghe choi.exe
    "C:\Users\Admin\AppData\Roaming\s8 ghe choi.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:8

C:\Users\Admin\AppData\Roaming\s8 ghe choi.exe
"C:\Users\Admin\AppData\Roaming\s8 ghe choi.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2440

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmpCE19.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmpCE19.tmp.bat
Size 155B
SHA256 823f29c366139efef5f62290d686b367cbde2b9cb8489faf9fbb2b2bb4de10a2
MD5 4c2ee3e0affeacf02b7ed53b52ae04e3
SHA1 3d96406e139a193727854a618923db802bf8e9ac
SHA512 9593d1092e22c5384a9fe57b38e412322d3fccdfd683dcdec803da40444e5c0a33c9d8776af986e8858b6a2d55b3cf6d4a9b3c0bd66f0458aec79df2c07bd490
TLSH
T16EC08C4652C6EA5E3809641302FAD49C9572A8993E40AB00E398800A5A80888E8D9242
MD5 SHA1 SHA512 TLSH

Submit Download

s8 ghe choi.exe

Path C:\Users\Admin\AppData\Roaming\s8 ghe choi.exe
Size 45KB
SHA256 46d709fbb5edc1f78cb3e5514507d0fdc1a7fb2aaf9081d56a9e9e1166df18bf
MD5 472b45983e4194a4bcc2221e672ad3d5
SHA1 09e571188aa921ff0e08e6c30c335d3f07e1a6d4
SHA512 deec223ecb9070d229cd456031e6eeda1ea534e552942c3ddf2fe3d973233321dcd4bdcfc19e8a6338a8b534f94f020ead8b1d8de87de5e3536c7bdc2888bf04
SSDEEP 768:9uCgNTAolrhWU5ieLmo2qrvw0QbKXPIBzjbzgX3i1dJncuBDZXx:9uCgNTA2Z268B3bsXS1digdXx
TLSH
T156231A003BE9823AF2BE5FB8ACF26145467AF1632603D6492CC451DB5723BC696426FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4620-0-0x0000000000E90000-0x0000000000EA2000-memory.dmp

Download

memory/4620-1-0x0000000005890000-0x00000000058A0000-memory.dmp

Download

memory/4620-2-0x00000000058A0000-0x000000000593C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads