asyncrat | a0470b9276f5ef410e0db769efba305d836eee50303a9dad086139c689e5cb5d

General

Target
patch.exe
Size 112KB
Sample261102-khmwfsty6r
SHA256 a0470b9276f5ef410e0db769efba305d836eee50303a9dad086139c689e5cb5d
MD5 c3c739b40cf1be1624fcc4795561f4c9
SHA1 2b8b120be59d5bf8fb2fce31a73e15e2a77bdcb7
SHA512 16a5c6ba18c5f7b04c97022da87affc4611ad2ae87a3a0b8b54564723cd5c1cc5edc10cbb0678162fbdfe9fef67e89c3a83c614262045e143d2b52b423083486
SSDEEP 1536:bu+M1TFlJ42Z6VO3z3bhdSNmLlPidKtKrqi35RwYR:bu+YTFlW2Ak3z3bhYm45PwYR
TLSH
T1E1B39F30EFD7B036EC2D4AFC5CA371714929A9D3250EF53AFDC0329746226C1A5726A9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

default command_and_control defense_evasion discovery execution asyncrat persistence rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

C2

f8bet88.shop:443
f8bet88.shop:80
f8bet88.shop:22
f8bet88.shop:3306
f8bet88.shop:21
f8bet88.shop:5900
www.f8bet88.shop:443
www.f8bet88.shop:80
www.f8bet88.shop:22
www.f8bet88.shop:3306
www.f8bet88.shop:21
www.f8bet88.shop:5900
api.f8bet88.shop:443
api.f8bet88.shop:80
api.f8bet88.shop:22
api.f8bet88.shop:3306
api.f8bet88.shop:21
api.f8bet88.shop:5900

Mutex

Ltzy1hdpKevl

Attributes

delay
3
install
true
install_file
patch.exe
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral1/files/0x000a000000024257-8.dat	family_asyncrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Control Panel\International\Geo\Nation	patch.exe

Executes dropped EXE 2 IoCs

pid	Process
1972	patch.exe
4372	patch.exe

Outbound SSH connection to public host 2 TTPs 4 IoCs

SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

command_and_control

Protocol Tunneling

T1572

Network Service Discovery

T1046

description	flow	ioc	pid	Process
SSH destination	18	76.76.21.61:22	1972	patch.exe
SSH destination	31	66.33.60.130:22	1972	patch.exe
SSH destination	41	76.76.21.61:22	1972	patch.exe
SSH destination	42	66.33.60.130:22	1972	patch.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1420	cmd.exe
2748	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	patch.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	patch.exe

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patch.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
4664	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4616	schtasks.exe

Suspicious behavior: EnumeratesProcesses 23 IoCs

pid	Process
4332	patch.exe
4332	patch.exe
4332	patch.exe
4332	patch.exe
4332	patch.exe
4332	patch.exe
4332	patch.exe
4332	patch.exe
4332	patch.exe
4332	patch.exe
4332	patch.exe
4332	patch.exe
4332	patch.exe
4332	patch.exe
4332	patch.exe
4332	patch.exe
4332	patch.exe
4332	patch.exe
4332	patch.exe
4332	patch.exe
4332	patch.exe
4332	patch.exe
4332	patch.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4332	patch.exe
Token: SeDebugPrivilege	1972	patch.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4332 wrote to memory of 1420	4332	patch.exe	88
PID 4332 wrote to memory of 2748	4332	patch.exe	90
PID 2748 wrote to memory of 4664	2748	cmd.exe	92
PID 1420 wrote to memory of 4616	1420	cmd.exe	93
PID 2748 wrote to memory of 4372	2748	cmd.exe	97

C:\Users\Admin\AppData\Local\Temp\patch.exe
"C:\Users\Admin\AppData\Local\Temp\patch.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4332
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "patch" /tr '"C:\Users\Admin\AppData\Roaming\patch.exe"' & exit
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1420
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /f /sc onlogon /rl highest /tn "patch" /tr '"C:\Users\Admin\AppData\Roaming\patch.exe"'
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4616
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpC9B4.tmp.bat""
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2748
- - C:\Windows\SysWOW64\timeout.exe
    timeout 3
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:4664
- - C:\Users\Admin\AppData\Roaming\patch.exe
    "C:\Users\Admin\AppData\Roaming\patch.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4372

C:\Users\Admin\AppData\Roaming\patch.exe
"C:\Users\Admin\AppData\Roaming\patch.exe"
1⤵
- Executes dropped EXE
- Outbound SSH connection to public host
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1972

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Discovery

Network Service Discovery

Query Registry

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

System Network Configuration Discovery

1

T1016

Lateral Movement

Collection

Command and Control

Protocol Tunneling

1

T1572

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patch.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\patch.exe.log
Size 522B
SHA256 2412679218bb0a7d05ceee32869bbb223619bde9966c4c460a68304a3367724b
MD5 acc9090417037dfa2a55b46ed86e32b8
SHA1 53fa6fb25fb3e88c24d2027aca6ae492b2800a4d
SHA512 d51f7085ec147c708f446b9fb6923cd2fb64596d354ed929e125b30ace57c8cb3217589447a36960e5d3aea87a4e48aaa82c7509eced6d6c2cecd71fcfe3697b
TLSH
T11EF097303722E1E489423F521C1C3A9943EF079AA360EE2C3958036ED825227AB212E3
MD5 SHA1 SHA512 TLSH

Submit Download

tmpC9B4.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmpC9B4.tmp.bat
Size 149B
SHA256 2b0d30eeafd21ab3612ae2ba0f0c2f8d6725d151ac14b025378d4aa384eeb17e
MD5 48f50aebde7b696ea3bd85189b91fa58
SHA1 ff5be82e33bc796f4941ccab9171d2021414dde3
SHA512 0ad1d9b55f89bc1a650c399a2281a1b496e921ddd74f051fe46512585d9e79a1fc7224a45eb13bd836017a3630eab6b09bf3cb7ae1de2c6f8385b0f016f36a76
TLSH
T154C02BB251C5EA9E2C09141303FBD48C917B7CAD3F80BB00C744404E26804C8F4DA349
MD5 SHA1 SHA512 TLSH

Submit Download

patch.exe

Path C:\Users\Admin\AppData\Roaming\patch.exe
Size 112KB
SHA256 a0470b9276f5ef410e0db769efba305d836eee50303a9dad086139c689e5cb5d
MD5 c3c739b40cf1be1624fcc4795561f4c9
SHA1 2b8b120be59d5bf8fb2fce31a73e15e2a77bdcb7
SHA512 16a5c6ba18c5f7b04c97022da87affc4611ad2ae87a3a0b8b54564723cd5c1cc5edc10cbb0678162fbdfe9fef67e89c3a83c614262045e143d2b52b423083486
SSDEEP 1536:bu+M1TFlJ42Z6VO3z3bhdSNmLlPidKtKrqi35RwYR:bu+YTFlW2Ak3z3bhYm45PwYR
TLSH
T1E1B39F30EFD7B036EC2D4AFC5CA371714929A9D3250EF53AFDC0329746226C1A5726A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4332-0-0x0000000000B10000-0x0000000000B32000-memory.dmp

Download

memory/4332-1-0x00000000055B0000-0x00000000055C0000-memory.dmp

Download

memory/4332-2-0x00000000054E0000-0x000000000557C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads