Executive Summary

Amethyst Systems has actively analyzed a modern variant of the AsyncRAT Remote Access Trojan targeting enterprise perimeters. This report provides critical technical breakdowns of its defense evasion tactics, command-and-control (C2) infrastructure, and persistent registry footings to assist corporate security teams and managed service providers (MSSPs) in deploying immediate hunting signatures.

1. Delivery & Execution Flow

The deployment profile features highly aggressive initial execution loops designed to establish a rapid foothold before traditional endpoint security layers can isolate the runtime thread. The payload targets native operating system execution vectors to mask its initialization phase.

2. Process Hollowing & Defense Evasion (MITRE ATT&CK T1055.012)

Once initial execution triggers, the malware avoids writing its raw malicious payload directly to the visible filesystem. Instead, it utilizes Process Hollowing targeting critical Microsoft .NET sub-components:

  • Target Hijack Binary: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

The malware spawns a legitimate, cryptographically signed instance of the .NET Assembly Registration Utility (RegSvcs.exe) in a suspended state, unmaps its interior memory space, injects the core remote access trojan assembly, and resumes execution. This effectively masks all subsequent malicious processor instructions and network connections behind a trusted Microsoft service banner.

3. Registry Persistence Profile (MITRE ATT&CK T1054)

To ensure survival across system reboots, the hollowed process writes an obfuscated run key directly to the individual user registry hive, ensuring silent automated initialization at user authentication:

  • Target Hive Path: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
  • Registry Key Label: rwjJOH

4. Indicators of Compromise (IoCs)

Network Telemetry

  • C2 Active Domain: carrenzaalwarex.ddns.net
  • Dynamic DNS Registrar: No-IP Infrastructure (ddns.net)
  • Active Listening Port: 7004 (Encrypted TCP Stream)
  • Hashes:
    • MD5: d5a1c25a0d94a939935412058154c8ef
    • SHA1: f3d48d753ee43f069763fcf06a8c9e3536dfed8b
    • SHA256: 46038f8f6f10cbee2ea6654ab97a7664365087b7b86bb3ee783ae0428a411eb4

5. Blue-Team Hunting Signature (YARA Framework)

Security Operations Centers (SOCs) can utilize this custom signature rule block to scan memory spaces and forensic host images for corresponding AsyncRAT client components:

rule Amethyst_Systems_AsyncRAT_Memory {
    meta:
        description = "Detects active, unpacked AsyncRAT payloads in-memory via key strings within the binary"
        author = "Amethyst Systems Threat Intelligence"
        version = "6.0"
        date = "2026-08-01"
        confidence = "High"

    strings:
        // The C2 domain which is in plaintext within the binary
        $c2_string = "carrenzaalwarex.ddns.net" ascii wide

        // Core runtime identifier
        $mscorlib_ascii = "mscorlib" ascii wide
        
        // Cryptographic handler
        $rijndael_ascii = "RijndaelManaged" ascii wide

    condition:
        // Enforce Windows PE execution header parameters
        uint16(0) == 0x5A4D and 
        
        // Target structural elements
        $c2_string and
        ($mscorlib_ascii or $rijndael_ascii)
}