ANALYZING ASYNCRAT'S CODE INJECTION INTO ASPNET_COMPILER.EXE ACROSS MULTIPLE INCIDENT RESPONSE CASES

Summary from the TLDR InfoSec newsletter

The Trend Micro Managed XDR team discusses how the aspnet_compiler.exe, a legitimate Microsoft Process, is used to inject the AsyncRAT payload. The investigation revealed different tactics employed by the attackers, including phishing campaigns, code injection, and the use of dynamic DNS servers as well as the ability to evade detection by Antivirus software.