asyncrat | f2ed40ab9c2eb52484d79b485a78e2779dd300b7513eac17ec4e39fd4a9614a8

Analysis

max time kernel
71s
max time network
112s
platform
windows10_x64
resource
win10v20210408
submitted
14/06/2021, 15:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bf7b01b358903416117bc4de8e0861b2.exe
Size 196KB
Sample210614-ye6rt9mdn2
SHA256 f2ed40ab9c2eb52484d79b485a78e2779dd300b7513eac17ec4e39fd4a9614a8
MD5 bf7b01b358903416117bc4de8e0861b2
SHA1 823f0f10fe938504503a8331e4f890b15f123ad8
SHA512 30e8db13ea9b1a386ce323575b764061b66189b61706ffad6d55c2b7c55701ee49ae158ce011c0c2c2405f1c06457450aff524d552ed5f28609669ff10f2c9dc
MD5 SHA1 SHA512

Score

10^/10

asyncrat rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

127.0.0.1:4771
136.144.41.4:4771

Mutex

AsyncMutex_6SI8OkPnk

Attributes

aes_key
QC5yo2zkgXpQvYIuqVhwItzoZLTyoXrn
anti_detection
false
autorun
false
bdos
false
delay
Default
host
127.0.0.1,136.144.41.4
hwid
3
install_file
install_folder
%AppData%
mutex
AsyncMutex_6SI8OkPnk
pastebin_config
null
port
4771
version
0.5.7B

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
rat asyncrat

Async RAT payload 3 IoCs

rat

resource	yara_rule
behavioral2/memory/2408-118-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat
behavioral2/memory/2408-119-0x000000000040C75E-mapping.dmp	asyncrat
behavioral2/memory/2408-134-0x0000000006FE0000-0x0000000006FFB000-memory.dmp	asyncrat

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 808 set thread context of 2408	808	bf7b01b358903416117bc4de8e0861b2.exe	78

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
2252	timeout.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2408	aspnet_compiler.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 808 wrote to memory of 2408	808	bf7b01b358903416117bc4de8e0861b2.exe	78
PID 808 wrote to memory of 2408	808	bf7b01b358903416117bc4de8e0861b2.exe	78
PID 808 wrote to memory of 2408	808	bf7b01b358903416117bc4de8e0861b2.exe	78
PID 808 wrote to memory of 2408	808	bf7b01b358903416117bc4de8e0861b2.exe	78
PID 808 wrote to memory of 2408	808	bf7b01b358903416117bc4de8e0861b2.exe	78
PID 808 wrote to memory of 2408	808	bf7b01b358903416117bc4de8e0861b2.exe	78
PID 808 wrote to memory of 2408	808	bf7b01b358903416117bc4de8e0861b2.exe	78
PID 808 wrote to memory of 2408	808	bf7b01b358903416117bc4de8e0861b2.exe	78
PID 2408 wrote to memory of 3944	2408	aspnet_compiler.exe	80
PID 2408 wrote to memory of 3944	2408	aspnet_compiler.exe	80
PID 2408 wrote to memory of 3944	2408	aspnet_compiler.exe	80
PID 2408 wrote to memory of 3172	2408	aspnet_compiler.exe	82
PID 2408 wrote to memory of 3172	2408	aspnet_compiler.exe	82
PID 2408 wrote to memory of 3172	2408	aspnet_compiler.exe	82
PID 3944 wrote to memory of 2268	3944	cmd.exe	84
PID 3944 wrote to memory of 2268	3944	cmd.exe	84
PID 3944 wrote to memory of 2268	3944	cmd.exe	84
PID 3172 wrote to memory of 2252	3172	cmd.exe	85
PID 3172 wrote to memory of 2252	3172	cmd.exe	85
PID 3172 wrote to memory of 2252	3172	cmd.exe	85

C:\Users\Admin\AppData\Local\Temp\bf7b01b358903416117bc4de8e0861b2.exe
"C:\Users\Admin\AppData\Local\Temp\bf7b01b358903416117bc4de8e0861b2.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:808
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2408
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\jlpkyp.exe"' & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3944
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\jlpkyp.exe"'
      4⤵
      PID:2268
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp73BA.tmp.bat""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3172
  - - C:\Windows\SysWOW64\timeout.exe
      timeout 2
      4⤵
      Delays execution with timeout.exe
      PID:2252

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/808-114-0x0000000000490000-0x0000000000491000-memory.dmp

Download

memory/808-116-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/808-117-0x0000000004DD0000-0x0000000004DD1000-memory.dmp

Download

memory/2408-128-0x0000000006F20000-0x0000000006F21000-memory.dmp

Download

memory/2408-131-0x00000000073E0000-0x000000000746D000-memory.dmp

Download

memory/2408-126-0x0000000006E20000-0x0000000006E21000-memory.dmp

Download

memory/2408-127-0x0000000006DA0000-0x0000000006E19000-memory.dmp

Download

memory/2408-124-0x00000000064E0000-0x00000000064E1000-memory.dmp

Download

memory/2408-129-0x0000000007020000-0x0000000007021000-memory.dmp

Download

memory/2408-130-0x0000000006F90000-0x0000000006F94000-memory.dmp

Download

memory/2408-125-0x0000000005FE0000-0x0000000005FE1000-memory.dmp

Download

memory/2408-132-0x0000000007570000-0x00000000075C9000-memory.dmp

Download

memory/2408-133-0x00000000075D0000-0x00000000075D1000-memory.dmp

Download

memory/2408-134-0x0000000006FE0000-0x0000000006FFB000-memory.dmp

Download

memory/2408-118-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/2408-122-0x0000000005620000-0x0000000005621000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads