asyncrat | 25e21f55b7fbffe0d90e6845044e3e907964a5c278f29fcd1cf0fff9916a2ac3

Analysis

max time kernel
23s
max time network
155s
platform
windows10_x64
resource
win10v20210410
submitted
14/08/2021, 06:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
invoice receipt.exe
Size 85KB
Sample210814-2dach2nbgx
SHA256 25e21f55b7fbffe0d90e6845044e3e907964a5c278f29fcd1cf0fff9916a2ac3
MD5 fbaae5aefbf3594f6df80196560b04e9
SHA1 ea3c33b97c4c6f4ca9a5cba967e3446ae50c940c
SHA512 4b853724bb0d135e8762c4ab92688b05af0feb8c13e1cfd1f77753f1812f2121c9c0d2dd3214f2375323368870ee25296567e6d0a34dc2e9ad5fdb3327e8f6f8
MD5 SHA1 SHA512

Score

10^/10

asyncrat rat

Malware Config

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
rat asyncrat

Async RAT payload 3 IoCs

rat

resource	yara_rule
behavioral2/memory/4944-120-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat
behavioral2/memory/4944-121-0x000000000040CB9E-mapping.dmp	asyncrat
behavioral2/memory/4944-130-0x0000000005ED0000-0x0000000005ED7000-memory.dmp	asyncrat

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4444 set thread context of 4944	4444	invoice receipt.exe	75

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
4944	invoice receipt.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4444	invoice receipt.exe
Token: SeDebugPrivilege	4944	invoice receipt.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4944	invoice receipt.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4444 wrote to memory of 4944	4444	invoice receipt.exe	75
PID 4444 wrote to memory of 4944	4444	invoice receipt.exe	75
PID 4444 wrote to memory of 4944	4444	invoice receipt.exe	75
PID 4444 wrote to memory of 4944	4444	invoice receipt.exe	75
PID 4444 wrote to memory of 4944	4444	invoice receipt.exe	75
PID 4444 wrote to memory of 4944	4444	invoice receipt.exe	75
PID 4444 wrote to memory of 4944	4444	invoice receipt.exe	75
PID 4444 wrote to memory of 4944	4444	invoice receipt.exe	75

C:\Users\Admin\AppData\Local\Temp\invoice receipt.exe
"C:\Users\Admin\AppData\Local\Temp\invoice receipt.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4444
- C:\Users\Admin\AppData\Local\Temp\invoice receipt.exe
  "C:\Users\Admin\AppData\Local\Temp\invoice receipt.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:4944

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4444-114-0x0000000000D40000-0x0000000000D41000-memory.dmp

Download

memory/4444-116-0x0000000005A30000-0x0000000005A31000-memory.dmp

Download

memory/4444-117-0x00000000055D0000-0x00000000055D1000-memory.dmp

Download

memory/4444-118-0x0000000005500000-0x0000000005511000-memory.dmp

Download

memory/4444-119-0x0000000005670000-0x0000000005671000-memory.dmp

Download

memory/4944-120-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/4944-125-0x0000000002D80000-0x0000000002D81000-memory.dmp

Download

memory/4944-128-0x0000000005F90000-0x0000000005F91000-memory.dmp

Download

memory/4944-129-0x0000000006E50000-0x0000000006E51000-memory.dmp

Download

memory/4944-130-0x0000000005ED0000-0x0000000005ED7000-memory.dmp

Download

memory/4944-131-0x0000000006E10000-0x0000000006E11000-memory.dmp

Download

memory/4944-132-0x0000000007170000-0x0000000007173000-memory.dmp

Download

memory/4944-134-0x00000000070A0000-0x00000000070A1000-memory.dmp

Download