asyncrat | 12f2e964639c39076f29196264c1dcbd3792eaaaa77aca14986a802a122b341b

Analysis

max time kernel
123s
max time network
166s
platform
windows10_x64
resource
win10v20210408
submitted
17/08/2021, 13:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Invoice Receipt.exe
Size 171KB
Sample210817-53dkqnqlqe
SHA256 12f2e964639c39076f29196264c1dcbd3792eaaaa77aca14986a802a122b341b
MD5 a63c33079aecbb0087c1350f0d3b70cb
SHA1 0dc3d2eb3337120d74d5c18193d7d9a73b068da2
SHA512 834fe49a1de579a3fb7f03cd056ac70c51a7608fd8454ab4cad8175b3c77cd77eff620e6f4ab5aaf1be0a0010c9bda620927ce330a580d3e0d51610b0b8c5990
MD5 SHA1 SHA512

Score

10^/10

asyncrat rat

Malware Config

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
rat asyncrat

Async RAT payload 3 IoCs

rat

resource	yara_rule
behavioral2/memory/540-119-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat
behavioral2/memory/540-120-0x000000000040CB9E-mapping.dmp	asyncrat
behavioral2/memory/540-130-0x0000000006190000-0x0000000006197000-memory.dmp	asyncrat

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4648 set thread context of 540	4648	Invoice Receipt.exe	75

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
540	Invoice Receipt.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4648	Invoice Receipt.exe
Token: SeDebugPrivilege	540	Invoice Receipt.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
540	Invoice Receipt.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4648 wrote to memory of 540	4648	Invoice Receipt.exe	75
PID 4648 wrote to memory of 540	4648	Invoice Receipt.exe	75
PID 4648 wrote to memory of 540	4648	Invoice Receipt.exe	75
PID 4648 wrote to memory of 540	4648	Invoice Receipt.exe	75
PID 4648 wrote to memory of 540	4648	Invoice Receipt.exe	75
PID 4648 wrote to memory of 540	4648	Invoice Receipt.exe	75
PID 4648 wrote to memory of 540	4648	Invoice Receipt.exe	75
PID 4648 wrote to memory of 540	4648	Invoice Receipt.exe	75

C:\Users\Admin\AppData\Local\Temp\Invoice Receipt.exe
"C:\Users\Admin\AppData\Local\Temp\Invoice Receipt.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4648
- C:\Users\Admin\AppData\Local\Temp\Invoice Receipt.exe
  "C:\Users\Admin\AppData\Local\Temp\Invoice Receipt.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:540

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/540-125-0x0000000005310000-0x0000000005311000-memory.dmp

Download

memory/540-129-0x0000000006F00000-0x0000000006F01000-memory.dmp

Download

memory/540-135-0x00000000074F0000-0x0000000007633000-memory.dmp

Download

memory/540-119-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/540-134-0x0000000006DB0000-0x0000000006DB1000-memory.dmp

Download

memory/540-133-0x0000000006DE0000-0x0000000006DE1000-memory.dmp

Download

memory/540-132-0x0000000007220000-0x0000000007223000-memory.dmp

Download

memory/540-128-0x0000000006000000-0x0000000006001000-memory.dmp

Download

memory/540-131-0x0000000006EC0000-0x0000000006EC1000-memory.dmp

Download

memory/540-130-0x0000000006190000-0x0000000006197000-memory.dmp

Download

memory/4648-114-0x0000000000690000-0x0000000000691000-memory.dmp

Download

memory/4648-124-0x0000000004EB0000-0x00000000053AE000-memory.dmp

Download

memory/4648-117-0x0000000004F50000-0x0000000004F51000-memory.dmp

Download

memory/4648-116-0x00000000053B0000-0x00000000053B1000-memory.dmp

Download

memory/4648-118-0x00000000029E0000-0x00000000029F1000-memory.dmp

Download