Analysis
- max time kernel
64s - max time network
161s - platform
windows10_x64 - resource
win10-en-20210920 - submitted
19/10/2021, 09:45
General
- Target Server1.ps1
- Size 963KB
- Sample211019-lq4plsgdfj
- SHA256 a341b8f10a51457c11292173cfa48fe49256c9ccef8ec045753b49b2bfa935d6
Malware Config
Extracted
-
asyncrat
-
1.0.7
-
Default
-
139.28.37.182:5200
-
DcRatMutex_qwqdanchun
-
anti_vm
false
-
bsod
false
-
delay
1
-
install
false
-
install_folder
%AppData%
-
pastebin_config
null
Signatures
- AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
- Async RAT payload 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\Server1.ps11⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/420-138-0x0000000000400000-0x0000000000412000-memory.dmp
memory/420-147-0x0000000005E60000-0x0000000005E61000-memory.dmp
memory/420-145-0x0000000005D50000-0x0000000005D51000-memory.dmp
memory/420-146-0x00000000062F0000-0x00000000062F1000-memory.dmp
memory/420-144-0x00000000054F0000-0x00000000054F1000-memory.dmp
memory/420-142-0x0000000000DE0000-0x0000000000DF2000-memory.dmp
memory/1828-120-0x0000021125520000-0x0000021125521000-memory.dmp
memory/1828-134-0x0000021123A60000-0x0000021123A62000-memory.dmp
memory/1828-125-0x000002113DAC3000-0x000002113DAC5000-memory.dmp
memory/1828-123-0x0000021123A60000-0x0000021123A62000-memory.dmp
memory/1828-126-0x000002113FBA0000-0x000002113FBA1000-memory.dmp
memory/1828-127-0x0000021123A60000-0x0000021123A62000-memory.dmp
memory/1828-131-0x0000021123A60000-0x0000021123A62000-memory.dmp
memory/1828-132-0x000002113DAC6000-0x000002113DAC8000-memory.dmp
memory/1828-133-0x0000021125560000-0x0000021125584000-memory.dmp
memory/1828-124-0x000002113DAC0000-0x000002113DAC2000-memory.dmp
memory/1828-122-0x0000021123A60000-0x0000021123A62000-memory.dmp
memory/1828-115-0x0000021123A60000-0x0000021123A62000-memory.dmp
memory/1828-141-0x0000021123A60000-0x0000021123A62000-memory.dmp
memory/1828-140-0x0000021125590000-0x0000021125591000-memory.dmp
memory/1828-121-0x0000021123A60000-0x0000021123A62000-memory.dmp
memory/1828-119-0x0000021123A60000-0x0000021123A62000-memory.dmp
memory/1828-118-0x0000021123A60000-0x0000021123A62000-memory.dmp
memory/1828-117-0x0000021123A60000-0x0000021123A62000-memory.dmp
memory/1828-116-0x0000021123A60000-0x0000021123A62000-memory.dmp