BL. NO. ANSMUNDAR3621.exe
BL. NO. ANSMUNDAR3621.exe
343KB
21-10-2021 12:40
6e313f49084c58fcd006489103bac31a
cfb76b45950b867da23054c1df26ce8e7a3f8274
408e8ea1cbe31a44e822f1673cbfbe79dbd2938a1e449e61a661c1cceda8f322
Extracted
Family | asyncrat |
Version | 0.5.7B |
Botnet | Default |
C2 |
185.222.57.71:00783 |
Attributes |
anti_vm false
bsod false
delay 3
install false
install_folder %AppData%
pastebin_config null |
aes.plain |
|
Filter: none
-
AsyncRat
Description
AsyncRAT is designed to remotely monitor and control other computers.
Tags
-
Async RAT payload
Tags
Reported IOCs
resource yara_rule behavioral1/memory/1372-63-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/1372-64-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/1372-65-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/1372-66-0x000000000040C70E-mapping.dmp asyncrat behavioral1/memory/1372-67-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat -
Suspicious use of SetThreadContextBL. NO. ANSMUNDAR3621.exe
Reported IOCs
description pid process target process PID 1636 set thread context of 1372 1636 BL. NO. ANSMUNDAR3621.exe RegSvcs.exe -
Suspicious behavior: EnumeratesProcessesBL. NO. ANSMUNDAR3621.exe
Reported IOCs
pid process 1636 BL. NO. ANSMUNDAR3621.exe 1636 BL. NO. ANSMUNDAR3621.exe -
Suspicious use of AdjustPrivilegeTokenBL. NO. ANSMUNDAR3621.exeRegSvcs.exe
Reported IOCs
description pid process Token: SeDebugPrivilege 1636 BL. NO. ANSMUNDAR3621.exe Token: SeDebugPrivilege 1372 RegSvcs.exe -
Suspicious use of WriteProcessMemoryBL. NO. ANSMUNDAR3621.exe
Reported IOCs
description pid process target process PID 1636 wrote to memory of 1372 1636 BL. NO. ANSMUNDAR3621.exe RegSvcs.exe PID 1636 wrote to memory of 1372 1636 BL. NO. ANSMUNDAR3621.exe RegSvcs.exe PID 1636 wrote to memory of 1372 1636 BL. NO. ANSMUNDAR3621.exe RegSvcs.exe PID 1636 wrote to memory of 1372 1636 BL. NO. ANSMUNDAR3621.exe RegSvcs.exe PID 1636 wrote to memory of 1372 1636 BL. NO. ANSMUNDAR3621.exe RegSvcs.exe PID 1636 wrote to memory of 1372 1636 BL. NO. ANSMUNDAR3621.exe RegSvcs.exe PID 1636 wrote to memory of 1372 1636 BL. NO. ANSMUNDAR3621.exe RegSvcs.exe PID 1636 wrote to memory of 1372 1636 BL. NO. ANSMUNDAR3621.exe RegSvcs.exe PID 1636 wrote to memory of 1372 1636 BL. NO. ANSMUNDAR3621.exe RegSvcs.exe PID 1636 wrote to memory of 1372 1636 BL. NO. ANSMUNDAR3621.exe RegSvcs.exe PID 1636 wrote to memory of 1372 1636 BL. NO. ANSMUNDAR3621.exe RegSvcs.exe PID 1636 wrote to memory of 1372 1636 BL. NO. ANSMUNDAR3621.exe RegSvcs.exe
-
C:\Users\Admin\AppData\Local\Temp\BL. NO. ANSMUNDAR3621.exe"C:\Users\Admin\AppData\Local\Temp\BL. NO. ANSMUNDAR3621.exe"Suspicious use of SetThreadContextSuspicious behavior: EnumeratesProcessesSuspicious use of AdjustPrivilegeTokenSuspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"Suspicious use of AdjustPrivilegeToken
-
memory/1372-63-0x0000000000400000-0x0000000000412000-memory.dmp
-
memory/1372-67-0x0000000000400000-0x0000000000412000-memory.dmp
-
memory/1372-66-0x000000000040C70E-mapping.dmp
-
memory/1372-65-0x0000000000400000-0x0000000000412000-memory.dmp
-
memory/1372-64-0x0000000000400000-0x0000000000412000-memory.dmp
-
memory/1372-61-0x0000000000400000-0x0000000000412000-memory.dmp
-
memory/1372-62-0x0000000000400000-0x0000000000412000-memory.dmp
-
memory/1372-70-0x0000000004AD0000-0x0000000004AD1000-memory.dmp
-
memory/1636-60-0x0000000000B00000-0x0000000000B2D000-memory.dmp
-
memory/1636-59-0x0000000000430000-0x0000000000437000-memory.dmp
-
memory/1636-58-0x0000000004C40000-0x0000000004C41000-memory.dmp
-
memory/1636-57-0x0000000076081000-0x0000000076083000-memory.dmp
-
memory/1636-55-0x0000000000E20000-0x0000000000E21000-memory.dmp