asyncrat | 3bddaaabed40855eea13845cecd0ee4df2d9fdae3a6c5f398a7dae49c2349b67

General

Target

3bddaaabed40855eea13845cecd0ee4df2d9fdae3a6c5f398a7dae49c2349b67.exe
Size

1007KB
MD5

c0442e6a2e6dc06d2fc5f57d6ae48021
SHA1

9345208f57bc389d3147337841865af982554a49
SHA256

3bddaaabed40855eea13845cecd0ee4df2d9fdae3a6c5f398a7dae49c2349b67
SHA512

cb9642e885532fc15ee381263ec117e5bdb35bf717aac833cfb9f96db5f8901e2d302586afae2b33a7686d0357469a9b5ff3928bae6c643a996dcf08fcddec31

Score

10^/10

asyncrat rat

Malware Config

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
rat asyncrat

Async RAT payload 6 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1752-60-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat
behavioral1/memory/1752-61-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat
behavioral1/memory/1752-62-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat
behavioral1/memory/1752-63-0x000000000040CCDE-mapping.dmp	asyncrat
behavioral1/memory/1752-66-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat
behavioral1/memory/1752-68-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat

Executes dropped EXE 1 IoCs

Processes:

svhost.exe

pid process

1752 svhost.exe
Loads dropped DLL 1 IoCs

Processes:

3bddaaabed40855eea13845cecd0ee4df2d9fdae3a6c5f398a7dae49c2349b67.exe

pid process

1652 3bddaaabed40855eea13845cecd0ee4df2d9fdae3a6c5f398a7dae49c2349b67.exe

pid	process
1752	svhost.exe

pid	process
1652	3bddaaabed40855eea13845cecd0ee4df2d9fdae3a6c5f398a7dae49c2349b67.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

3bddaaabed40855eea13845cecd0ee4df2d9fdae3a6c5f398a7dae49c2349b67.exe

description	pid	process	target process
PID 1652 set thread context of 1752	1652	3bddaaabed40855eea13845cecd0ee4df2d9fdae3a6c5f398a7dae49c2349b67.exe	svhost.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

3bddaaabed40855eea13845cecd0ee4df2d9fdae3a6c5f398a7dae49c2349b67.exesvhost.exe

pid process

1652 3bddaaabed40855eea13845cecd0ee4df2d9fdae3a6c5f398a7dae49c2349b67.exe
1752 svhost.exe

pid	process
1652	3bddaaabed40855eea13845cecd0ee4df2d9fdae3a6c5f398a7dae49c2349b67.exe
1752	svhost.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

3bddaaabed40855eea13845cecd0ee4df2d9fdae3a6c5f398a7dae49c2349b67.exesvhost.exe

description	pid	process
Token: SeDebugPrivilege	1652	3bddaaabed40855eea13845cecd0ee4df2d9fdae3a6c5f398a7dae49c2349b67.exe
Token: SeDebugPrivilege	1752	svhost.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

3bddaaabed40855eea13845cecd0ee4df2d9fdae3a6c5f398a7dae49c2349b67.exe

description	pid	process	target process
PID 1652 wrote to memory of 1752	1652	3bddaaabed40855eea13845cecd0ee4df2d9fdae3a6c5f398a7dae49c2349b67.exe	svhost.exe
PID 1652 wrote to memory of 1752	1652	3bddaaabed40855eea13845cecd0ee4df2d9fdae3a6c5f398a7dae49c2349b67.exe	svhost.exe
PID 1652 wrote to memory of 1752	1652	3bddaaabed40855eea13845cecd0ee4df2d9fdae3a6c5f398a7dae49c2349b67.exe	svhost.exe
PID 1652 wrote to memory of 1752	1652	3bddaaabed40855eea13845cecd0ee4df2d9fdae3a6c5f398a7dae49c2349b67.exe	svhost.exe
PID 1652 wrote to memory of 1752	1652	3bddaaabed40855eea13845cecd0ee4df2d9fdae3a6c5f398a7dae49c2349b67.exe	svhost.exe
PID 1652 wrote to memory of 1752	1652	3bddaaabed40855eea13845cecd0ee4df2d9fdae3a6c5f398a7dae49c2349b67.exe	svhost.exe
PID 1652 wrote to memory of 1752	1652	3bddaaabed40855eea13845cecd0ee4df2d9fdae3a6c5f398a7dae49c2349b67.exe	svhost.exe
PID 1652 wrote to memory of 1752	1652	3bddaaabed40855eea13845cecd0ee4df2d9fdae3a6c5f398a7dae49c2349b67.exe	svhost.exe
PID 1652 wrote to memory of 1752	1652	3bddaaabed40855eea13845cecd0ee4df2d9fdae3a6c5f398a7dae49c2349b67.exe	svhost.exe

C:\Users\Admin\AppData\Local\Temp\3bddaaabed40855eea13845cecd0ee4df2d9fdae3a6c5f398a7dae49c2349b67.exe
"C:\Users\Admin\AppData\Local\Temp\3bddaaabed40855eea13845cecd0ee4df2d9fdae3a6c5f398a7dae49c2349b67.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1652
- C:\Users\Admin\AppData\Local\Temp\svhost.exe
  "C:\Users\Admin\AppData\Local\Temp\svhost.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1752

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\svhost.exe

Filesize
255KB

MD5
9af17c8393f0970ee5136bd3ffa27001

SHA1
4b285b72c1a11285a25f31f2597e090da6bbc049

SHA256
71d6a7a3fe5f8dc878cd5bdeca0e09177efb85c01e9a8a10a95262cabefaa019

SHA512
b90f7de7d5ce72dccb264c7ba609e173c529b9d99ed9a63f88632bc58b1a994bbb727365f519c73b979f8918bd6de3c39a9f0347eb3a4bccdce4b2772a6516a3

Download Submit
C:\Users\Admin\AppData\Local\Temp\svhost.exe

Filesize
255KB

MD5
9af17c8393f0970ee5136bd3ffa27001

SHA1
4b285b72c1a11285a25f31f2597e090da6bbc049

SHA256
71d6a7a3fe5f8dc878cd5bdeca0e09177efb85c01e9a8a10a95262cabefaa019

SHA512
b90f7de7d5ce72dccb264c7ba609e173c529b9d99ed9a63f88632bc58b1a994bbb727365f519c73b979f8918bd6de3c39a9f0347eb3a4bccdce4b2772a6516a3

Download Submit
\Users\Admin\AppData\Local\Temp\svhost.exe

Filesize
255KB

MD5
9af17c8393f0970ee5136bd3ffa27001

SHA1
4b285b72c1a11285a25f31f2597e090da6bbc049

SHA256
71d6a7a3fe5f8dc878cd5bdeca0e09177efb85c01e9a8a10a95262cabefaa019

SHA512
b90f7de7d5ce72dccb264c7ba609e173c529b9d99ed9a63f88632bc58b1a994bbb727365f519c73b979f8918bd6de3c39a9f0347eb3a4bccdce4b2772a6516a3

Download Submit
memory/1652-55-0x0000000000420000-0x0000000000436000-memory.dmp

Filesize
88KB

Download
memory/1652-54-0x0000000000980000-0x00000000009BC000-memory.dmp

Filesize
240KB

Download
memory/1752-57-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1752-61-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1752-62-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1752-63-0x000000000040CCDE-mapping.dmp

Download
memory/1752-60-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1752-66-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1752-68-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1752-58-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1752-70-0x00000000753C1000-0x00000000753C3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads