asyncrat | 162c17601f3f2d8eda02546e6ee08cabed5f01267fb75224073a3ac21f0ca3dc

General

Target
a6a36115e072d7ef31b40277e4695e2c.exe
Size 407KB
Sample220408-ag68lababm
SHA256 162c17601f3f2d8eda02546e6ee08cabed5f01267fb75224073a3ac21f0ca3dc
MD5 a6a36115e072d7ef31b40277e4695e2c
SHA1 7fc7f195266c8e362551c8fb6564ca97ce26dad8
SHA512 c2efbed16867b0142cbb8f3158dcc9b5888f4a934b6d2ba17fe671d2bb4c78be5b2e03e4a8eeb1871748dd175e695556a3f279cabf1eac8da1e254cd7f7dd5c0
MD5 SHA1 SHA512

Score

10^/10

asyncrat default rat suricata

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

Default

C2

107.182.237.14:58453

Mutex

AsyncMutex_6SI8OkPnk

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
rat asyncrat
suricata: ET MALWARE Generic AsyncRAT Style SSL Cert
suricata: ET MALWARE Generic AsyncRAT Style SSL Cert
suricata
suricata: ET MALWARE Observed Malicious SSL Cert (AsyncRAT Server)
suricata: ET MALWARE Observed Malicious SSL Cert (AsyncRAT Server)
suricata

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral2/memory/1952-133-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4656 set thread context of 1952	4656	a6a36115e072d7ef31b40277e4695e2c.exe	93

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
4656	a6a36115e072d7ef31b40277e4695e2c.exe
4656	a6a36115e072d7ef31b40277e4695e2c.exe
4656	a6a36115e072d7ef31b40277e4695e2c.exe
4656	a6a36115e072d7ef31b40277e4695e2c.exe
4656	a6a36115e072d7ef31b40277e4695e2c.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4656	a6a36115e072d7ef31b40277e4695e2c.exe
Token: SeDebugPrivilege	1952	a6a36115e072d7ef31b40277e4695e2c.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 4656 wrote to memory of 1528	4656	a6a36115e072d7ef31b40277e4695e2c.exe	91
PID 4656 wrote to memory of 1528	4656	a6a36115e072d7ef31b40277e4695e2c.exe	91
PID 4656 wrote to memory of 1528	4656	a6a36115e072d7ef31b40277e4695e2c.exe	91
PID 4656 wrote to memory of 1960	4656	a6a36115e072d7ef31b40277e4695e2c.exe	92
PID 4656 wrote to memory of 1960	4656	a6a36115e072d7ef31b40277e4695e2c.exe	92
PID 4656 wrote to memory of 1960	4656	a6a36115e072d7ef31b40277e4695e2c.exe	92
PID 4656 wrote to memory of 1952	4656	a6a36115e072d7ef31b40277e4695e2c.exe	93
PID 4656 wrote to memory of 1952	4656	a6a36115e072d7ef31b40277e4695e2c.exe	93
PID 4656 wrote to memory of 1952	4656	a6a36115e072d7ef31b40277e4695e2c.exe	93
PID 4656 wrote to memory of 1952	4656	a6a36115e072d7ef31b40277e4695e2c.exe	93
PID 4656 wrote to memory of 1952	4656	a6a36115e072d7ef31b40277e4695e2c.exe	93
PID 4656 wrote to memory of 1952	4656	a6a36115e072d7ef31b40277e4695e2c.exe	93
PID 4656 wrote to memory of 1952	4656	a6a36115e072d7ef31b40277e4695e2c.exe	93
PID 4656 wrote to memory of 1952	4656	a6a36115e072d7ef31b40277e4695e2c.exe	93

C:\Users\Admin\AppData\Local\Temp\a6a36115e072d7ef31b40277e4695e2c.exe
"C:\Users\Admin\AppData\Local\Temp\a6a36115e072d7ef31b40277e4695e2c.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4656
- C:\Users\Admin\AppData\Local\Temp\a6a36115e072d7ef31b40277e4695e2c.exe
  "{path}"
  2⤵
  PID:1528
- C:\Users\Admin\AppData\Local\Temp\a6a36115e072d7ef31b40277e4695e2c.exe
  "{path}"
  2⤵
  PID:1960
- C:\Users\Admin\AppData\Local\Temp\a6a36115e072d7ef31b40277e4695e2c.exe
  "{path}"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1952

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1952-133-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/1952-134-0x0000000005430000-0x0000000005496000-memory.dmp

Download

memory/4656-124-0x0000000000D20000-0x0000000000D8C000-memory.dmp

Download

memory/4656-125-0x00000000056F0000-0x000000000578C000-memory.dmp

Download

memory/4656-126-0x0000000005DB0000-0x0000000006354000-memory.dmp

Download

memory/4656-127-0x00000000058A0000-0x0000000005932000-memory.dmp

Download

memory/4656-128-0x00000000057D0000-0x00000000057DA000-memory.dmp

Download

memory/4656-129-0x0000000005A30000-0x0000000005A86000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads