asyncrat | 14d449fbc2ed1f0bf002d0c599b96ae52c5d77e60ed8714f74aa2e8c7aa8a3eb

General

Target

14d449fbc2ed1f0bf002d0c599b96ae52c5d77e60ed8714f74aa2e8c7aa8a3eb.exe
Size

682KB
MD5

80bb1cba6800f593cf722f35eecf2651
SHA1

ec57b4c93f8e53ba5e2118b2c642b6c83694e0c9
SHA256

14d449fbc2ed1f0bf002d0c599b96ae52c5d77e60ed8714f74aa2e8c7aa8a3eb
SHA512

160782272319358cd5608d1ffa9cb7ee0acfef657366e688b3b944902b2a9221b970fc2a7e55bbd0eb576257070e500f48ebdf9a4a6d49cda57c9e1ce93e1fd4

Score

10^/10

asyncrat default rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.7A

Botnet

Default

C2

klol.ddns.net:5353

Mutex

pbkkxzhztwvqna

Attributes

delay
1
install
false
install_file
klol.exe
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
rat asyncrat

Async RAT payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/672-157-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat

Suspicious use of SetThreadContext 1 IoCs

Processes:

14d449fbc2ed1f0bf002d0c599b96ae52c5d77e60ed8714f74aa2e8c7aa8a3eb.exe

description	pid	process	target process
PID 1964 set thread context of 672	1964	14d449fbc2ed1f0bf002d0c599b96ae52c5d77e60ed8714f74aa2e8c7aa8a3eb.exe	aspnet_compiler.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

14d449fbc2ed1f0bf002d0c599b96ae52c5d77e60ed8714f74aa2e8c7aa8a3eb.exe

description pid process

Token: SeDebugPrivilege 1964 14d449fbc2ed1f0bf002d0c599b96ae52c5d77e60ed8714f74aa2e8c7aa8a3eb.exe

description	pid	process
Token: SeDebugPrivilege	1964	14d449fbc2ed1f0bf002d0c599b96ae52c5d77e60ed8714f74aa2e8c7aa8a3eb.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

14d449fbc2ed1f0bf002d0c599b96ae52c5d77e60ed8714f74aa2e8c7aa8a3eb.exe

description	pid	process	target process
PID 1964 wrote to memory of 672	1964	14d449fbc2ed1f0bf002d0c599b96ae52c5d77e60ed8714f74aa2e8c7aa8a3eb.exe	aspnet_compiler.exe
PID 1964 wrote to memory of 672	1964	14d449fbc2ed1f0bf002d0c599b96ae52c5d77e60ed8714f74aa2e8c7aa8a3eb.exe	aspnet_compiler.exe
PID 1964 wrote to memory of 672	1964	14d449fbc2ed1f0bf002d0c599b96ae52c5d77e60ed8714f74aa2e8c7aa8a3eb.exe	aspnet_compiler.exe
PID 1964 wrote to memory of 672	1964	14d449fbc2ed1f0bf002d0c599b96ae52c5d77e60ed8714f74aa2e8c7aa8a3eb.exe	aspnet_compiler.exe
PID 1964 wrote to memory of 672	1964	14d449fbc2ed1f0bf002d0c599b96ae52c5d77e60ed8714f74aa2e8c7aa8a3eb.exe	aspnet_compiler.exe
PID 1964 wrote to memory of 672	1964	14d449fbc2ed1f0bf002d0c599b96ae52c5d77e60ed8714f74aa2e8c7aa8a3eb.exe	aspnet_compiler.exe
PID 1964 wrote to memory of 672	1964	14d449fbc2ed1f0bf002d0c599b96ae52c5d77e60ed8714f74aa2e8c7aa8a3eb.exe	aspnet_compiler.exe
PID 1964 wrote to memory of 672	1964	14d449fbc2ed1f0bf002d0c599b96ae52c5d77e60ed8714f74aa2e8c7aa8a3eb.exe	aspnet_compiler.exe

C:\Users\Admin\AppData\Local\Temp\14d449fbc2ed1f0bf002d0c599b96ae52c5d77e60ed8714f74aa2e8c7aa8a3eb.exe
"C:\Users\Admin\AppData\Local\Temp\14d449fbc2ed1f0bf002d0c599b96ae52c5d77e60ed8714f74aa2e8c7aa8a3eb.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1964

C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
2⤵
PID:672

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/672-156-0x0000000000000000-mapping.dmp

Download
memory/672-157-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1964-144-0x0000000005C50000-0x0000000005C5C000-memory.dmp

Filesize
48KB

Download
memory/1964-134-0x0000000005A90000-0x0000000005A9C000-memory.dmp

Filesize
48KB

Download
memory/1964-145-0x0000000005CB0000-0x0000000005CBE000-memory.dmp

Filesize
56KB

Download
memory/1964-146-0x0000000005CC0000-0x0000000005CCA000-memory.dmp

Filesize
40KB

Download
memory/1964-136-0x00000000063A0000-0x00000000068CC000-memory.dmp

Filesize
5.2MB

Download
memory/1964-137-0x0000000005B80000-0x0000000005B8E000-memory.dmp

Filesize
56KB

Download
memory/1964-138-0x0000000005BD0000-0x0000000005BF2000-memory.dmp

Filesize
136KB

Download
memory/1964-139-0x0000000005C10000-0x0000000005C2C000-memory.dmp

Filesize
112KB

Download
memory/1964-140-0x0000000005C30000-0x0000000005C5C000-memory.dmp

Filesize
176KB

Download
memory/1964-141-0x0000000005C30000-0x0000000005C44000-memory.dmp

Filesize
80KB

Download
memory/1964-142-0x0000000005BA0000-0x0000000005BA8000-memory.dmp

Filesize
32KB

Download
memory/1964-143-0x0000000005C90000-0x0000000005CAA000-memory.dmp

Filesize
104KB

Download
memory/1964-131-0x0000000006300000-0x000000000639C000-memory.dmp

Filesize
624KB

Download
memory/1964-133-0x0000000005A80000-0x0000000005A8C000-memory.dmp

Filesize
48KB

Download
memory/1964-135-0x0000000005B10000-0x0000000005B20000-memory.dmp

Filesize
64KB

Download
memory/1964-147-0x0000000005D20000-0x0000000005D60000-memory.dmp

Filesize
256KB

Download
memory/1964-148-0x0000000005D00000-0x0000000005D18000-memory.dmp

Filesize
96KB

Download
memory/1964-149-0x0000000005D20000-0x0000000005D32000-memory.dmp

Filesize
72KB

Download
memory/1964-150-0x0000000005CE0000-0x0000000005CEE000-memory.dmp

Filesize
56KB

Download
memory/1964-151-0x0000000005DD0000-0x0000000005DF4000-memory.dmp

Filesize
144KB

Download
memory/1964-152-0x0000000005DD0000-0x0000000005DF8000-memory.dmp

Filesize
160KB

Download
memory/1964-153-0x00000000070B0000-0x0000000007654000-memory.dmp

Filesize
5.6MB

Download
memory/1964-154-0x0000000005FB0000-0x0000000006042000-memory.dmp

Filesize
584KB

Download
memory/1964-155-0x0000000005E60000-0x0000000005E6A000-memory.dmp

Filesize
40KB

Download
memory/1964-132-0x0000000005A50000-0x0000000005A5C000-memory.dmp

Filesize
48KB

Download
memory/1964-130-0x0000000000F70000-0x000000000101E000-memory.dmp

Filesize
696KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads