asyncrat | b5152c3adf4885ee9c9542802d9c6f5dc2cbd8a0f467780ff9622058028e6b50 | Triage

Analysis

max time kernel
45s
max time network
154s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
03-10-2022 17:07

Sharing

Report Analysis Logs

General

Target

39bd1ac6a67c3f95c0f007265bac7c5d.exe
Size

76KB
MD5

39bd1ac6a67c3f95c0f007265bac7c5d
SHA1

20a557cb54acfe2c64673b44a0cd6f7bfd27047e
SHA256

b5152c3adf4885ee9c9542802d9c6f5dc2cbd8a0f467780ff9622058028e6b50
SHA512

670d12229e86065dac4dad37fff40247aa83b41c8a1d636f7cade1d98d8ccc1ed168e5f5715b2cde2787e0d8b8f3b4db082cc04a54ad2b36bb0708302647d054
SSDEEP

1536:PBkwyaSaVr5yQUdlBG456ihZAGXDBnio9JL:pPya/VrEQMlqihqotJL

Score

10^/10

asyncrat rat

Malware Config

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
rat asyncrat

Async RAT payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1292-54-0x0000000000270000-0x000000000028A000-memory.dmp	asyncrat

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

39bd1ac6a67c3f95c0f007265bac7c5d.exe

description pid process

Token: SeDebugPrivilege 1292 39bd1ac6a67c3f95c0f007265bac7c5d.exe

C:\Users\Admin\AppData\Local\Temp\39bd1ac6a67c3f95c0f007265bac7c5d.exe
"C:\Users\Admin\AppData\Local\Temp\39bd1ac6a67c3f95c0f007265bac7c5d.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1292

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1292-54-0x0000000000270000-0x000000000028A000-memory.dmp

Filesize
104KB

Download
memory/1292-55-0x00000000003B0000-0x00000000003BA000-memory.dmp

Filesize
40KB

Download