asyncrat | c96718e4f79dbc5e868f55720c77af071011de9b7dbd239243cc8a8604235822

Analysis

max time kernel
185s
max time network
217s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
04-10-2022 08:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a2488b9d02c16c8f4227e7657d066c47.exe
Size

76KB
MD5

a2488b9d02c16c8f4227e7657d066c47
SHA1

de1a49fc402e04109f1549846c542cb0aa483371
SHA256

c96718e4f79dbc5e868f55720c77af071011de9b7dbd239243cc8a8604235822
SHA512

2771ae5cc4b024750c76528cf5a678af44d56950663a859a36aaa5d0bedacd39a65a7a1e10197511a5b0ae7cd803ddfc0f8d18956b418b2a6eb4f20a0829713c
SSDEEP

1536:/wwwmEsKq68kCKQtkGtJaYDxG+wlDOFjZNIduA/F4Ro9:/wwwmEsKq68kCKQtkG/aoE+ODgjZN0uc

Score

10^/10

asyncrat drax rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

drax

azazws6606.linkpc.net:6606

Mutex

AsyncMutex_6SI8OkPnk

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
rat asyncrat

Async RAT payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/2660-135-0x00000000005C0000-0x00000000005D2000-memory.dmp	asyncrat

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064
Suspicious use of SetThreadContext 1 IoCs

Processes:

a2488b9d02c16c8f4227e7657d066c47.exe

description pid process target process

PID 4524 set thread context of 2660 4524 a2488b9d02c16c8f4227e7657d066c47.exe vbc.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

vbc.exe

description pid process

Token: SeDebugPrivilege 2660 vbc.exe

description	pid	process	target process
PID 4524 set thread context of 2660	4524	a2488b9d02c16c8f4227e7657d066c47.exe	vbc.exe

description	pid	process
Token: SeDebugPrivilege	2660	vbc.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

a2488b9d02c16c8f4227e7657d066c47.exe

description	pid	process	target process
PID 4524 wrote to memory of 2660	4524	a2488b9d02c16c8f4227e7657d066c47.exe	vbc.exe
PID 4524 wrote to memory of 2660	4524	a2488b9d02c16c8f4227e7657d066c47.exe	vbc.exe
PID 4524 wrote to memory of 2660	4524	a2488b9d02c16c8f4227e7657d066c47.exe	vbc.exe
PID 4524 wrote to memory of 2660	4524	a2488b9d02c16c8f4227e7657d066c47.exe	vbc.exe
PID 4524 wrote to memory of 2660	4524	a2488b9d02c16c8f4227e7657d066c47.exe	vbc.exe
PID 4524 wrote to memory of 2660	4524	a2488b9d02c16c8f4227e7657d066c47.exe	vbc.exe
PID 4524 wrote to memory of 2660	4524	a2488b9d02c16c8f4227e7657d066c47.exe	vbc.exe
PID 4524 wrote to memory of 2660	4524	a2488b9d02c16c8f4227e7657d066c47.exe	vbc.exe

C:\Users\Admin\AppData\Local\Temp\a2488b9d02c16c8f4227e7657d066c47.exe
"C:\Users\Admin\AppData\Local\Temp\a2488b9d02c16c8f4227e7657d066c47.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4524

C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2660

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

T1064

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2660-133-0x0000000000000000-mapping.dmp

Download
memory/2660-134-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2660-135-0x00000000005C0000-0x00000000005D2000-memory.dmp

Filesize
72KB

Download
memory/2660-136-0x0000000005220000-0x00000000052BC000-memory.dmp

Filesize
624KB

Download
memory/2660-137-0x0000000005870000-0x0000000005E14000-memory.dmp

Filesize
5.6MB

Download
memory/2660-138-0x00000000052C0000-0x0000000005326000-memory.dmp

Filesize
408KB

Download
memory/4524-132-0x0000000000630000-0x000000000064A000-memory.dmp

Filesize
104KB

Download