asyncrat | 111a4d926a4c6cf6eab9ad519c381db560fea5aec1ef5ad6ac427f034dbd825d | Triage

Analysis

max time kernel
43s
max time network
153s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
05-10-2022 10:04

Sharing

Report Analysis Logs

General

Target

b7fdc8ea85c9b3b6a7db8dffa6e6ab40.exe
Size

47KB
MD5

b7fdc8ea85c9b3b6a7db8dffa6e6ab40
SHA1

c0ae5d7dd6cdb4f3be8fb01db26ffcd5fe078f76
SHA256

111a4d926a4c6cf6eab9ad519c381db560fea5aec1ef5ad6ac427f034dbd825d
SHA512

de83e7aa181fcf022c1b29d352a626f7b575604e2c801f763fb0409a26b0101eca6bc49862b6a24c7a73054802a181184206ef5a56c3fb87ae99fd1c8315943e
SSDEEP

768:dOEuILWCKi+DinObi/UYbJge1I8vXuvEgK/J9lZVc6KN:dOtmntbbGHnkJ3ZVclN

Score

10^/10

asyncrat default rat

Malware Config

Extracted

Family

asyncrat

Version

1.0.7

Botnet

Default

C2

44.192.67.149:4784

Mutex

DcRatMutex_qwqdanchun

Attributes

delay
1
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
rat asyncrat

Async RAT payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1100-54-0x0000000000A10000-0x0000000000A22000-memory.dmp	asyncrat

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

b7fdc8ea85c9b3b6a7db8dffa6e6ab40.exe

description pid process

Token: SeDebugPrivilege 1100 b7fdc8ea85c9b3b6a7db8dffa6e6ab40.exe

C:\Users\Admin\AppData\Local\Temp\b7fdc8ea85c9b3b6a7db8dffa6e6ab40.exe
"C:\Users\Admin\AppData\Local\Temp\b7fdc8ea85c9b3b6a7db8dffa6e6ab40.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1100

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1100-54-0x0000000000A10000-0x0000000000A22000-memory.dmp

Filesize
72KB

Download