asyncrat | 8d69095834bac3c4cc270b37c761cc10a1279c659dd8c77b82f86e45274a313a

Analysis

max time kernel
45s
max time network
150s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
28-11-2022 10:07

Target

file.exe
Size

363KB
MD5

8fd9d9f8b6259e5e2eb5648b7db40733
SHA1

61ca93864ded26999f7a41db60a5c0737421a8c4
SHA256

8d69095834bac3c4cc270b37c761cc10a1279c659dd8c77b82f86e45274a313a
SHA512

81edf1ab2758b73a185430e845be95d56ed7b9375ea49adbac76dec1306a68f4795ea1d330bc80517a2303f67154f90eeb845847a055863e96927e610b33e746
SSDEEP

6144:grXQlEcjUxw3NrtRI+Z98d2qqU61rZLBteQpnAYxUx9:grXQlxjvp8YqqLt3te4ABx

Score

10^/10

Family

asyncrat

Version

1.0.7

Botnet

Installs

185.81.157.202:5555

Mutex

E786210B-B764-434F-8BB7-DD5EBC016A57

Attributes

aes.plain

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
rat asyncrat

Async RAT payload 6 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1324-60-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat
behavioral1/memory/1324-59-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat
behavioral1/memory/1324-61-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat
behavioral1/memory/1324-62-0x000000000040CB9E-mapping.dmp	asyncrat
behavioral1/memory/1324-64-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat
behavioral1/memory/1324-66-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat

Suspicious use of SetThreadContext 1 IoCs

Processes:

file.exe

description pid process target process

PID 1352 set thread context of 1324 1352 file.exe aspnet_compiler.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

aspnet_compiler.exe

description pid process

Token: SeDebugPrivilege 1324 aspnet_compiler.exe

description	pid	process	target process
PID 1352 set thread context of 1324	1352	file.exe	aspnet_compiler.exe

description	pid	process
Token: SeDebugPrivilege	1324	aspnet_compiler.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

file.exe

description	pid	process	target process
PID 1352 wrote to memory of 1324	1352	file.exe	aspnet_compiler.exe
PID 1352 wrote to memory of 1324	1352	file.exe	aspnet_compiler.exe
PID 1352 wrote to memory of 1324	1352	file.exe	aspnet_compiler.exe
PID 1352 wrote to memory of 1324	1352	file.exe	aspnet_compiler.exe
PID 1352 wrote to memory of 1324	1352	file.exe	aspnet_compiler.exe
PID 1352 wrote to memory of 1324	1352	file.exe	aspnet_compiler.exe
PID 1352 wrote to memory of 1324	1352	file.exe	aspnet_compiler.exe
PID 1352 wrote to memory of 1324	1352	file.exe	aspnet_compiler.exe
PID 1352 wrote to memory of 1324	1352	file.exe	aspnet_compiler.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1324

memory/1324-56-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1324-57-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1324-60-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1324-59-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1324-61-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1324-62-0x000000000040CB9E-mapping.dmp

Download
memory/1324-64-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1324-66-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1324-67-0x0000000075B51000-0x0000000075B53000-memory.dmp

Filesize
8KB

Download
memory/1352-54-0x0000000000280000-0x00000000002E2000-memory.dmp

Filesize
392KB

Download
memory/1352-55-0x0000000000350000-0x0000000000358000-memory.dmp

Filesize
32KB

Download