asyncrat | 8d69095834bac3c4cc270b37c761cc10a1279c659dd8c77b82f86e45274a313a

Analysis

max time kernel
173s
max time network
186s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
28-11-2022 10:07

Target

file.exe
Size

363KB
MD5

8fd9d9f8b6259e5e2eb5648b7db40733
SHA1

61ca93864ded26999f7a41db60a5c0737421a8c4
SHA256

8d69095834bac3c4cc270b37c761cc10a1279c659dd8c77b82f86e45274a313a
SHA512

81edf1ab2758b73a185430e845be95d56ed7b9375ea49adbac76dec1306a68f4795ea1d330bc80517a2303f67154f90eeb845847a055863e96927e610b33e746
SSDEEP

6144:grXQlEcjUxw3NrtRI+Z98d2qqU61rZLBteQpnAYxUx9:grXQlxjvp8YqqLt3te4ABx

Score

10^/10

Family

asyncrat

Version

1.0.7

Botnet

Installs

185.81.157.202:5555

Mutex

E786210B-B764-434F-8BB7-DD5EBC016A57

Attributes

aes.plain

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
rat asyncrat

Async RAT payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/4940-137-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat

Suspicious use of SetThreadContext 1 IoCs

Processes:

file.exe

description pid process target process

PID 1168 set thread context of 4940 1168 file.exe aspnet_compiler.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

aspnet_compiler.exe

description pid process

Token: SeDebugPrivilege 4940 aspnet_compiler.exe

description	pid	process	target process
PID 1168 set thread context of 4940	1168	file.exe	aspnet_compiler.exe

description	pid	process
Token: SeDebugPrivilege	4940	aspnet_compiler.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

file.exe

description	pid	process	target process
PID 1168 wrote to memory of 4940	1168	file.exe	aspnet_compiler.exe
PID 1168 wrote to memory of 4940	1168	file.exe	aspnet_compiler.exe
PID 1168 wrote to memory of 4940	1168	file.exe	aspnet_compiler.exe
PID 1168 wrote to memory of 4940	1168	file.exe	aspnet_compiler.exe
PID 1168 wrote to memory of 4940	1168	file.exe	aspnet_compiler.exe
PID 1168 wrote to memory of 4940	1168	file.exe	aspnet_compiler.exe
PID 1168 wrote to memory of 4940	1168	file.exe	aspnet_compiler.exe
PID 1168 wrote to memory of 4940	1168	file.exe	aspnet_compiler.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:4940

memory/1168-132-0x0000000000800000-0x0000000000862000-memory.dmp

Filesize
392KB

Download
memory/1168-133-0x00000000051E0000-0x000000000527C000-memory.dmp

Filesize
624KB

Download
memory/1168-134-0x0000000005280000-0x00000000052F6000-memory.dmp

Filesize
472KB

Download
memory/1168-135-0x0000000005320000-0x000000000533E000-memory.dmp

Filesize
120KB

Download
memory/4940-136-0x0000000000000000-mapping.dmp

Download
memory/4940-137-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/4940-138-0x00000000061F0000-0x0000000006794000-memory.dmp

Filesize
5.6MB

Download
memory/4940-139-0x0000000005CB0000-0x0000000005D16000-memory.dmp

Filesize
408KB

Download