asyncrat | 5b0a3e7a54417c206be93da0f4f4be8aa344b1895292418946cea2bc85239d10

Analysis

max time kernel
196s
max time network
218s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
28-11-2022 12:19

Target

OJSeFyaLzDF0XdG.exe
Size

523KB
MD5

62fde40de2248ee19d5c657238b38c5a
SHA1

70fe5d51b3b0bc0a4ea041f134bbbf91c58038c0
SHA256

f0e61a30a68cacde89ef636511dfae2b488bcbe9b47053c3afc0718d66324f70
SHA512

bb6bd64ff64a8729a748889c007ac2b8dc61eef5a181d4e5284f8d03b6e71a974580aec36f8beac7f480fe416fa759756a716894c12c9e9a1320520a9bf39465
SSDEEP

12288:gvYApSXICFZ6kg/gc+nE9xxi1VnXK1EU6fRJ:gjpQICfgyEv

Score

10^/10

Family

asyncrat

Version

0.5.7B

Botnet

Default

famous147.ddns.net:8089

Mutex

AsyncMutex_6SI8OkPnk

Attributes

aes.plain

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
rat asyncrat

Async RAT payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/4112-138-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat

Suspicious use of SetThreadContext 1 IoCs

Processes:

OJSeFyaLzDF0XdG.exe

description pid process target process

PID 5028 set thread context of 4112 5028 OJSeFyaLzDF0XdG.exe RegSvcs.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

OJSeFyaLzDF0XdG.exe

pid process

5028 OJSeFyaLzDF0XdG.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

OJSeFyaLzDF0XdG.exe

description pid process

Token: SeDebugPrivilege 5028 OJSeFyaLzDF0XdG.exe

description	pid	process	target process
PID 5028 set thread context of 4112	5028	OJSeFyaLzDF0XdG.exe	RegSvcs.exe

pid	process
5028	OJSeFyaLzDF0XdG.exe

description	pid	process
Token: SeDebugPrivilege	5028	OJSeFyaLzDF0XdG.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

OJSeFyaLzDF0XdG.exe

description	pid	process	target process
PID 5028 wrote to memory of 4112	5028	OJSeFyaLzDF0XdG.exe	RegSvcs.exe
PID 5028 wrote to memory of 4112	5028	OJSeFyaLzDF0XdG.exe	RegSvcs.exe
PID 5028 wrote to memory of 4112	5028	OJSeFyaLzDF0XdG.exe	RegSvcs.exe
PID 5028 wrote to memory of 4112	5028	OJSeFyaLzDF0XdG.exe	RegSvcs.exe
PID 5028 wrote to memory of 4112	5028	OJSeFyaLzDF0XdG.exe	RegSvcs.exe
PID 5028 wrote to memory of 4112	5028	OJSeFyaLzDF0XdG.exe	RegSvcs.exe
PID 5028 wrote to memory of 4112	5028	OJSeFyaLzDF0XdG.exe	RegSvcs.exe
PID 5028 wrote to memory of 4112	5028	OJSeFyaLzDF0XdG.exe	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\OJSeFyaLzDF0XdG.exe
"C:\Users\Admin\AppData\Local\Temp\OJSeFyaLzDF0XdG.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5028
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "{path}"
  2⤵
  PID:4112

memory/4112-137-0x0000000000000000-mapping.dmp

Download
memory/4112-138-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/5028-132-0x0000000000C70000-0x0000000000CF8000-memory.dmp

Filesize
544KB

Download
memory/5028-133-0x0000000005B70000-0x0000000006114000-memory.dmp

Filesize
5.6MB

Download
memory/5028-134-0x00000000056A0000-0x0000000005732000-memory.dmp

Filesize
584KB

Download
memory/5028-135-0x00000000057E0000-0x000000000587C000-memory.dmp

Filesize
624KB

Download
memory/5028-136-0x0000000005740000-0x000000000574A000-memory.dmp

Filesize
40KB

Download