asyncrat | 39ae1a73d9326d866c0ea79742243790ed3aeeceac161f1a23f7b0c7b84b4570 | Triage

Analysis

max time kernel
39s
max time network
157s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
01-12-2022 07:38

Sharing

Report Analysis Logs

General

Target

tmp.exe
Size

47KB
MD5

6d717fe6e6123691c7d9ffee92625c2f
SHA1

ac8e4b99c2398a48884805255f2fa90daf0dff3c
SHA256

39ae1a73d9326d866c0ea79742243790ed3aeeceac161f1a23f7b0c7b84b4570
SHA512

2b1d1ef8cc59b9916ccea5712609117d99576d59d3376bfe187eca473f988c0c76bc16dfff75d0e936af769963e13135f2f5f45ae7d4b62c619ffb88d20afdf8
SSDEEP

768:R/IO5VILWCyh+DiWtelDSN+iV08YbygejovEgK/J/ZVc6KN:R/PNWtKDs4zb1BnkJ/ZVclN

Score

10^/10

asyncrat default rat

Malware Config

Extracted

Family

asyncrat

Version

1.0.7

Botnet

Default

C2

193.233.48.17:8848

Mutex

dfas9asdf8as8z

Attributes

delay
1
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
rat asyncrat

Async RAT payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/288-54-0x0000000001000000-0x0000000001012000-memory.dmp	asyncrat

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

tmp.exe

description pid process

Token: SeDebugPrivilege 288 tmp.exe

C:\Users\Admin\AppData\Local\Temp\tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmp.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:288

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/288-54-0x0000000001000000-0x0000000001012000-memory.dmp

Filesize
72KB

Download