asyncrat | e98df30ddb2e8b105e23e7d5e7c913f1cb7d2ef963def3030853daa91f71b75d

Analysis

max time kernel
125s
max time network
149s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
05-12-2022 06:25

Target

e98df30ddb2e8b105e23e7d5e7c913f1cb7d2ef963def3030853daa91f71b75d.exe
Size

1.1MB
MD5

19590a0af1f36d0aa9e9f7515a5ee7b7
SHA1

ba3812e84be2d9fe890b8398abdc26a3a1d05331
SHA256

e98df30ddb2e8b105e23e7d5e7c913f1cb7d2ef963def3030853daa91f71b75d
SHA512

57d915c8608f07517951fe644abef0505eee8455c3d10d563798d835dde9617a2453d64cf8683e1cb9a720643859af1981dede17f1f91de122ed458ace582b16
SSDEEP

24576:Ob2aCoEYQ68QyzJdmDMbmMNIhfntXoYyLb2rARuG:No3Q0yzPmgb/IvYYWb2rAR

Score

10^/10

Family

asyncrat

Version

0.5.7B

Botnet

luxy2sdds

asnyc2020.ddns.net:2119

Mutex

AsyncMutex_6SI8OkPnk

Attributes

aes.plain

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
rat asyncrat

Async RAT payload 6 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1732-59-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat
behavioral1/memory/1732-60-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat
behavioral1/memory/1732-61-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat
behavioral1/memory/1732-62-0x000000000040C74E-mapping.dmp	asyncrat
behavioral1/memory/1732-64-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat
behavioral1/memory/1732-66-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat

Suspicious use of SetThreadContext 1 IoCs

Processes:

e98df30ddb2e8b105e23e7d5e7c913f1cb7d2ef963def3030853daa91f71b75d.exe

description	pid	process	target process
PID 912 set thread context of 1732	912	e98df30ddb2e8b105e23e7d5e7c913f1cb7d2ef963def3030853daa91f71b75d.exe	RegAsm.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

e98df30ddb2e8b105e23e7d5e7c913f1cb7d2ef963def3030853daa91f71b75d.exe

description	pid	process	target process
PID 912 wrote to memory of 1732	912	e98df30ddb2e8b105e23e7d5e7c913f1cb7d2ef963def3030853daa91f71b75d.exe	RegAsm.exe
PID 912 wrote to memory of 1732	912	e98df30ddb2e8b105e23e7d5e7c913f1cb7d2ef963def3030853daa91f71b75d.exe	RegAsm.exe
PID 912 wrote to memory of 1732	912	e98df30ddb2e8b105e23e7d5e7c913f1cb7d2ef963def3030853daa91f71b75d.exe	RegAsm.exe
PID 912 wrote to memory of 1732	912	e98df30ddb2e8b105e23e7d5e7c913f1cb7d2ef963def3030853daa91f71b75d.exe	RegAsm.exe
PID 912 wrote to memory of 1732	912	e98df30ddb2e8b105e23e7d5e7c913f1cb7d2ef963def3030853daa91f71b75d.exe	RegAsm.exe
PID 912 wrote to memory of 1732	912	e98df30ddb2e8b105e23e7d5e7c913f1cb7d2ef963def3030853daa91f71b75d.exe	RegAsm.exe
PID 912 wrote to memory of 1732	912	e98df30ddb2e8b105e23e7d5e7c913f1cb7d2ef963def3030853daa91f71b75d.exe	RegAsm.exe
PID 912 wrote to memory of 1732	912	e98df30ddb2e8b105e23e7d5e7c913f1cb7d2ef963def3030853daa91f71b75d.exe	RegAsm.exe
PID 912 wrote to memory of 1732	912	e98df30ddb2e8b105e23e7d5e7c913f1cb7d2ef963def3030853daa91f71b75d.exe	RegAsm.exe
PID 912 wrote to memory of 1732	912	e98df30ddb2e8b105e23e7d5e7c913f1cb7d2ef963def3030853daa91f71b75d.exe	RegAsm.exe
PID 912 wrote to memory of 1732	912	e98df30ddb2e8b105e23e7d5e7c913f1cb7d2ef963def3030853daa91f71b75d.exe	RegAsm.exe
PID 912 wrote to memory of 1732	912	e98df30ddb2e8b105e23e7d5e7c913f1cb7d2ef963def3030853daa91f71b75d.exe	RegAsm.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
2⤵
PID:1732

memory/912-54-0x0000000000880000-0x00000000009AA000-memory.dmp

Filesize
1.2MB

Download
memory/912-55-0x0000000000A30000-0x0000000000AC2000-memory.dmp

Filesize
584KB

Download
memory/1732-56-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1732-57-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1732-59-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1732-60-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1732-61-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1732-62-0x000000000040C74E-mapping.dmp

Download
memory/1732-64-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1732-66-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1732-67-0x00000000761F1000-0x00000000761F3000-memory.dmp

Filesize
8KB

Download