asyncrat | 38acb0a39a41cd025106836edc40beaa0b53cea2b7e5a3dcfebae8269b8f6c58

Analysis

max time kernel
90s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
07/12/2022, 11:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
98379a4b4b9f36794e4d85eedf2ccf8e.exe
Size 189KB
Sample221207-n47drseb85
SHA256 38acb0a39a41cd025106836edc40beaa0b53cea2b7e5a3dcfebae8269b8f6c58
MD5 98379a4b4b9f36794e4d85eedf2ccf8e
SHA1 7eabd6cf8bc2deecc6691c810146345f918213b9
SHA512 a5cceb8514f598f759e0dd9ba242fbbb7b029446d7d94f13b089da472dc8af52ec6014848b851bad67fe3ed268bb79db05284291e33e0bcdab58c2e05acdc63c
SSDEEP 3072:B3CX/huQkPjdYZ2kPTx6A9duTSzac6gEzGP7y3mw9mKlrqNPVJFUSo7c1Vwi:B0YQIiZJPT4RUAgvP7yVmKl+NPVJFUSw
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

asyncrat default rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

Default

chinasea.duckdns.org:5201

Mutex

AsyncMutex_6SI8OkPnk

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral2/memory/2320-141-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystJHKJHKem.exe	Powershell.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystJHKJHKem.exe	Powershell.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4256 set thread context of 2320	4256	98379a4b4b9f36794e4d85eedf2ccf8e.exe	91

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4256	98379a4b4b9f36794e4d85eedf2ccf8e.exe
4256	98379a4b4b9f36794e4d85eedf2ccf8e.exe
4256	98379a4b4b9f36794e4d85eedf2ccf8e.exe
4256	98379a4b4b9f36794e4d85eedf2ccf8e.exe
4832	Powershell.exe
4832	Powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4256	98379a4b4b9f36794e4d85eedf2ccf8e.exe
Token: SeDebugPrivilege	4832	Powershell.exe
Token: SeDebugPrivilege	2320	RegSvcs.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 4256 wrote to memory of 4832	4256	98379a4b4b9f36794e4d85eedf2ccf8e.exe	87
PID 4256 wrote to memory of 4832	4256	98379a4b4b9f36794e4d85eedf2ccf8e.exe	87
PID 4256 wrote to memory of 4832	4256	98379a4b4b9f36794e4d85eedf2ccf8e.exe	87
PID 4256 wrote to memory of 4840	4256	98379a4b4b9f36794e4d85eedf2ccf8e.exe	89
PID 4256 wrote to memory of 4840	4256	98379a4b4b9f36794e4d85eedf2ccf8e.exe	89
PID 4256 wrote to memory of 4840	4256	98379a4b4b9f36794e4d85eedf2ccf8e.exe	89
PID 4256 wrote to memory of 1820	4256	98379a4b4b9f36794e4d85eedf2ccf8e.exe	90
PID 4256 wrote to memory of 1820	4256	98379a4b4b9f36794e4d85eedf2ccf8e.exe	90
PID 4256 wrote to memory of 1820	4256	98379a4b4b9f36794e4d85eedf2ccf8e.exe	90
PID 4256 wrote to memory of 2320	4256	98379a4b4b9f36794e4d85eedf2ccf8e.exe	91
PID 4256 wrote to memory of 2320	4256	98379a4b4b9f36794e4d85eedf2ccf8e.exe	91
PID 4256 wrote to memory of 2320	4256	98379a4b4b9f36794e4d85eedf2ccf8e.exe	91
PID 4256 wrote to memory of 2320	4256	98379a4b4b9f36794e4d85eedf2ccf8e.exe	91
PID 4256 wrote to memory of 2320	4256	98379a4b4b9f36794e4d85eedf2ccf8e.exe	91
PID 4256 wrote to memory of 2320	4256	98379a4b4b9f36794e4d85eedf2ccf8e.exe	91
PID 4256 wrote to memory of 2320	4256	98379a4b4b9f36794e4d85eedf2ccf8e.exe	91
PID 4256 wrote to memory of 2320	4256	98379a4b4b9f36794e4d85eedf2ccf8e.exe	91

C:\Users\Admin\AppData\Local\Temp\98379a4b4b9f36794e4d85eedf2ccf8e.exe
"C:\Users\Admin\AppData\Local\Temp\98379a4b4b9f36794e4d85eedf2ccf8e.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4256
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Powershell.exe
  "Powershell" Copy-Item 'C:\Users\Admin\AppData\Local\Temp\98379a4b4b9f36794e4d85eedf2ccf8e.exe' 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystJHKJHKem.exe'
  2⤵
  - Drops startup file
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4832
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  PID:4840
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  PID:1820
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2320

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2320-141-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/4256-133-0x0000000004AB0000-0x0000000004B4C000-memory.dmp

Download

memory/4256-134-0x00000000097D0000-0x0000000009D74000-memory.dmp

Download

memory/4256-132-0x00000000000D0000-0x0000000000104000-memory.dmp

Download

memory/4832-136-0x0000000004B00000-0x0000000004B36000-memory.dmp

Download

memory/4832-137-0x0000000005170000-0x0000000005798000-memory.dmp

Download

memory/4832-142-0x00000000050D0000-0x00000000050F2000-memory.dmp

Download

memory/4832-143-0x00000000058D0000-0x0000000005936000-memory.dmp

Download

memory/4832-144-0x0000000005A40000-0x0000000005AA6000-memory.dmp

Download

memory/4832-145-0x0000000006090000-0x00000000060AE000-memory.dmp

Download

memory/4832-146-0x0000000007050000-0x00000000070E6000-memory.dmp

Download

memory/4832-147-0x0000000006550000-0x000000000656A000-memory.dmp

Download

memory/4832-148-0x00000000065A0000-0x00000000065C2000-memory.dmp

Download