asyncrat | 15ec1422db74fb41b7d086c608055aa1c3f9bb15fd5c3bfb40412f03d3eba565

Analysis

max time kernel
138s
max time network
195s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
07/12/2022, 11:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d32f06aa276a1ef87396ca0692f74214.exe
Size 160KB
Sample221207-n47drseb86
SHA256 15ec1422db74fb41b7d086c608055aa1c3f9bb15fd5c3bfb40412f03d3eba565
MD5 d32f06aa276a1ef87396ca0692f74214
SHA1 60f910d6a81e4978a803ad6e5388afb21a435a9a
SHA512 e8b07c4321c1173d5d9ea591bd4ac59047a77843439c59b841ffc92657074ad1a12f4fc0aa9098e514777356c31d57f1fb124effc6f6b8505c5153ea48bae4f7
SSDEEP 3072:p9ywHtYCIHfecjxrW4l248V3FMrF4MdFU0ohs8:NHtYjfrCVdKrLTU0o
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

asyncrat default rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

Default

chinasea.duckdns.org:5201

Mutex

AsyncMutex_6SI8OkPnk

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
rat asyncrat

Async RAT payload 6 IoCs

rat

resource	yara_rule
behavioral1/memory/772-62-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat
behavioral1/memory/772-63-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat
behavioral1/memory/772-64-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat
behavioral1/memory/772-65-0x000000000040C72E-mapping.dmp	asyncrat
behavioral1/memory/772-67-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat
behavioral1/memory/772-69-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Systhhdfhsdem.exe	Powershell.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Systhhdfhsdem.exe	Powershell.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1736 set thread context of 772	1736	d32f06aa276a1ef87396ca0692f74214.exe	30

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
944	Powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1736	d32f06aa276a1ef87396ca0692f74214.exe
Token: SeDebugPrivilege	944	Powershell.exe
Token: SeDebugPrivilege	772	RegSvcs.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1736 wrote to memory of 944	1736	d32f06aa276a1ef87396ca0692f74214.exe	28
PID 1736 wrote to memory of 944	1736	d32f06aa276a1ef87396ca0692f74214.exe	28
PID 1736 wrote to memory of 944	1736	d32f06aa276a1ef87396ca0692f74214.exe	28
PID 1736 wrote to memory of 944	1736	d32f06aa276a1ef87396ca0692f74214.exe	28
PID 1736 wrote to memory of 772	1736	d32f06aa276a1ef87396ca0692f74214.exe	30
PID 1736 wrote to memory of 772	1736	d32f06aa276a1ef87396ca0692f74214.exe	30
PID 1736 wrote to memory of 772	1736	d32f06aa276a1ef87396ca0692f74214.exe	30
PID 1736 wrote to memory of 772	1736	d32f06aa276a1ef87396ca0692f74214.exe	30
PID 1736 wrote to memory of 772	1736	d32f06aa276a1ef87396ca0692f74214.exe	30
PID 1736 wrote to memory of 772	1736	d32f06aa276a1ef87396ca0692f74214.exe	30
PID 1736 wrote to memory of 772	1736	d32f06aa276a1ef87396ca0692f74214.exe	30
PID 1736 wrote to memory of 772	1736	d32f06aa276a1ef87396ca0692f74214.exe	30
PID 1736 wrote to memory of 772	1736	d32f06aa276a1ef87396ca0692f74214.exe	30
PID 1736 wrote to memory of 772	1736	d32f06aa276a1ef87396ca0692f74214.exe	30
PID 1736 wrote to memory of 772	1736	d32f06aa276a1ef87396ca0692f74214.exe	30
PID 1736 wrote to memory of 772	1736	d32f06aa276a1ef87396ca0692f74214.exe	30

C:\Users\Admin\AppData\Local\Temp\d32f06aa276a1ef87396ca0692f74214.exe
"C:\Users\Admin\AppData\Local\Temp\d32f06aa276a1ef87396ca0692f74214.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1736
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Powershell.exe
  "Powershell" Copy-Item 'C:\Users\Admin\AppData\Local\Temp\d32f06aa276a1ef87396ca0692f74214.exe' 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Systhhdfhsdem.exe'
  2⤵
  - Drops startup file
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:944
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:772

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/772-67-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/772-63-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/772-69-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/772-59-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/772-60-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/772-64-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/772-62-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/944-70-0x0000000071CD0000-0x000000007227B000-memory.dmp

Download

memory/944-72-0x0000000071CD0000-0x000000007227B000-memory.dmp

Download

memory/1736-55-0x0000000075C81000-0x0000000075C83000-memory.dmp

Download

memory/1736-54-0x0000000000020000-0x000000000004E000-memory.dmp

Download

memory/1736-57-0x0000000000270000-0x000000000028C000-memory.dmp

Download