asyncrat | 15ec1422db74fb41b7d086c608055aa1c3f9bb15fd5c3bfb40412f03d3eba565

Analysis

max time kernel
92s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
07/12/2022, 11:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d32f06aa276a1ef87396ca0692f74214.exe
Size 160KB
Sample221207-n47drseb86
SHA256 15ec1422db74fb41b7d086c608055aa1c3f9bb15fd5c3bfb40412f03d3eba565
MD5 d32f06aa276a1ef87396ca0692f74214
SHA1 60f910d6a81e4978a803ad6e5388afb21a435a9a
SHA512 e8b07c4321c1173d5d9ea591bd4ac59047a77843439c59b841ffc92657074ad1a12f4fc0aa9098e514777356c31d57f1fb124effc6f6b8505c5153ea48bae4f7
SSDEEP 3072:p9ywHtYCIHfecjxrW4l248V3FMrF4MdFU0ohs8:NHtYjfrCVdKrLTU0o
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

asyncrat default rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

Default

chinasea.duckdns.org:5201

Mutex

AsyncMutex_6SI8OkPnk

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral2/memory/3868-139-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Systhhdfhsdem.exe	Powershell.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Systhhdfhsdem.exe	Powershell.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 392 set thread context of 3868	392	d32f06aa276a1ef87396ca0692f74214.exe	89

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1076	Powershell.exe
1076	Powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	392	d32f06aa276a1ef87396ca0692f74214.exe
Token: SeDebugPrivilege	1076	Powershell.exe
Token: SeDebugPrivilege	3868	RegSvcs.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 392 wrote to memory of 1076	392	d32f06aa276a1ef87396ca0692f74214.exe	87
PID 392 wrote to memory of 1076	392	d32f06aa276a1ef87396ca0692f74214.exe	87
PID 392 wrote to memory of 1076	392	d32f06aa276a1ef87396ca0692f74214.exe	87
PID 392 wrote to memory of 3868	392	d32f06aa276a1ef87396ca0692f74214.exe	89
PID 392 wrote to memory of 3868	392	d32f06aa276a1ef87396ca0692f74214.exe	89
PID 392 wrote to memory of 3868	392	d32f06aa276a1ef87396ca0692f74214.exe	89
PID 392 wrote to memory of 3868	392	d32f06aa276a1ef87396ca0692f74214.exe	89
PID 392 wrote to memory of 3868	392	d32f06aa276a1ef87396ca0692f74214.exe	89
PID 392 wrote to memory of 3868	392	d32f06aa276a1ef87396ca0692f74214.exe	89
PID 392 wrote to memory of 3868	392	d32f06aa276a1ef87396ca0692f74214.exe	89
PID 392 wrote to memory of 3868	392	d32f06aa276a1ef87396ca0692f74214.exe	89

C:\Users\Admin\AppData\Local\Temp\d32f06aa276a1ef87396ca0692f74214.exe
"C:\Users\Admin\AppData\Local\Temp\d32f06aa276a1ef87396ca0692f74214.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:392
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Powershell.exe
  "Powershell" Copy-Item 'C:\Users\Admin\AppData\Local\Temp\d32f06aa276a1ef87396ca0692f74214.exe' 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Systhhdfhsdem.exe'
  2⤵
  - Drops startup file
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1076
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3868

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/392-132-0x0000000000DB0000-0x0000000000DDE000-memory.dmp

Download

memory/392-133-0x0000000005D00000-0x00000000062A4000-memory.dmp

Download

memory/392-134-0x00000000057F0000-0x000000000588C000-memory.dmp

Download

memory/1076-141-0x0000000005830000-0x0000000005896000-memory.dmp

Download

memory/1076-136-0x0000000004960000-0x0000000004996000-memory.dmp

Download

memory/1076-138-0x0000000004FD0000-0x00000000055F8000-memory.dmp

Download

memory/1076-140-0x0000000004F40000-0x0000000004F62000-memory.dmp

Download

memory/1076-142-0x00000000058A0000-0x0000000005906000-memory.dmp

Download

memory/1076-143-0x0000000005D70000-0x0000000005D8E000-memory.dmp

Download

memory/1076-144-0x0000000006440000-0x00000000064D6000-memory.dmp

Download

memory/1076-145-0x00000000063C0000-0x00000000063DA000-memory.dmp

Download

memory/1076-146-0x0000000006410000-0x0000000006432000-memory.dmp

Download

memory/3868-139-0x0000000000400000-0x0000000000412000-memory.dmp

Download