asyncrat | 38acb0a39a41cd025106836edc40beaa0b53cea2b7e5a3dcfebae8269b8f6c58

Analysis

max time kernel
144s
max time network
149s
platform
windows10-1703_x64
resource
win10-20220901-en
resource tags

arch:x64arch:x86image:win10-20220901-enlocale:en-usos:windows10-1703-x64system
submitted
07-12-2022 11:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

38acb0a39a41cd025106836edc40beaa0b53cea2b7e5a3dcfebae8269b8f6c58.exe
Size

189KB
MD5

98379a4b4b9f36794e4d85eedf2ccf8e
SHA1

7eabd6cf8bc2deecc6691c810146345f918213b9
SHA256

38acb0a39a41cd025106836edc40beaa0b53cea2b7e5a3dcfebae8269b8f6c58
SHA512

a5cceb8514f598f759e0dd9ba242fbbb7b029446d7d94f13b089da472dc8af52ec6014848b851bad67fe3ed268bb79db05284291e33e0bcdab58c2e05acdc63c
SSDEEP

3072:B3CX/huQkPjdYZ2kPTx6A9duTSzac6gEzGP7y3mw9mKlrqNPVJFUSo7c1Vwi:B0YQIiZJPT4RUAgvP7yVmKl+NPVJFUSw

Score

10^/10

asyncrat default rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

Default

chinasea.duckdns.org:5201

Mutex

AsyncMutex_6SI8OkPnk

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
rat asyncrat

Async RAT payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/4292-185-0x000000000040C72E-mapping.dmp	asyncrat
behavioral1/memory/4292-183-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat

Drops startup file 2 IoCs

Processes:

Powershell.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystJHKJHKem.exe	Powershell.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystJHKJHKem.exe	Powershell.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

38acb0a39a41cd025106836edc40beaa0b53cea2b7e5a3dcfebae8269b8f6c58.exe

description	pid	process	target process
PID 1940 set thread context of 4292	1940	38acb0a39a41cd025106836edc40beaa0b53cea2b7e5a3dcfebae8269b8f6c58.exe	RegSvcs.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

Powershell.exe

pid process

1872 Powershell.exe
1872 Powershell.exe
1872 Powershell.exe

pid	process
1872	Powershell.exe
1872	Powershell.exe
1872	Powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

38acb0a39a41cd025106836edc40beaa0b53cea2b7e5a3dcfebae8269b8f6c58.exePowershell.exeRegSvcs.exe

description	pid	process
Token: SeDebugPrivilege	1940	38acb0a39a41cd025106836edc40beaa0b53cea2b7e5a3dcfebae8269b8f6c58.exe
Token: SeDebugPrivilege	1872	Powershell.exe
Token: SeDebugPrivilege	4292	RegSvcs.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

38acb0a39a41cd025106836edc40beaa0b53cea2b7e5a3dcfebae8269b8f6c58.exe

description	pid	process	target process
PID 1940 wrote to memory of 1872	1940	38acb0a39a41cd025106836edc40beaa0b53cea2b7e5a3dcfebae8269b8f6c58.exe	Powershell.exe
PID 1940 wrote to memory of 1872	1940	38acb0a39a41cd025106836edc40beaa0b53cea2b7e5a3dcfebae8269b8f6c58.exe	Powershell.exe
PID 1940 wrote to memory of 1872	1940	38acb0a39a41cd025106836edc40beaa0b53cea2b7e5a3dcfebae8269b8f6c58.exe	Powershell.exe
PID 1940 wrote to memory of 4292	1940	38acb0a39a41cd025106836edc40beaa0b53cea2b7e5a3dcfebae8269b8f6c58.exe	RegSvcs.exe
PID 1940 wrote to memory of 4292	1940	38acb0a39a41cd025106836edc40beaa0b53cea2b7e5a3dcfebae8269b8f6c58.exe	RegSvcs.exe
PID 1940 wrote to memory of 4292	1940	38acb0a39a41cd025106836edc40beaa0b53cea2b7e5a3dcfebae8269b8f6c58.exe	RegSvcs.exe
PID 1940 wrote to memory of 4292	1940	38acb0a39a41cd025106836edc40beaa0b53cea2b7e5a3dcfebae8269b8f6c58.exe	RegSvcs.exe
PID 1940 wrote to memory of 4292	1940	38acb0a39a41cd025106836edc40beaa0b53cea2b7e5a3dcfebae8269b8f6c58.exe	RegSvcs.exe
PID 1940 wrote to memory of 4292	1940	38acb0a39a41cd025106836edc40beaa0b53cea2b7e5a3dcfebae8269b8f6c58.exe	RegSvcs.exe
PID 1940 wrote to memory of 4292	1940	38acb0a39a41cd025106836edc40beaa0b53cea2b7e5a3dcfebae8269b8f6c58.exe	RegSvcs.exe
PID 1940 wrote to memory of 4292	1940	38acb0a39a41cd025106836edc40beaa0b53cea2b7e5a3dcfebae8269b8f6c58.exe	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\38acb0a39a41cd025106836edc40beaa0b53cea2b7e5a3dcfebae8269b8f6c58.exe
"C:\Users\Admin\AppData\Local\Temp\38acb0a39a41cd025106836edc40beaa0b53cea2b7e5a3dcfebae8269b8f6c58.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1940

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Powershell.exe
"Powershell" Copy-Item 'C:\Users\Admin\AppData\Local\Temp\38acb0a39a41cd025106836edc40beaa0b53cea2b7e5a3dcfebae8269b8f6c58.exe' 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystJHKJHKem.exe'
2⤵
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1872

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:4292

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1872-174-0x0000000000000000-mapping.dmp

Download
memory/1872-306-0x0000000009410000-0x0000000009432000-memory.dmp

Filesize
136KB

Download
memory/1872-305-0x00000000093D0000-0x00000000093EA000-memory.dmp

Filesize
104KB

Download
memory/1872-304-0x00000000096F0000-0x0000000009784000-memory.dmp

Filesize
592KB

Download
memory/1872-283-0x0000000008570000-0x00000000085E6000-memory.dmp

Filesize
472KB

Download
memory/1872-279-0x0000000008320000-0x000000000836B000-memory.dmp

Filesize
300KB

Download
memory/1872-278-0x00000000081C0000-0x00000000081DC000-memory.dmp

Filesize
112KB

Download
memory/1872-275-0x0000000007E50000-0x00000000081A0000-memory.dmp

Filesize
3.3MB

Download
memory/1872-274-0x0000000007DE0000-0x0000000007E46000-memory.dmp

Filesize
408KB

Download
memory/1872-273-0x0000000007C00000-0x0000000007C66000-memory.dmp

Filesize
408KB

Download
memory/1872-268-0x0000000007420000-0x0000000007442000-memory.dmp

Filesize
136KB

Download
memory/1872-253-0x00000000074E0000-0x0000000007B08000-memory.dmp

Filesize
6.2MB

Download
memory/1872-246-0x0000000006E70000-0x0000000006EA6000-memory.dmp

Filesize
216KB

Download
memory/1872-184-0x0000000077250000-0x00000000773DE000-memory.dmp

Filesize
1.6MB

Download
memory/1872-190-0x0000000077250000-0x00000000773DE000-memory.dmp

Filesize
1.6MB

Download
memory/1872-188-0x0000000077250000-0x00000000773DE000-memory.dmp

Filesize
1.6MB

Download
memory/1872-186-0x0000000077250000-0x00000000773DE000-memory.dmp

Filesize
1.6MB

Download
memory/1872-181-0x0000000077250000-0x00000000773DE000-memory.dmp

Filesize
1.6MB

Download
memory/1872-182-0x0000000077250000-0x00000000773DE000-memory.dmp

Filesize
1.6MB

Download
memory/1872-179-0x0000000077250000-0x00000000773DE000-memory.dmp

Filesize
1.6MB

Download
memory/1872-178-0x0000000077250000-0x00000000773DE000-memory.dmp

Filesize
1.6MB

Download
memory/1872-175-0x0000000077250000-0x00000000773DE000-memory.dmp

Filesize
1.6MB

Download
memory/1872-176-0x0000000077250000-0x00000000773DE000-memory.dmp

Filesize
1.6MB

Download
memory/1940-140-0x0000000077250000-0x00000000773DE000-memory.dmp

Filesize
1.6MB

Download
memory/1940-172-0x0000000077250000-0x00000000773DE000-memory.dmp

Filesize
1.6MB

Download
memory/1940-145-0x0000000077250000-0x00000000773DE000-memory.dmp

Filesize
1.6MB

Download
memory/1940-146-0x0000000077250000-0x00000000773DE000-memory.dmp

Filesize
1.6MB

Download
memory/1940-148-0x0000000077250000-0x00000000773DE000-memory.dmp

Filesize
1.6MB

Download
memory/1940-147-0x0000000077250000-0x00000000773DE000-memory.dmp

Filesize
1.6MB

Download
memory/1940-149-0x0000000077250000-0x00000000773DE000-memory.dmp

Filesize
1.6MB

Download
memory/1940-150-0x0000000077250000-0x00000000773DE000-memory.dmp

Filesize
1.6MB

Download
memory/1940-151-0x0000000077250000-0x00000000773DE000-memory.dmp

Filesize
1.6MB

Download
memory/1940-152-0x0000000077250000-0x00000000773DE000-memory.dmp

Filesize
1.6MB

Download
memory/1940-153-0x0000000000700000-0x0000000000734000-memory.dmp

Filesize
208KB

Download
memory/1940-154-0x0000000077250000-0x00000000773DE000-memory.dmp

Filesize
1.6MB

Download
memory/1940-155-0x0000000077250000-0x00000000773DE000-memory.dmp

Filesize
1.6MB

Download
memory/1940-156-0x0000000077250000-0x00000000773DE000-memory.dmp

Filesize
1.6MB

Download
memory/1940-157-0x0000000077250000-0x00000000773DE000-memory.dmp

Filesize
1.6MB

Download
memory/1940-158-0x0000000077250000-0x00000000773DE000-memory.dmp

Filesize
1.6MB

Download
memory/1940-159-0x0000000077250000-0x00000000773DE000-memory.dmp

Filesize
1.6MB

Download
memory/1940-160-0x00000000028D0000-0x00000000028F4000-memory.dmp

Filesize
144KB

Download
memory/1940-161-0x0000000077250000-0x00000000773DE000-memory.dmp

Filesize
1.6MB

Download
memory/1940-162-0x00000000096B0000-0x000000000974C000-memory.dmp

Filesize
624KB

Download
memory/1940-163-0x0000000077250000-0x00000000773DE000-memory.dmp

Filesize
1.6MB

Download
memory/1940-164-0x0000000077250000-0x00000000773DE000-memory.dmp

Filesize
1.6MB

Download
memory/1940-165-0x0000000077250000-0x00000000773DE000-memory.dmp

Filesize
1.6MB

Download
memory/1940-166-0x0000000077250000-0x00000000773DE000-memory.dmp

Filesize
1.6MB

Download
memory/1940-167-0x0000000077250000-0x00000000773DE000-memory.dmp

Filesize
1.6MB

Download
memory/1940-168-0x0000000077250000-0x00000000773DE000-memory.dmp

Filesize
1.6MB

Download
memory/1940-169-0x0000000009D50000-0x000000000A24E000-memory.dmp

Filesize
5.0MB

Download
memory/1940-170-0x0000000077250000-0x00000000773DE000-memory.dmp

Filesize
1.6MB

Download
memory/1940-171-0x0000000077250000-0x00000000773DE000-memory.dmp

Filesize
1.6MB

Download
memory/1940-144-0x0000000077250000-0x00000000773DE000-memory.dmp

Filesize
1.6MB

Download
memory/1940-173-0x0000000077250000-0x00000000773DE000-memory.dmp

Filesize
1.6MB

Download
memory/1940-143-0x0000000077250000-0x00000000773DE000-memory.dmp

Filesize
1.6MB

Download
memory/1940-177-0x00000000050E0000-0x00000000050FC000-memory.dmp

Filesize
112KB

Download
memory/1940-142-0x0000000077250000-0x00000000773DE000-memory.dmp

Filesize
1.6MB

Download
memory/1940-141-0x0000000077250000-0x00000000773DE000-memory.dmp

Filesize
1.6MB

Download
memory/1940-120-0x0000000077250000-0x00000000773DE000-memory.dmp

Filesize
1.6MB

Download
memory/1940-180-0x0000000077250000-0x00000000773DE000-memory.dmp

Filesize
1.6MB

Download
memory/1940-139-0x0000000077250000-0x00000000773DE000-memory.dmp

Filesize
1.6MB

Download
memory/1940-138-0x0000000077250000-0x00000000773DE000-memory.dmp

Filesize
1.6MB

Download
memory/1940-137-0x0000000077250000-0x00000000773DE000-memory.dmp

Filesize
1.6MB

Download
memory/1940-135-0x0000000077250000-0x00000000773DE000-memory.dmp

Filesize
1.6MB

Download
memory/1940-136-0x0000000077250000-0x00000000773DE000-memory.dmp

Filesize
1.6MB

Download
memory/1940-121-0x0000000077250000-0x00000000773DE000-memory.dmp

Filesize
1.6MB

Download
memory/1940-134-0x0000000077250000-0x00000000773DE000-memory.dmp

Filesize
1.6MB

Download
memory/1940-122-0x0000000077250000-0x00000000773DE000-memory.dmp

Filesize
1.6MB

Download
memory/1940-123-0x0000000077250000-0x00000000773DE000-memory.dmp

Filesize
1.6MB

Download
memory/1940-133-0x0000000077250000-0x00000000773DE000-memory.dmp

Filesize
1.6MB

Download
memory/1940-124-0x0000000077250000-0x00000000773DE000-memory.dmp

Filesize
1.6MB

Download
memory/1940-132-0x0000000077250000-0x00000000773DE000-memory.dmp

Filesize
1.6MB

Download
memory/1940-131-0x0000000077250000-0x00000000773DE000-memory.dmp

Filesize
1.6MB

Download
memory/1940-130-0x0000000077250000-0x00000000773DE000-memory.dmp

Filesize
1.6MB

Download
memory/1940-129-0x0000000077250000-0x00000000773DE000-memory.dmp

Filesize
1.6MB

Download
memory/1940-128-0x0000000077250000-0x00000000773DE000-memory.dmp

Filesize
1.6MB

Download
memory/1940-127-0x0000000077250000-0x00000000773DE000-memory.dmp

Filesize
1.6MB

Download
memory/1940-126-0x0000000077250000-0x00000000773DE000-memory.dmp

Filesize
1.6MB

Download
memory/1940-125-0x0000000077250000-0x00000000773DE000-memory.dmp

Filesize
1.6MB

Download
memory/4292-183-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/4292-185-0x000000000040C72E-mapping.dmp

Download
memory/4292-187-0x0000000077250000-0x00000000773DE000-memory.dmp

Filesize
1.6MB

Download
memory/4292-189-0x0000000077250000-0x00000000773DE000-memory.dmp

Filesize
1.6MB

Download