asyncrat | ac0c1c0379a7f97283829cd57f8848b8ebf9cc819952c9792124eae4fc08e71a

Analysis

max time kernel
150s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
09-12-2022 15:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ac0c1c0379a7f97283829cd57f8848b8ebf9cc819952c9792124eae4fc08e71a.ps1
Size

327KB
MD5

1356a90b675211989a87a48f3b27537e
SHA1

c5f8c3c3ac577f8ccd8b27ee97543f48f96f6cda
SHA256

ac0c1c0379a7f97283829cd57f8848b8ebf9cc819952c9792124eae4fc08e71a
SHA512

5459e4ec6144bb160ca5a4657c2e233880ebd5ab17573e03ab184fb8b189fbf5b7f90b27e88374a9d5c6fbc96d1e23a0d33ada4abfdb2cc7905ab0682fd7398b
SSDEEP

3072:9j68V2ldvzD3t3ApYjK+bXMUm+I4t/qKKlUkyZWdV:9+m2TzD3t3ApYjKiXlICqKKlUlZWdV

Score

10^/10

asyncrat default rat

Malware Config

Extracted

Family

asyncrat

Version

| Edit 3LOSH RAT

Botnet

Default

185.81.157.19:3312

ns1usaupload.myphotos.cc:3312

Mutex

AsyncMutex_6SI8OkPnkAAA

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
rat asyncrat

Async RAT payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/3112-134-0x0000000000400000-0x0000000000416000-memory.dmp	asyncrat
behavioral2/memory/3112-135-0x00000000004107DE-mapping.dmp	asyncrat

Suspicious use of SetThreadContext 1 IoCs

Processes:

powershell.exe

description pid process target process

PID 4708 set thread context of 3112 4708 powershell.exe RegSvcs.exe
Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

RegSvcs.exe

pid process

3112 RegSvcs.exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

powershell.exeRegSvcs.exe

pid process

4708 powershell.exe
4708 powershell.exe
3112 RegSvcs.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

powershell.exeRegSvcs.exe

description pid process

Token: SeDebugPrivilege 4708 powershell.exe
Token: SeDebugPrivilege 3112 RegSvcs.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

RegSvcs.exe

pid process

3112 RegSvcs.exe

description	pid	process	target process
PID 4708 set thread context of 3112	4708	powershell.exe	RegSvcs.exe

pid	process
3112	RegSvcs.exe

pid	process
4708	powershell.exe
4708	powershell.exe
3112	RegSvcs.exe

description	pid	process
Token: SeDebugPrivilege	4708	powershell.exe
Token: SeDebugPrivilege	3112	RegSvcs.exe

pid	process
3112	RegSvcs.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

powershell.exe

description	pid	process	target process
PID 4708 wrote to memory of 3112	4708	powershell.exe	RegSvcs.exe
PID 4708 wrote to memory of 3112	4708	powershell.exe	RegSvcs.exe
PID 4708 wrote to memory of 3112	4708	powershell.exe	RegSvcs.exe
PID 4708 wrote to memory of 3112	4708	powershell.exe	RegSvcs.exe
PID 4708 wrote to memory of 3112	4708	powershell.exe	RegSvcs.exe
PID 4708 wrote to memory of 3112	4708	powershell.exe	RegSvcs.exe
PID 4708 wrote to memory of 3112	4708	powershell.exe	RegSvcs.exe
PID 4708 wrote to memory of 3112	4708	powershell.exe	RegSvcs.exe
PID 4708 wrote to memory of 1092	4708	powershell.exe	schtasks.exe
PID 4708 wrote to memory of 1092	4708	powershell.exe	schtasks.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\ac0c1c0379a7f97283829cd57f8848b8ebf9cc819952c9792124eae4fc08e71a.ps1
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4708

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
2⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3112

C:\Windows\system32\schtasks.exe
"C:\Windows\system32\schtasks.exe" /delete /tn det /f
2⤵
PID:1092

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1092-136-0x0000000000000000-mapping.dmp

Download
memory/3112-134-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/3112-135-0x00000000004107DE-mapping.dmp

Download
memory/3112-138-0x0000000005F60000-0x0000000006504000-memory.dmp

Filesize
5.6MB

Download
memory/3112-139-0x0000000005AC0000-0x0000000005B52000-memory.dmp

Filesize
584KB

Download
memory/3112-140-0x0000000005A80000-0x0000000005A8A000-memory.dmp

Filesize
40KB

Download
memory/4708-132-0x0000018320160000-0x0000018320182000-memory.dmp

Filesize
136KB

Download
memory/4708-133-0x00007FF83C920000-0x00007FF83D3E1000-memory.dmp

Filesize
10.8MB

Download
memory/4708-137-0x00007FF83C920000-0x00007FF83D3E1000-memory.dmp

Filesize
10.8MB

Download