asyncrat | cd2c63e16f4c1e79e7763c278146acae54dca752c25ad46d47167f69d70d714a

General

Target

cd2c63e16f4c1e79e7763c278146acae54dca752c25ad46d47167f69d70d714a.exe
Size

14.7MB
MD5

533f876556e02dec453f6fa4c2536967
SHA1

a4abdc1e4b26623e2be6c3715c1a75a5a6e2c397
SHA256

cd2c63e16f4c1e79e7763c278146acae54dca752c25ad46d47167f69d70d714a
SHA512

3935d864faa3e7c32e6a4fa2a7ab01a9ae2c103531a73df1a6500ce78321f86623e3e9d7be74535ff0bd09382462915239f263c9466cb8ef6437c48a55fcb47a
SSDEEP

196608:6nMPXMnhoMskO1/6Bstbu5F5bciXk0H+TnrgC8d:6nMQdCJEl5o+Ha8jd

Score

10^/10

asyncrat derenderscuriry rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

DerenderScuriry

C2

20.100.196.69:9281

Mutex

DerenderScuriry

Attributes

delay
3
install
false
install_file
DerenderScuriry
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral1/memory/5032-138-0x0000000000600000-0x0000000000612000-memory.dmp	asyncrat

Executes dropped EXE 1 IoCs

pid	Process
4808	cd2c63e16f4c1e79e7763c278146acae54dca752c25ad46d47167f69d70d714a.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 440 set thread context of 5032	440	cd2c63e16f4c1e79e7763c278146acae54dca752c25ad46d47167f69d70d714a.exe	87
PID 4808 set thread context of 2816	4808	cd2c63e16f4c1e79e7763c278146acae54dca752c25ad46d47167f69d70d714a.exe	89

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	440	cd2c63e16f4c1e79e7763c278146acae54dca752c25ad46d47167f69d70d714a.exe
Token: SeDebugPrivilege	5032	RegAsm.exe
Token: SeDebugPrivilege	4808	cd2c63e16f4c1e79e7763c278146acae54dca752c25ad46d47167f69d70d714a.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 440 wrote to memory of 5032	440	cd2c63e16f4c1e79e7763c278146acae54dca752c25ad46d47167f69d70d714a.exe	87
PID 440 wrote to memory of 5032	440	cd2c63e16f4c1e79e7763c278146acae54dca752c25ad46d47167f69d70d714a.exe	87
PID 440 wrote to memory of 5032	440	cd2c63e16f4c1e79e7763c278146acae54dca752c25ad46d47167f69d70d714a.exe	87
PID 440 wrote to memory of 5032	440	cd2c63e16f4c1e79e7763c278146acae54dca752c25ad46d47167f69d70d714a.exe	87
PID 440 wrote to memory of 5032	440	cd2c63e16f4c1e79e7763c278146acae54dca752c25ad46d47167f69d70d714a.exe	87
PID 440 wrote to memory of 5032	440	cd2c63e16f4c1e79e7763c278146acae54dca752c25ad46d47167f69d70d714a.exe	87
PID 440 wrote to memory of 5032	440	cd2c63e16f4c1e79e7763c278146acae54dca752c25ad46d47167f69d70d714a.exe	87
PID 440 wrote to memory of 5032	440	cd2c63e16f4c1e79e7763c278146acae54dca752c25ad46d47167f69d70d714a.exe	87
PID 4808 wrote to memory of 2816	4808	cd2c63e16f4c1e79e7763c278146acae54dca752c25ad46d47167f69d70d714a.exe	89
PID 4808 wrote to memory of 2816	4808	cd2c63e16f4c1e79e7763c278146acae54dca752c25ad46d47167f69d70d714a.exe	89
PID 4808 wrote to memory of 2816	4808	cd2c63e16f4c1e79e7763c278146acae54dca752c25ad46d47167f69d70d714a.exe	89
PID 4808 wrote to memory of 2816	4808	cd2c63e16f4c1e79e7763c278146acae54dca752c25ad46d47167f69d70d714a.exe	89
PID 4808 wrote to memory of 2816	4808	cd2c63e16f4c1e79e7763c278146acae54dca752c25ad46d47167f69d70d714a.exe	89
PID 4808 wrote to memory of 2816	4808	cd2c63e16f4c1e79e7763c278146acae54dca752c25ad46d47167f69d70d714a.exe	89
PID 4808 wrote to memory of 2816	4808	cd2c63e16f4c1e79e7763c278146acae54dca752c25ad46d47167f69d70d714a.exe	89
PID 4808 wrote to memory of 2816	4808	cd2c63e16f4c1e79e7763c278146acae54dca752c25ad46d47167f69d70d714a.exe	89

C:\Users\Admin\AppData\Local\Temp\cd2c63e16f4c1e79e7763c278146acae54dca752c25ad46d47167f69d70d714a.exe
"C:\Users\Admin\AppData\Local\Temp\cd2c63e16f4c1e79e7763c278146acae54dca752c25ad46d47167f69d70d714a.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:440
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5032

C:\Users\Admin\AppData\Local\Temp\cd2c63e16f4c1e79e7763c278146acae54dca752c25ad46d47167f69d70d714a.exe
C:\Users\Admin\AppData\Local\Temp\cd2c63e16f4c1e79e7763c278146acae54dca752c25ad46d47167f69d70d714a.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4808
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:2816

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\cd2c63e16f4c1e79e7763c278146acae54dca752c25ad46d47167f69d70d714a.exe.log

Filesize
902B

MD5
317ed182314a105b8436cfd8bb3879f6

SHA1
aa407b44619a9b06b18d8a39ce27a65b959598e1

SHA256
34a156e5235a27901293bd8928b37d13724d62183e409f6d284110280c56f865

SHA512
27bc617005ef36be6384484e5cec56d7165d1e9535c9a0b5546f1f082cc4bf5969acb573da77171ac7f4119c8cf50a3ced103cd21485569c9cfcf2e340468604

Download Submit
C:\Users\Admin\AppData\Local\Temp\cd2c63e16f4c1e79e7763c278146acae54dca752c25ad46d47167f69d70d714a.exe

Filesize
14.7MB

MD5
533f876556e02dec453f6fa4c2536967

SHA1
a4abdc1e4b26623e2be6c3715c1a75a5a6e2c397

SHA256
cd2c63e16f4c1e79e7763c278146acae54dca752c25ad46d47167f69d70d714a

SHA512
3935d864faa3e7c32e6a4fa2a7ab01a9ae2c103531a73df1a6500ce78321f86623e3e9d7be74535ff0bd09382462915239f263c9466cb8ef6437c48a55fcb47a

Download Submit
memory/440-132-0x0000000000260000-0x0000000001112000-memory.dmp

Filesize
14.7MB

Download
memory/440-133-0x0000000006E90000-0x0000000007434000-memory.dmp

Filesize
5.6MB

Download
memory/440-134-0x00000000063F0000-0x0000000006482000-memory.dmp

Filesize
584KB

Download
memory/440-135-0x0000000006540000-0x00000000065DC000-memory.dmp

Filesize
624KB

Download
memory/2816-142-0x0000000000000000-mapping.dmp

Download
memory/5032-136-0x0000000000000000-mapping.dmp

Download
memory/5032-138-0x0000000000600000-0x0000000000612000-memory.dmp

Filesize
72KB

Download
memory/5032-139-0x0000000005520000-0x0000000005586000-memory.dmp

Filesize
408KB

Download

Analysis

Sharing