asyncrat | 4293a76767a4657c973bd39b07054adc0d3d790cbc2b9be6e14c81e1f9545b79 | Triage

Analysis

max time kernel
61s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
06-01-2023 22:16

Sharing

Report Analysis Logs

General

Target

WuyQxFYteA.exe
Size

171KB
MD5

f0bd3c3d10b20b6078c9d0c99ecb0137
SHA1

279c453e9d0144d3338a11f3e1a8efec56ad1044
SHA256

4293a76767a4657c973bd39b07054adc0d3d790cbc2b9be6e14c81e1f9545b79
SHA512

7b66a99fb9e20cb43d0d4cb624b0153253a492e03da313de3fd9f78e2bc4b1e4008fad4b98d2cd45757c53bd2f9a58c07ebe3140cf12f47646bbb72b86a4290b
SSDEEP

3072:cu/iTgle2PQuSzbLbTTlW4GLD6DvtMJCU7DzpyhJWnFd:cu/brPRSzbvTTeODvtMJfDVyhJW/

Score

10^/10

asyncrat default rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

Default

C2

bevdona.theworkpc.com:5576

Mutex

AsyncMutex_6SI8OkPnk

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
rat asyncrat

Async RAT payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4860-132-0x0000000000410000-0x0000000000440000-memory.dmp	asyncrat

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WuyQxFYteA.exe

description pid process

Token: SeDebugPrivilege 4860 WuyQxFYteA.exe

C:\Users\Admin\AppData\Local\Temp\WuyQxFYteA.exe
"C:\Users\Admin\AppData\Local\Temp\WuyQxFYteA.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4860

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4860-132-0x0000000000410000-0x0000000000440000-memory.dmp

Filesize
192KB

Download
memory/4860-133-0x0000000005140000-0x00000000051DC000-memory.dmp

Filesize
624KB

Download
memory/4860-134-0x0000000005790000-0x0000000005D34000-memory.dmp

Filesize
5.6MB

Download
memory/4860-135-0x0000000005250000-0x00000000052B6000-memory.dmp

Filesize
408KB

Download