asyncrat | f0765d27b3fd830dba8809d79845c6c74c58f349f85197a563d436dc248aab8a | Triage

Analysis

max time kernel
43s
max time network
151s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
30-01-2023 16:46

Sharing

Report Analysis Logs

General

Target

c61096cac2af72e13f8073d0b7a1a619.exe
Size

58KB
MD5

c61096cac2af72e13f8073d0b7a1a619
SHA1

762c3e3ebe028546fb35f87cdb4f734ef6aa7f72
SHA256

f0765d27b3fd830dba8809d79845c6c74c58f349f85197a563d436dc248aab8a
SHA512

f1cfa713d31560c38a98e9ba595d06f2ba89b7b9cd9c6cf16d915478929845d9ad2577ac8906a8d5be234d82b4fc95abf5215e222298e31700d6f1da20c74b46
SSDEEP

1536:Z7KNH9JgaQb5SFk9bwTJfE8DsP8PLb7x:Z7KNH3gaQtak9bwdh5PLPx

Score

10^/10

asyncrat default rat

Malware Config

Extracted

Family

asyncrat

Version

| Edit 3LOSH RAT

Botnet

Default

C2

formenn.linkpc.net:5555

formenn.linkpc.net:6666

Mutex

AsyncMutex_6SI8OkPnk

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
rat asyncrat

Async RAT payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1516-54-0x0000000000A10000-0x0000000000A24000-memory.dmp	asyncrat

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

c61096cac2af72e13f8073d0b7a1a619.exe

description pid process

Token: SeDebugPrivilege 1516 c61096cac2af72e13f8073d0b7a1a619.exe

C:\Users\Admin\AppData\Local\Temp\c61096cac2af72e13f8073d0b7a1a619.exe
"C:\Users\Admin\AppData\Local\Temp\c61096cac2af72e13f8073d0b7a1a619.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1516

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1516-54-0x0000000000A10000-0x0000000000A24000-memory.dmp

Filesize
80KB

Download
memory/1516-55-0x0000000075111000-0x0000000075113000-memory.dmp

Filesize
8KB

Download