asyncrat | c40f3216652866e041fd154c38dab5f443f65da7e995e45ce473bf2662e2f7e4

Analysis

max time kernel
82s
max time network
85s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03-02-2023 16:08

Target

bJyz.exe
Size

47KB
MD5

90631c5269980f1ea596b3c76974d262
SHA1

889a1edb9b462ed0d3a5cc8ecf0427696d6095c5
SHA256

c40f3216652866e041fd154c38dab5f443f65da7e995e45ce473bf2662e2f7e4
SHA512

c129df24c9302a9c0cae09cbe1a5c9efca3848719cc80e1801cf8ccdac9d1a714c03cb590446394e2e14ba16dc8bb8e7e6c1ae1110271dcf0896e08634cbb9cd
SSDEEP

768:dOEuILWCKi+DiBtelDSN+iV08YbygemmbbeUZvEgK/J9lZVc6KN:dOtmBtKDs4zb1CbeMnkJ3ZVclN

Score

10^/10

Family

asyncrat

Version

1.0.7

Botnet

Default

20.197.196.201:7749

Mutex

hAtBdUenfThOelUfgThs

Attributes

aes.plain

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
rat asyncrat

Async RAT payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1832-54-0x0000000001090000-0x00000000010A2000-memory.dmp	asyncrat
behavioral1/memory/1832-55-0x0000000000EE0000-0x0000000000F44000-memory.dmp	asyncrat

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1488 cmd.exe
Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

1628 timeout.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

bJyz.exe

description pid process

Token: SeDebugPrivilege 1832 bJyz.exe

pid	process
1488	cmd.exe

pid	process
1628	timeout.exe

description	pid	process
Token: SeDebugPrivilege	1832	bJyz.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

bJyz.execmd.exe

description	pid	process	target process
PID 1832 wrote to memory of 1488	1832	bJyz.exe	cmd.exe
PID 1832 wrote to memory of 1488	1832	bJyz.exe	cmd.exe
PID 1832 wrote to memory of 1488	1832	bJyz.exe	cmd.exe
PID 1488 wrote to memory of 1628	1488	cmd.exe	timeout.exe
PID 1488 wrote to memory of 1628	1488	cmd.exe	timeout.exe
PID 1488 wrote to memory of 1628	1488	cmd.exe	timeout.exe

C:\Windows\system32\timeout.exe
timeout 3
3⤵
- Delays execution with timeout.exe
PID:1628

C:\Users\Admin\AppData\Local\Temp\tmp3A4B.tmp.bat
Filesize
156B

MD5
dae6d2c237560b15611e5220dafa2043

SHA1
9e54898f88713dacf6883d6bfa66484e77940663

SHA256
c597bc3e4f14e85cd5ec999ffbac5355977deada50eee9e25325b76d271f6dfb

SHA512
af7de93b7932af6ae532658ac5fa02947cbdb09ada976846dd99bf52dbf096d807fddff0ed231386868854109958cc272151f1a42cd0b0b4b847b2ce6ac8f8fc

Download Submit
memory/1488-56-0x0000000000000000-mapping.dmp

Download
memory/1628-58-0x0000000000000000-mapping.dmp

Download
memory/1832-54-0x0000000001090000-0x00000000010A2000-memory.dmp

Filesize
72KB

Download
memory/1832-55-0x0000000000EE0000-0x0000000000F44000-memory.dmp

Filesize
400KB

Download