asyncrat | 3b7c79a0d9b63348eb5786ee405466e224c825a828c0adc255dbb94631d81b26

Analysis

max time kernel
151s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06-02-2023 09:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5432086daa9ec74b311002f8cf2d9c110414b342366941fda6732a7a264562c0.exe
Size

47KB
MD5

5e9cf194d28e22718aa580991d8f15df
SHA1

055e7ba5d1a80e2f619792e063bfa2a5372ecd5e
SHA256

5432086daa9ec74b311002f8cf2d9c110414b342366941fda6732a7a264562c0
SHA512

49a1ce959439d1aaff770fbe2ae5f23483e5cd311eaf19cf06e33cbf69b44dd6d11086ce5fb223698214d6cc025e5cf249a40fcd4d509c655472526d95b30843
SSDEEP

768:4G+s3CjtDILWCCa+DiptelDSN+iV08YbygeTbCvEgK/JvZVc6KN:4G+AatpOptKDs4zb1cenkJvZVclN

Score

10^/10

asyncrat default rat

Malware Config

Extracted

Family

asyncrat

Version

1.0.7

Botnet

Default

Mutex

fArmMaBaSRfuPWksjdA

Attributes

delay
1
install
false
install_folder
%AppData%
pastebin_config
https://pastebin.com/FcHGaN0M

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
rat asyncrat

Async RAT payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/1488-132-0x0000000000470000-0x0000000000482000-memory.dmp	asyncrat

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

5432086daa9ec74b311002f8cf2d9c110414b342366941fda6732a7a264562c0.exe

description pid process

Token: SeDebugPrivilege 1488 5432086daa9ec74b311002f8cf2d9c110414b342366941fda6732a7a264562c0.exe

description	pid	process
Token: SeDebugPrivilege	1488	5432086daa9ec74b311002f8cf2d9c110414b342366941fda6732a7a264562c0.exe

C:\Users\Admin\AppData\Local\Temp\5432086daa9ec74b311002f8cf2d9c110414b342366941fda6732a7a264562c0.exe
"C:\Users\Admin\AppData\Local\Temp\5432086daa9ec74b311002f8cf2d9c110414b342366941fda6732a7a264562c0.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1488

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

T1102

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1488-132-0x0000000000470000-0x0000000000482000-memory.dmp

Filesize
72KB

Download
memory/1488-133-0x00007FFD784B0000-0x00007FFD78F71000-memory.dmp

Filesize
10.8MB

Download
memory/1488-134-0x00007FFD784B0000-0x00007FFD78F71000-memory.dmp

Filesize
10.8MB

Download