asyncrat | 9e59803a4492e5a3666bfd541ae612573b23a04b63430abeecb7d19da54a93d7 | Triage

Analysis

max time kernel
31s
max time network
149s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
21-03-2023 19:33

Sharing

Report Analysis Logs

General

Target

tmp.exe
Size

1.6MB
MD5

47194f35428265e80351f561a0941dd1
SHA1

1208724fa2417b65af800a2510eaecee8dcc2fb4
SHA256

9e59803a4492e5a3666bfd541ae612573b23a04b63430abeecb7d19da54a93d7
SHA512

41e714e9a029e0ac053f8f940250ce29a439ab3b8da3f242afe10c98d52fe1249070ed916b73cc85b6417d538b3867a4de196408bf8c23e52bb98fe10426906b
SSDEEP

49152:SDiHsAJScXAJvVqnAgGTveta7OPggaV/KjiVOSYu9dQvqh:SnAJScqqnAgGTga7O/aV/KjiLh3Qvqh

Score

10^/10

asyncrat rat

Malware Config

Extracted

Credentials

Protocol: ftp
Host:
45.151.135.235
Port:
21
Username:
123
Password:
123

Extracted

Family

asyncrat

C2

1.14.103.49:8848

Mutex

laosan

Attributes

delay
1
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1720-56-0x0000000002590000-0x00000000025A6000-memory.dmp	asyncrat
behavioral1/memory/1720-57-0x00000000061D0000-0x0000000006210000-memory.dmp	asyncrat

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

tmp.exe

description pid process

Token: SeDebugPrivilege 1720 tmp.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

tmp.exe

pid process

1720 tmp.exe

C:\Users\Admin\AppData\Local\Temp\tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmp.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1720

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1720-56-0x0000000002590000-0x00000000025A6000-memory.dmp

Filesize
88KB

Download
memory/1720-58-0x00000000061D0000-0x0000000006210000-memory.dmp

Filesize
256KB

Download
memory/1720-57-0x00000000061D0000-0x0000000006210000-memory.dmp

Filesize
256KB

Download
memory/1720-78-0x00000000061D0000-0x0000000006210000-memory.dmp

Filesize
256KB

Download