asyncrat | 3927fb9e359a91bca4e55c70fa20590bccfa8c3a46ceecaf04509a0b4d3e6442 | Triage

Analysis

max time kernel
141s
max time network
151s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
21-03-2023 19:06

Sharing

Report Analysis Logs

General

Target

tmp.exe
Size

1.6MB
MD5

77a47f34b1aadd9bd4b2df76692e4514
SHA1

aebeebce328e9304fb03862a4f95631da31fa313
SHA256

3927fb9e359a91bca4e55c70fa20590bccfa8c3a46ceecaf04509a0b4d3e6442
SHA512

c63324f2c326dcdad4e090eb260650efc30513edf70ddb19ae4ad204d96ea01639e56278dcd2e3ab239ab23d840884640e75c45632f1ba5b537539f0e5fb813d
SSDEEP

49152:RX2nBONBFteX1k7VP/H6rmVNlCl0bqfqSHBGJoco5PxfmUHd:5VNBreuVP/H6rklClXfqSHBPhFxfmU

Score

10^/10

asyncrat rat

Malware Config

Extracted

Credentials

Protocol: ftp
Host:
45.151.135.235
Port:
21
Username:
123
Password:
123

Extracted

Family

asyncrat

C2

43.137.15.104:8848

Mutex

UKRVDCADEVGBRBHNETB

Attributes

delay
1
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1520-56-0x0000000000CC0000-0x0000000000CD6000-memory.dmp	asyncrat
behavioral1/memory/1520-57-0x0000000006050000-0x0000000006090000-memory.dmp	asyncrat

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

tmp.exe

pid process

1520 tmp.exe

C:\Users\Admin\AppData\Local\Temp\tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmp.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:1520

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1520-56-0x0000000000CC0000-0x0000000000CD6000-memory.dmp

Filesize
88KB

Download
memory/1520-57-0x0000000006050000-0x0000000006090000-memory.dmp

Filesize
256KB

Download
memory/1520-58-0x0000000006050000-0x0000000006090000-memory.dmp

Filesize
256KB

Download