asyncrat | e2ed986394cf247495d37901772aad9f4f87bc2f03f65e0ead9706b9e51b66fa | Triage

Analysis

max time kernel
112s
max time network
190s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
05-04-2023 14:50

Sharing

Report Analysis Logs

General

Target

New folder/Stub/Client.exe
Size

63KB
MD5

6158c0682f86511060619bba0fe864be
SHA1

63a1738c87ba9449b1d572ee470da2b242742643
SHA256

5bf4fc2c4d3115229d60511cad1af48019a4c291ad6144e73393e88e319f80a5
SHA512

baef40b589d8717f419185ad0885173f790394827d72d78520890ae737c7ee1cebe3af062340847cfe705c223669562e7116f48ab11d59654653a0b269026bd1
SSDEEP

1536:8WP+BbY58krxvI0TTCNsOoIK7q6LgRAIM8pqKmY7:8WP+BbY5xrxvI0Z7P8R8Xz

Score

10^/10

asyncrat rat

Malware Config

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

resource	yara_rule
behavioral10/memory/3836-133-0x0000000000520000-0x0000000000536000-memory.dmp	asyncrat

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4048	3836	WerFault.exe	55

C:\Users\Admin\AppData\Local\Temp\New folder\Stub\Client.exe
"C:\Users\Admin\AppData\Local\Temp\New folder\Stub\Client.exe"
1⤵
PID:3836
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3836 -s 736
  2⤵
  - Program crash
  PID:4048

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 420 -p 3836 -ip 3836
1⤵
PID:3944

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3836-133-0x0000000000520000-0x0000000000536000-memory.dmp

Filesize
88KB

Download