asyncrat | 0305f072031592da1b8d9d153f5cc2ba415727f514dc960354952e393e20f4fa

Analysis

max time kernel
135s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
22/04/2023, 01:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
tmp.exe
Size 552KB
Sample230422-bz8d2sbf38
SHA256 0305f072031592da1b8d9d153f5cc2ba415727f514dc960354952e393e20f4fa
MD5 e9a058a0718129b34e72b2bea47f534b
SHA1 15ec5a5075aca81544b12529136481208cb547db
SHA512 53fa614daaba10672ca75127094d019a473308f74af5d82a5978fa2066c781a02808ba96e5a9f40f2e47f0f7c2b967dacd009d8aab88661f185bdc53222796b0
SSDEEP 12288:F/BO5ZZC/W2n9x5w7LWCyjrFJPY0JHJSZy+tmToW9:F/qTC/fr5/CyJP1JQyQs9
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

asyncrat default rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

Default

194.55.224.44:6606
194.55.224.44:7707
194.55.224.44:8808

Mutex

AsyncMutex_6SI8OkPnk

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral2/memory/3660-140-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2456 set thread context of 3660	2456	tmp.exe	93

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2456	tmp.exe
2456	tmp.exe
2456	tmp.exe
2456	tmp.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2456	tmp.exe
Token: SeDebugPrivilege	3660	tmp.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2456 wrote to memory of 4356	2456	tmp.exe	91
PID 2456 wrote to memory of 4356	2456	tmp.exe	91
PID 2456 wrote to memory of 4356	2456	tmp.exe	91
PID 2456 wrote to memory of 4444	2456	tmp.exe	92
PID 2456 wrote to memory of 4444	2456	tmp.exe	92
PID 2456 wrote to memory of 4444	2456	tmp.exe	92
PID 2456 wrote to memory of 3660	2456	tmp.exe	93
PID 2456 wrote to memory of 3660	2456	tmp.exe	93
PID 2456 wrote to memory of 3660	2456	tmp.exe	93
PID 2456 wrote to memory of 3660	2456	tmp.exe	93
PID 2456 wrote to memory of 3660	2456	tmp.exe	93
PID 2456 wrote to memory of 3660	2456	tmp.exe	93
PID 2456 wrote to memory of 3660	2456	tmp.exe	93
PID 2456 wrote to memory of 3660	2456	tmp.exe	93

C:\Users\Admin\AppData\Local\Temp\tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmp.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2456
- C:\Users\Admin\AppData\Local\Temp\tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmp.exe"
  2⤵
  PID:4356
- C:\Users\Admin\AppData\Local\Temp\tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmp.exe"
  2⤵
  PID:4444
- C:\Users\Admin\AppData\Local\Temp\tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmp.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3660

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

tmp.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\tmp.exe.log
Size 1KB
SHA256 7667e538030e3f8ce2886e47a01af24cb0ea70528b1e821c5d8832c5076cb982
MD5 8ec831f3e3a3f77e4a7b9cd32b48384c
SHA1 d83f09fd87c5bd86e045873c231c14836e76a05c
SHA512 26bffa2406b66368bd412bf25869a792631455645992cdcade2dbc13a2e56fb546414a6a9223b94c96c38d89187add6678d4779a88b38b0c9e36be8527b213c3
MD5 SHA1 SHA512

Submit Download

memory/2456-133-0x0000000000B30000-0x0000000000BC0000-memory.dmp

Download

memory/2456-134-0x0000000005C10000-0x00000000061B4000-memory.dmp

Download

memory/2456-135-0x0000000005560000-0x00000000055F2000-memory.dmp

Download

memory/2456-136-0x0000000005700000-0x0000000005710000-memory.dmp

Download

memory/2456-137-0x0000000005600000-0x000000000560A000-memory.dmp

Download

memory/2456-138-0x0000000005700000-0x0000000005710000-memory.dmp

Download

memory/2456-139-0x0000000007120000-0x00000000071BC000-memory.dmp

Download

memory/3660-140-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/3660-143-0x0000000005200000-0x0000000005210000-memory.dmp

Download

memory/3660-144-0x0000000005600000-0x0000000005666000-memory.dmp

Download

memory/3660-145-0x0000000005200000-0x0000000005210000-memory.dmp

Download