asyncrat | 4de6ae6aac77baf7408332927e2ee3884a0719e97614b8a3a7af75d021f2ba7e

Analysis

max time kernel
31s
max time network
153s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
26/04/2023, 05:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
remittance-slip-confirmation-.exe
Size 1.1MB
Sample230426-fx5btsfc25
SHA256 4de6ae6aac77baf7408332927e2ee3884a0719e97614b8a3a7af75d021f2ba7e
MD5 b1c4504ac7001d8feefe5da649dc8916
SHA1 dceddacd349ddfc8a61607f317453c775766a256
SHA512 05069a6d0cf7b3f18937200715bb009144d23e82b94593130a3a00fc51c02f8c8c845eec190e333ec40ab465a972ca94430fef2448b6eb1964d3f550fdb08cee
SSDEEP 12288:BdFoZKst6nwr1c+2YC/tyuncQk2nFKQ+IBUJHKOUHzrBAukaWhAjQpOSvKiNhQsl:BdFu6nwX6/tyufAuk3W8pO1U
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

asyncrat default rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

Default

37.120.210.219:48408

Mutex

AsyncMutex_6SI8OkPnk

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 7 IoCs

rat

resource	yara_rule
behavioral1/memory/1832-60-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat
behavioral1/memory/1832-61-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat
behavioral1/memory/1832-63-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat
behavioral1/memory/1832-65-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat
behavioral1/memory/1832-67-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat
behavioral1/memory/1832-68-0x0000000000480000-0x00000000004C0000-memory.dmp	asyncrat
behavioral1/memory/1832-86-0x0000000000480000-0x00000000004C0000-memory.dmp	asyncrat

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1964 set thread context of 1832	1964	remittance-slip-confirmation-.exe	30

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1832	RegSvcs.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1964 wrote to memory of 2000	1964	remittance-slip-confirmation-.exe	28
PID 1964 wrote to memory of 2000	1964	remittance-slip-confirmation-.exe	28
PID 1964 wrote to memory of 2000	1964	remittance-slip-confirmation-.exe	28
PID 1964 wrote to memory of 2000	1964	remittance-slip-confirmation-.exe	28
PID 1964 wrote to memory of 1832	1964	remittance-slip-confirmation-.exe	30
PID 1964 wrote to memory of 1832	1964	remittance-slip-confirmation-.exe	30
PID 1964 wrote to memory of 1832	1964	remittance-slip-confirmation-.exe	30
PID 1964 wrote to memory of 1832	1964	remittance-slip-confirmation-.exe	30
PID 1964 wrote to memory of 1832	1964	remittance-slip-confirmation-.exe	30
PID 1964 wrote to memory of 1832	1964	remittance-slip-confirmation-.exe	30
PID 1964 wrote to memory of 1832	1964	remittance-slip-confirmation-.exe	30
PID 1964 wrote to memory of 1832	1964	remittance-slip-confirmation-.exe	30
PID 1964 wrote to memory of 1832	1964	remittance-slip-confirmation-.exe	30
PID 1964 wrote to memory of 1832	1964	remittance-slip-confirmation-.exe	30
PID 1964 wrote to memory of 1832	1964	remittance-slip-confirmation-.exe	30
PID 1964 wrote to memory of 1832	1964	remittance-slip-confirmation-.exe	30

C:\Users\Admin\AppData\Local\Temp\remittance-slip-confirmation-.exe
"C:\Users\Admin\AppData\Local\Temp\remittance-slip-confirmation-.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1964
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe"
  2⤵
  PID:2000
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1832

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1832-61-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/1832-58-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/1832-59-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/1832-60-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/1832-62-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Download

memory/1832-63-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/1832-65-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/1832-67-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/1832-68-0x0000000000480000-0x00000000004C0000-memory.dmp

Download

memory/1832-86-0x0000000000480000-0x00000000004C0000-memory.dmp

Download

memory/1964-56-0x0000000000350000-0x000000000035C000-memory.dmp

Download

memory/1964-57-0x0000000000390000-0x0000000000398000-memory.dmp

Download

memory/1964-54-0x0000000001170000-0x000000000129A000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads