asyncrat | bafb79c0260edbcb4a9d78aa5d0a2e0198c4d86b097c1118c732add640d237c0

Analysis

max time kernel
147s
max time network
148s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
11/05/2023, 00:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 73KB
Sample230511-avmfcacf9z
SHA256 bafb79c0260edbcb4a9d78aa5d0a2e0198c4d86b097c1118c732add640d237c0
MD5 f28f5f2088dddb4d5fd512e870afec1e
SHA1 ac3e9b13e7162fffe2abe7bf3cc09525ceeb28ca
SHA512 5f069c2e50feb4bd287185cc26df43212339635fd9654fae86f3819f6a852caf49467c4532d3f831f1911040c1b791bac7f158a7dc164217b720ba005270a8ec
SSDEEP 1536:dUZGcx5NVCMoPMVls4cd4nYYYHYYYYYYYYYZKYFYY6MYY99bzYYtgI/I1b9/oQz3:dU8cx5zHoPMVlrcwI1b9wQSlY
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

asyncrat default discovery rat

Malware Config

Extracted

Family

asyncrat

Version

Venom Pwn3rzs' Edtition v6.0.1

Botnet

Default

66.94.105.170:4449

Mutex

ntiiaobeojniys

Attributes

delay
1
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
840	file.exe
840	file.exe
840	file.exe
840	file.exe
840	file.exe
840	file.exe
840	file.exe
840	file.exe
840	file.exe
840	file.exe
840	file.exe
840	file.exe
840	file.exe
840	file.exe
840	file.exe
840	file.exe
840	file.exe
840	file.exe
840	file.exe
840	file.exe
840	file.exe
840	file.exe
840	file.exe
840	file.exe
840	file.exe
840	file.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	840	file.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
840	file.exe

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:840

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

94308059B57B3142E455B38A6EB92015

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
Size 62KB
SHA256 d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904
MD5 3ac860860707baaf32469fa7cc7c0192
SHA1 c33c2acdaba0e6fa41fd2f00f186804722477639
SHA512 d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c
SSDEEP 1536:MRxM2u+06GOIVUvVmMKAfUfsrPa1jfCu18ZNMe3v:KMH+F3IacMZ2CPACu1GN7v
MD5 SHA1 SHA512 SSDEEP

Submit Download

Tar3D56.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tar3D56.tmp
Size 164KB
SHA256 c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6
MD5 4ff65ad929cd9a367680e0e5b1c08166
SHA1 c0af0d4396bd1f15c45f39d3b849ba444233b3a2
SHA512 f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27
SSDEEP 1536:FUdJXlCUs0Rv0/29TFrJW5ibN/5YJkKCdru2hRIwjYvjCQ9vbmt6t0:FIJXq0Rn5JaJkHru2h2jCEvt2
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/840-54-0x0000000000270000-0x0000000000286000-memory.dmp

Download

memory/840-56-0x000000001BBB0000-0x000000001BC30000-memory.dmp

Download

memory/840-114-0x000000001BBB0000-0x000000001BC30000-memory.dmp

Download