asyncrat | d447242a078661aa69c652929cbedbc1896b135aa50ed27427ea8c7e4d4a71be

Analysis

max time kernel
143s
max time network
149s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
13/06/2023, 14:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

file.exe
Size

171KB
MD5

7c44e8e46e3f7669ad24db6756895950
SHA1

ad74d9dbca6885a004e21824d87f8e5168030484
SHA256

d447242a078661aa69c652929cbedbc1896b135aa50ed27427ea8c7e4d4a71be
SHA512

97b96bb2d5b07b13aae9768867b040ea67b8cc5bfcbfe15f61fe71809609d3d6c6fa867efec91cd1431d27affae8380bd514788cf5b235142bb8c095458c06fd
SSDEEP

3072:FWAm7g0RE3N82rmAniiFhb7zPeo7f8D6L6W6/68696Ugtdy+PkDLJ6rSIalbn:sHE3i2rmVizt8D6L6W6/68696UgtPkDd

Score

10^/10

asyncrat default rat

Malware Config

Extracted

Family

asyncrat

Version

1.0.7

Botnet

Default

192.168.175.1:1800

Mutex

DcRatMutex_qwqdanchun

Attributes

delay
1
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 3 IoCs

rat

resource	yara_rule
behavioral1/memory/928-57-0x0000000000090000-0x00000000000A2000-memory.dmp	asyncrat
behavioral1/memory/928-64-0x0000000000090000-0x00000000000A2000-memory.dmp	asyncrat
behavioral1/memory/928-63-0x0000000000090000-0x00000000000A2000-memory.dmp	asyncrat

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1108 set thread context of 928	1108	file.exe	28

Program crash 1 IoCs

pid	pid_target	Process	procid_target
472	1108	WerFault.exe	27

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1108	file.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 1108 wrote to memory of 928	1108	file.exe	28
PID 1108 wrote to memory of 928	1108	file.exe	28
PID 1108 wrote to memory of 928	1108	file.exe	28
PID 1108 wrote to memory of 928	1108	file.exe	28
PID 1108 wrote to memory of 928	1108	file.exe	28
PID 1108 wrote to memory of 928	1108	file.exe	28
PID 1108 wrote to memory of 928	1108	file.exe	28
PID 1108 wrote to memory of 928	1108	file.exe	28
PID 1108 wrote to memory of 928	1108	file.exe	28
PID 1108 wrote to memory of 472	1108	file.exe	29
PID 1108 wrote to memory of 472	1108	file.exe	29
PID 1108 wrote to memory of 472	1108	file.exe	29
PID 1108 wrote to memory of 472	1108	file.exe	29

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1108
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  -arguments
  2⤵
  PID:928
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1108 -s 236
  2⤵
  - Program crash
  PID:472

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/928-56-0x0000000000090000-0x00000000000A2000-memory.dmp

Filesize
72KB

Download
memory/928-57-0x0000000000090000-0x00000000000A2000-memory.dmp

Filesize
72KB

Download
memory/928-61-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/928-64-0x0000000000090000-0x00000000000A2000-memory.dmp

Filesize
72KB

Download
memory/928-63-0x0000000000090000-0x00000000000A2000-memory.dmp

Filesize
72KB

Download
memory/928-65-0x00000000006D0000-0x0000000000710000-memory.dmp

Filesize
256KB

Download