asyncrat | e7bf6176eb0f048d92c32f88265fb268e1fcb95c010b8ac561a830b20be0b756

Analysis

max time kernel
149s
max time network
153s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
16-06-2023 15:11

Target

f96c9a248732ef1465a9bf5d838c3ff5b47c0330dbc05be28611fc1c7461f9e6.exe
Size

1.4MB
MD5

6a18ac5e750f3e17501fa3021972ead1
SHA1

7d5772f7caf17b5de57411f9c1d75e1135447b74
SHA256

f96c9a248732ef1465a9bf5d838c3ff5b47c0330dbc05be28611fc1c7461f9e6
SHA512

d3e1af011cc435003f4b1e1abca896a6eb2a1e9f4ce2019132b6559a570fc439ab4ac29f76cffb2dc432b4f863ca0d1bf5fde4ab4a8381c93c6ddaa18f134134
SSDEEP

12288:etvjAl4blss8+o4BIHAiKw7d4C+TSD0fzlj7iXhASBijMoryJKnS2IingFdYxYeU:SvjAl2lss82GIfzljHSIYG8bFLv

Score

10^/10

Family

asyncrat

Version

1.0.7

Botnet

Default

aa9064aa.e1.luyouxia.net:22391

Mutex

Attributes

aes.plain

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral19/memory/1992-54-0x0000000000260000-0x0000000000272000-memory.dmp	asyncrat
behavioral19/memory/1992-56-0x000000001B440000-0x000000001B4C0000-memory.dmp	asyncrat

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

f96c9a248732ef1465a9bf5d838c3ff5b47c0330dbc05be28611fc1c7461f9e6.exe

description pid process

Token: SeDebugPrivilege 1992 f96c9a248732ef1465a9bf5d838c3ff5b47c0330dbc05be28611fc1c7461f9e6.exe

description	pid	process
Token: SeDebugPrivilege	1992	f96c9a248732ef1465a9bf5d838c3ff5b47c0330dbc05be28611fc1c7461f9e6.exe

C:\Users\Admin\AppData\Local\Temp\f96c9a248732ef1465a9bf5d838c3ff5b47c0330dbc05be28611fc1c7461f9e6.exe
"C:\Users\Admin\AppData\Local\Temp\f96c9a248732ef1465a9bf5d838c3ff5b47c0330dbc05be28611fc1c7461f9e6.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1992

C:\Users\Admin\AppData\Local\Temp\Cab7C25.tmp
Filesize
62KB

MD5
3ac860860707baaf32469fa7cc7c0192

SHA1
c33c2acdaba0e6fa41fd2f00f186804722477639

SHA256
d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

SHA512
d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar97E4.tmp
Filesize
164KB

MD5
4ff65ad929cd9a367680e0e5b1c08166

SHA1
c0af0d4396bd1f15c45f39d3b849ba444233b3a2

SHA256
c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6

SHA512
f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27

Download Submit
memory/1992-54-0x0000000000260000-0x0000000000272000-memory.dmp

Filesize
72KB

Download
memory/1992-55-0x00000000003D0000-0x00000000004D1000-memory.dmp

Filesize
1.0MB

Download
memory/1992-56-0x000000001B440000-0x000000001B4C0000-memory.dmp

Filesize
512KB

Download
memory/1992-57-0x000000001B440000-0x000000001B4C0000-memory.dmp

Filesize
512KB

Download
memory/1992-58-0x000000001B440000-0x000000001B4C0000-memory.dmp

Filesize
512KB

Download
memory/1992-66-0x000000001B440000-0x000000001B4C0000-memory.dmp

Filesize
512KB

Download
memory/1992-67-0x000000001B440000-0x000000001B4C0000-memory.dmp

Filesize
512KB

Download
memory/1992-68-0x000000001B440000-0x000000001B4C0000-memory.dmp

Filesize
512KB

Download