asyncrat | 5ca36203dcf4de2fb898308d50cb01aa4bbe3810a398a1f5e14b3aff1de16f65

Analysis

max time kernel
114s
max time network
119s
platform
windows7_x64
resource
win7-20230705-en
resource tags

arch:x64arch:x86image:win7-20230705-enlocale:en-usos:windows7-x64system
submitted
07/07/2023, 13:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
decode_409ea0deab39fc39e8f106a912f39176f58b85622cae933a8e1716db388e4cf8.exe
Size 47KB
Sample230707-q74hdsaf4y
SHA256 5ca36203dcf4de2fb898308d50cb01aa4bbe3810a398a1f5e14b3aff1de16f65
MD5 6c3e9f207ede400a9938fa93ee299fa3
SHA1 39d29c2835fafac2ae4070d2b6f11158c97eca23
SHA512 b9e5336aec44fd375adfe7a96634b0f551077b06d06d97b4999d03e945163f956ba1a84b44e9d0a09645b77728741e74e430fe63c6e4da3dce1c6952a1dcde40
SSDEEP 768:BOEuILWCKi+DiPdPaRD9SBiu3bsYb5gebAhmvEgK/JrZVc6KN:BOtmRqUx3bjbWI1nkJrZVclN
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

asyncrat 30junio-pjoaojs rat

Malware Config

Extracted

Family

asyncrat

Version

1.0.7

Botnet

30JUNIO-PJOAOJS

20.200.63.2:2727

Mutex

DcRatMutex_qwqdanchun

Attributes

delay
1
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 2 IoCs

rat

resource	yara_rule
behavioral1/memory/2144-54-0x0000000000080000-0x0000000000092000-memory.dmp	asyncrat
behavioral1/memory/2144-74-0x000000001A510000-0x000000001A574000-memory.dmp	asyncrat

Deletes itself 1 IoCs

pid	Process
2612	cmd.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
2556	timeout.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2144	decode_409ea0deab39fc39e8f106a912f39176f58b85622cae933a8e1716db388e4cf8.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2144 wrote to memory of 2612	2144	decode_409ea0deab39fc39e8f106a912f39176f58b85622cae933a8e1716db388e4cf8.exe	28
PID 2144 wrote to memory of 2612	2144	decode_409ea0deab39fc39e8f106a912f39176f58b85622cae933a8e1716db388e4cf8.exe	28
PID 2144 wrote to memory of 2612	2144	decode_409ea0deab39fc39e8f106a912f39176f58b85622cae933a8e1716db388e4cf8.exe	28
PID 2612 wrote to memory of 2556	2612	cmd.exe	30
PID 2612 wrote to memory of 2556	2612	cmd.exe	30
PID 2612 wrote to memory of 2556	2612	cmd.exe	30

C:\Users\Admin\AppData\Local\Temp\decode_409ea0deab39fc39e8f106a912f39176f58b85622cae933a8e1716db388e4cf8.exe
"C:\Users\Admin\AppData\Local\Temp\decode_409ea0deab39fc39e8f106a912f39176f58b85622cae933a8e1716db388e4cf8.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2144
- C:\Windows\system32\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp1A6D.tmp.bat""
  2⤵
  - Deletes itself
  - Suspicious use of WriteProcessMemory
  PID:2612
- - C:\Windows\system32\timeout.exe
    timeout 3
    3⤵
    - Delays execution with timeout.exe
    PID:2556

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

Cab914A.tmp

Path C:\Users\Admin\AppData\Local\Temp\Cab914A.tmp
Size 62KB
SHA256 d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904
MD5 3ac860860707baaf32469fa7cc7c0192
SHA1 c33c2acdaba0e6fa41fd2f00f186804722477639
SHA512 d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c
SSDEEP 1536:MRxM2u+06GOIVUvVmMKAfUfsrPa1jfCu18ZNMe3v:KMH+F3IacMZ2CPACu1GN7v
MD5 SHA1 SHA512 SSDEEP

Submit Download

Tar17EA.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tar17EA.tmp
Size 164KB
SHA256 c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6
MD5 4ff65ad929cd9a367680e0e5b1c08166
SHA1 c0af0d4396bd1f15c45f39d3b849ba444233b3a2
SHA512 f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27
SSDEEP 1536:FUdJXlCUs0Rv0/29TFrJW5ibN/5YJkKCdru2hRIwjYvjCQ9vbmt6t0:FIJXq0Rn5JaJkHru2h2jCEvt2
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmp1A6D.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmp1A6D.tmp.bat
Size 223B
SHA256 3409d9b2d8c309d841c9f72068978333813645adb4d3916390dff641caed7a18
MD5 51afcfe4bcbe0b24037a37294b9f72f4
SHA1 6ee395e2d6421ac1bc9f08813dbf530cb833901a
SHA512 2ed94655b820622b1c7114cb5bc4bb2ab1991d788205dd6b4c2756fca77ea9fe6239594f2f14acb9b30a204f396ab3ee3e4708a5b80fe9e4c860767257cb4df1
MD5 SHA1 SHA512

Submit Download

tmp1A6D.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmp1A6D.tmp.bat
Size 223B
SHA256 3409d9b2d8c309d841c9f72068978333813645adb4d3916390dff641caed7a18
MD5 51afcfe4bcbe0b24037a37294b9f72f4
SHA1 6ee395e2d6421ac1bc9f08813dbf530cb833901a
SHA512 2ed94655b820622b1c7114cb5bc4bb2ab1991d788205dd6b4c2756fca77ea9fe6239594f2f14acb9b30a204f396ab3ee3e4708a5b80fe9e4c860767257cb4df1
MD5 SHA1 SHA512

Submit Download

memory/2144-54-0x0000000000080000-0x0000000000092000-memory.dmp

Download

memory/2144-55-0x000000001AFB0000-0x000000001B030000-memory.dmp

Download

memory/2144-72-0x000000001AFB0000-0x000000001B030000-memory.dmp

Download

memory/2144-74-0x000000001A510000-0x000000001A574000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads