asyncrat | f464d1eca16652727a68d9ba70a7760e992063907b2d9b3889d9accf0d0dc9ae | Triage

Analysis

max time kernel
31s
max time network
38s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
30-07-2023 18:57

Sharing

Report Analysis Logs

General

Target

vnm/Stub/Client.exe
Size

63KB
MD5

6158c0682f86511060619bba0fe864be
SHA1

63a1738c87ba9449b1d572ee470da2b242742643
SHA256

5bf4fc2c4d3115229d60511cad1af48019a4c291ad6144e73393e88e319f80a5
SHA512

baef40b589d8717f419185ad0885173f790394827d72d78520890ae737c7ee1cebe3af062340847cfe705c223669562e7116f48ab11d59654653a0b269026bd1
SSDEEP

1536:8WP+BbY58krxvI0TTCNsOoIK7q6LgRAIM8pqKmY7:8WP+BbY5xrxvI0Z7P8R8Xz

Score

10^/10

asyncrat rat

Malware Config

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

Processes:

resource	yara_rule
behavioral3/memory/2248-133-0x0000000000610000-0x0000000000626000-memory.dmp	asyncrat

Program crash 1 IoCs

Processes:

WerFault.exe

pid	pid_target	Process	procid_target
1644	2248	WerFault.exe	84

C:\Users\Admin\AppData\Local\Temp\vnm\Stub\Client.exe
"C:\Users\Admin\AppData\Local\Temp\vnm\Stub\Client.exe"
1⤵
PID:2248
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2248 -s 736
  2⤵
  - Program crash
  PID:1644

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 416 -p 2248 -ip 2248
1⤵
PID:4196

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2248-133-0x0000000000610000-0x0000000000626000-memory.dmp

Filesize
88KB

Download
memory/2248-134-0x00007FFBD1370000-0x00007FFBD1E31000-memory.dmp

Filesize
10.8MB

Download
memory/2248-135-0x00007FFBD1370000-0x00007FFBD1E31000-memory.dmp

Filesize
10.8MB

Download