asyncrat | 42bb3272f7eba485223c6c4061be9aa54c72a1dfdeeeef2d737cb8c47b681068

Analysis

max time kernel
142s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
18/08/2023, 01:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8817a1e8ad3bacc4b983ea52a54fe54b595a75986978ff60e331f8a134aafbd6.exe
Size 7.5MB
Sample230818-bwsjesee94
SHA256 8817a1e8ad3bacc4b983ea52a54fe54b595a75986978ff60e331f8a134aafbd6
MD5 64023657cca817495e94afe5f8887be2
SHA1 d55e3d9b41c4cee294cce54964f7e7d7d8788d01
SHA512 c59bd6edf885ca94b0b023746c514566f0f9546a7171476bdd82926cc0caac4710f0a787da0fc8a4fb27601eed9fec1f123680d135f8d5141358d00b2eaa50cb
SSDEEP 98304:ax3zJiOlgXb/hT3y9eLAOk2stoG6isn5MsXSlmxetu1SPbgMp30ac5A8O7KaIBtd:akF3mesOJGX6d4EegATDT8cGZkYg2qp
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

asyncrat default rat

Malware Config

Extracted

Family

asyncrat

Version

Venom RAT + HVNC + Stealer + Grabber v6.0.1

Botnet

Default

185.106.94.122:4449

Mutex

nrasbnbyxirll

Attributes

delay
1
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral2/memory/2596-144-0x0000000000400000-0x0000000000418000-memory.dmp	asyncrat

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3792 set thread context of 2596	3792	8817a1e8ad3bacc4b983ea52a54fe54b595a75986978ff60e331f8a134aafbd6.exe	88

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2488	2596	WerFault.exe	88

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3792	8817a1e8ad3bacc4b983ea52a54fe54b595a75986978ff60e331f8a134aafbd6.exe
3792	8817a1e8ad3bacc4b983ea52a54fe54b595a75986978ff60e331f8a134aafbd6.exe
3792	8817a1e8ad3bacc4b983ea52a54fe54b595a75986978ff60e331f8a134aafbd6.exe
3792	8817a1e8ad3bacc4b983ea52a54fe54b595a75986978ff60e331f8a134aafbd6.exe
3792	8817a1e8ad3bacc4b983ea52a54fe54b595a75986978ff60e331f8a134aafbd6.exe
2596	InstallUtil.exe
2596	InstallUtil.exe
2596	InstallUtil.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3792	8817a1e8ad3bacc4b983ea52a54fe54b595a75986978ff60e331f8a134aafbd6.exe
Token: SeDebugPrivilege	2596	InstallUtil.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2596	InstallUtil.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 3792 wrote to memory of 1096	3792	8817a1e8ad3bacc4b983ea52a54fe54b595a75986978ff60e331f8a134aafbd6.exe	86
PID 3792 wrote to memory of 1096	3792	8817a1e8ad3bacc4b983ea52a54fe54b595a75986978ff60e331f8a134aafbd6.exe	86
PID 3792 wrote to memory of 1096	3792	8817a1e8ad3bacc4b983ea52a54fe54b595a75986978ff60e331f8a134aafbd6.exe	86
PID 3792 wrote to memory of 1096	3792	8817a1e8ad3bacc4b983ea52a54fe54b595a75986978ff60e331f8a134aafbd6.exe	86
PID 3792 wrote to memory of 1096	3792	8817a1e8ad3bacc4b983ea52a54fe54b595a75986978ff60e331f8a134aafbd6.exe	86
PID 3792 wrote to memory of 1096	3792	8817a1e8ad3bacc4b983ea52a54fe54b595a75986978ff60e331f8a134aafbd6.exe	86
PID 3792 wrote to memory of 1096	3792	8817a1e8ad3bacc4b983ea52a54fe54b595a75986978ff60e331f8a134aafbd6.exe	86
PID 3792 wrote to memory of 1096	3792	8817a1e8ad3bacc4b983ea52a54fe54b595a75986978ff60e331f8a134aafbd6.exe	86
PID 3792 wrote to memory of 2596	3792	8817a1e8ad3bacc4b983ea52a54fe54b595a75986978ff60e331f8a134aafbd6.exe	88
PID 3792 wrote to memory of 2596	3792	8817a1e8ad3bacc4b983ea52a54fe54b595a75986978ff60e331f8a134aafbd6.exe	88
PID 3792 wrote to memory of 2596	3792	8817a1e8ad3bacc4b983ea52a54fe54b595a75986978ff60e331f8a134aafbd6.exe	88
PID 3792 wrote to memory of 2596	3792	8817a1e8ad3bacc4b983ea52a54fe54b595a75986978ff60e331f8a134aafbd6.exe	88
PID 3792 wrote to memory of 2596	3792	8817a1e8ad3bacc4b983ea52a54fe54b595a75986978ff60e331f8a134aafbd6.exe	88
PID 3792 wrote to memory of 2596	3792	8817a1e8ad3bacc4b983ea52a54fe54b595a75986978ff60e331f8a134aafbd6.exe	88
PID 3792 wrote to memory of 2596	3792	8817a1e8ad3bacc4b983ea52a54fe54b595a75986978ff60e331f8a134aafbd6.exe	88
PID 3792 wrote to memory of 2596	3792	8817a1e8ad3bacc4b983ea52a54fe54b595a75986978ff60e331f8a134aafbd6.exe	88

C:\Users\Admin\AppData\Local\Temp\8817a1e8ad3bacc4b983ea52a54fe54b595a75986978ff60e331f8a134aafbd6.exe
"C:\Users\Admin\AppData\Local\Temp\8817a1e8ad3bacc4b983ea52a54fe54b595a75986978ff60e331f8a134aafbd6.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3792
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
  2⤵
  PID:1096
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2596
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2596 -s 2664
    3⤵
    - Program crash
    PID:2488

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 2596 -ip 2596
1⤵
PID:3692

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2596-144-0x0000000000400000-0x0000000000418000-memory.dmp

Download

memory/2596-198-0x0000000075230000-0x00000000759E0000-memory.dmp

Download

memory/2596-159-0x0000000007410000-0x000000000742E000-memory.dmp

Download

memory/2596-158-0x0000000007270000-0x00000000072E6000-memory.dmp

Download

memory/2596-157-0x0000000005370000-0x0000000005380000-memory.dmp

Download

memory/2596-156-0x0000000075230000-0x00000000759E0000-memory.dmp

Download

memory/2596-155-0x0000000005370000-0x0000000005380000-memory.dmp

Download

memory/2596-153-0x0000000006720000-0x0000000006786000-memory.dmp

Download

memory/2596-150-0x0000000077D31000-0x0000000077D32000-memory.dmp

Download

memory/2596-149-0x0000000005370000-0x0000000005380000-memory.dmp

Download

memory/2596-147-0x0000000075230000-0x00000000759E0000-memory.dmp

Download

memory/3792-138-0x0000000005C50000-0x0000000005C5A000-memory.dmp

Download

memory/3792-143-0x0000000005D20000-0x0000000005D30000-memory.dmp

Download

memory/3792-146-0x0000000075230000-0x00000000759E0000-memory.dmp

Download

memory/3792-142-0x0000000005D20000-0x0000000005D30000-memory.dmp

Download

memory/3792-141-0x0000000075230000-0x00000000759E0000-memory.dmp

Download

memory/3792-140-0x0000000005D20000-0x0000000005D30000-memory.dmp

Download

memory/3792-139-0x0000000007320000-0x00000000073BC000-memory.dmp

Download

memory/3792-133-0x0000000075230000-0x00000000759E0000-memory.dmp

Download

memory/3792-137-0x0000000005D20000-0x0000000005D30000-memory.dmp

Download

memory/3792-136-0x0000000005BB0000-0x0000000005C42000-memory.dmp

Download

memory/3792-135-0x0000000006160000-0x0000000006704000-memory.dmp

Download

memory/3792-134-0x0000000000A40000-0x00000000011C0000-memory.dmp

Download