asyncrat | 3cbec3c93a782db30683c6da93d4596d17f9eac032bc3b1def0db4f09d96ca14

Analysis

max time kernel
142s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
29/08/2023, 11:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NOTIFICACION DEMNADA EN SU CONTRA/1 NOTIFICACION DEMNADA EN SU CONTRA ...exe
Size

3.6MB
MD5

b715350905b9929d73f23bfced524f9f
SHA1

e2d229648da668e6f4db02f843fbf3d33a160f6e
SHA256

ddbfe7b56e871f221aedd2c0aa80f18f506b36cbb030bc3958f188c086fdf8be
SHA512

171c90d5bc1f0f7b228f0a695469c4581dc3ee79a6499c3a2e16eeddff32d02cb59d1bb5a205ce3b37c441c191711fa8c0d3db75f33821e38cbd4af28b2cc794
SSDEEP

49152:mI8msRR0cePMyfKZsU6Voz6KKT+AS8aeVMZ7qWuu2CwAj:+RZsZOFKT+AQ2

Score

10^/10

asyncrat default rat

Malware Config

Extracted

Family

asyncrat

Version

| Edit 3LOSH RAT

Botnet

Default

marli27.duckdns.org:2727

Mutex

AsyncMutex_6SI8OkPnk

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral2/memory/2064-15-0x00000000007B0000-0x00000000007C6000-memory.dmp	asyncrat

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4200 set thread context of 4624	4200	1 NOTIFICACION DEMNADA EN SU CONTRA ...exe	80

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
4200	1 NOTIFICACION DEMNADA EN SU CONTRA ...exe
4624	cmd.exe
2064	MSBuild.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
4200	1 NOTIFICACION DEMNADA EN SU CONTRA ...exe
4624	cmd.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2064	MSBuild.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2064	MSBuild.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4200 wrote to memory of 4624	4200	1 NOTIFICACION DEMNADA EN SU CONTRA ...exe	80
PID 4200 wrote to memory of 4624	4200	1 NOTIFICACION DEMNADA EN SU CONTRA ...exe	80
PID 4200 wrote to memory of 4624	4200	1 NOTIFICACION DEMNADA EN SU CONTRA ...exe	80
PID 4200 wrote to memory of 4624	4200	1 NOTIFICACION DEMNADA EN SU CONTRA ...exe	80
PID 4624 wrote to memory of 2064	4624	cmd.exe	93
PID 4624 wrote to memory of 2064	4624	cmd.exe	93
PID 4624 wrote to memory of 2064	4624	cmd.exe	93
PID 4624 wrote to memory of 2064	4624	cmd.exe	93
PID 4624 wrote to memory of 2064	4624	cmd.exe	93

C:\Users\Admin\AppData\Local\Temp\NOTIFICACION DEMNADA EN SU CONTRA\1 NOTIFICACION DEMNADA EN SU CONTRA ...exe
"C:\Users\Admin\AppData\Local\Temp\NOTIFICACION DEMNADA EN SU CONTRA\1 NOTIFICACION DEMNADA EN SU CONTRA ...exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4200
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\SysWOW64\cmd.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:4624
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:2064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\18770618

Filesize
488KB

MD5
c6471c890c05f72ffd78bf6f9c961663

SHA1
96b68706cfea80386f70a98b3cf7a5e66c8c20af

SHA256
f2bcac3d59d036a3e1cb7a2e19377bf9ad4bce9671f1cdd0163c72f697f8e37a

SHA512
e67e53b19d5eab45fbbd0aef990de09dcd92e6d85c83a1ed695631c57f7d2d2536e44b5350e263604025d3b8ac3371b2328bff8c3d0df33bb090b67a85aa32fc

Download Submit
memory/2064-18-0x0000000005630000-0x0000000005BD4000-memory.dmp

Filesize
5.6MB

Download
memory/2064-15-0x00000000007B0000-0x00000000007C6000-memory.dmp

Filesize
88KB

Download
memory/2064-16-0x0000000073100000-0x00000000738B0000-memory.dmp

Filesize
7.7MB

Download
memory/2064-17-0x0000000002850000-0x0000000002860000-memory.dmp

Filesize
64KB

Download
memory/2064-19-0x0000000005270000-0x0000000005302000-memory.dmp

Filesize
584KB

Download
memory/2064-20-0x0000000005260000-0x000000000526A000-memory.dmp

Filesize
40KB

Download
memory/2064-21-0x0000000073100000-0x00000000738B0000-memory.dmp

Filesize
7.7MB

Download
memory/2064-22-0x0000000002850000-0x0000000002860000-memory.dmp

Filesize
64KB

Download
memory/4200-0-0x00007FF977FC0000-0x00007FF979637000-memory.dmp

Filesize
22.5MB

Download
memory/4624-6-0x00007FF9964D0000-0x00007FF9966C5000-memory.dmp

Filesize
2.0MB

Download
memory/4624-9-0x00000000741E0000-0x0000000075434000-memory.dmp

Filesize
18.3MB

Download
memory/4624-10-0x00000000741E0000-0x0000000075434000-memory.dmp

Filesize
18.3MB

Download
memory/4624-14-0x00000000741E0000-0x0000000075434000-memory.dmp

Filesize
18.3MB

Download