asyncrat | 6d1374bb816d1e54b4cffae41830837e0c83985156a4b33f5dbce644bdb61de9

Resubmissions

23-09-2023 06:54

230923-hpl7dsdf3x 10

22-09-2023 05:10

230922-ftprzafc57 10

Analysis

max time kernel
150s
max time network
155s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
22-09-2023 05:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

mta.ps1
Size

743B
MD5

d4567ca45aded54298f9ccf063ed89cf
SHA1

72ef210030f0f470433a6aacc66dfbe4cbfdad5c
SHA256

60416198c9b2105c9204638fd00e154e2f5c32ba45f5a8ae2671bae565c062e9
SHA512

e616e9711a76525a30063b226c1c11131c30199a5cdb6389b6867e8a626d49abfa43c549f83f068fe7dfbe99c62c124ff838e318807ad65e8cd5db318088331e

Score

10^/10

asyncrat default rat

Malware Config

Extracted

Family

asyncrat

Version

Venom RAT + HVNC + Stealer + Grabber v6.0.3

Botnet

Default

193.161.193.99:31507

Mutex

ajmlxbvgoegjpkevdnz

Attributes

delay
1
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral5/memory/1752-18-0x000000001BAD0000-0x000000001BAE8000-memory.dmp	asyncrat

Blocklisted process makes network request 33 IoCs

flow	pid	Process
2	1752	powershell.exe
3	1752	powershell.exe
4	1752	powershell.exe
5	1752	powershell.exe
6	1752	powershell.exe
7	1752	powershell.exe
8	1752	powershell.exe
9	1752	powershell.exe
10	1752	powershell.exe
11	1752	powershell.exe
12	1752	powershell.exe
13	1752	powershell.exe
14	1752	powershell.exe
15	1752	powershell.exe
16	1752	powershell.exe
17	1752	powershell.exe
18	1752	powershell.exe
19	1752	powershell.exe
20	1752	powershell.exe
21	1752	powershell.exe
22	1752	powershell.exe
23	1752	powershell.exe
24	1752	powershell.exe
25	1752	powershell.exe
26	1752	powershell.exe
27	1752	powershell.exe
28	1752	powershell.exe
29	1752	powershell.exe
30	1752	powershell.exe
31	1752	powershell.exe
32	1752	powershell.exe
33	1752	powershell.exe
34	1752	powershell.exe

Downloads MZ/PE file

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
1752	powershell.exe
1752	powershell.exe
1752	powershell.exe
1752	powershell.exe
1752	powershell.exe
1752	powershell.exe
1752	powershell.exe
1752	powershell.exe
1752	powershell.exe
1752	powershell.exe
1752	powershell.exe
1752	powershell.exe
1752	powershell.exe
1752	powershell.exe
1752	powershell.exe
1752	powershell.exe
1752	powershell.exe
1752	powershell.exe
1752	powershell.exe
1752	powershell.exe
1752	powershell.exe
1752	powershell.exe
1752	powershell.exe
1752	powershell.exe
1752	powershell.exe
1752	powershell.exe
1752	powershell.exe
1752	powershell.exe
1752	powershell.exe
1752	powershell.exe
1752	powershell.exe
1752	powershell.exe
1752	powershell.exe
1752	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1752	powershell.exe
Token: SeDebugPrivilege	1752	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1752	powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\mta.ps1
1⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1752

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1752-4-0x000007FEF5A80000-0x000007FEF641D000-memory.dmp

Filesize
9.6MB

Download
memory/1752-6-0x0000000001E90000-0x0000000001F10000-memory.dmp

Filesize
512KB

Download
memory/1752-5-0x000000001B380000-0x000000001B662000-memory.dmp

Filesize
2.9MB

Download
memory/1752-7-0x0000000002310000-0x0000000002318000-memory.dmp

Filesize
32KB

Download
memory/1752-8-0x000007FEF5A80000-0x000007FEF641D000-memory.dmp

Filesize
9.6MB

Download
memory/1752-9-0x0000000001E90000-0x0000000001F10000-memory.dmp

Filesize
512KB

Download
memory/1752-10-0x0000000001E90000-0x0000000001F10000-memory.dmp

Filesize
512KB

Download
memory/1752-11-0x0000000001E90000-0x0000000001F10000-memory.dmp

Filesize
512KB

Download
memory/1752-12-0x000007FEF5A80000-0x000007FEF641D000-memory.dmp

Filesize
9.6MB

Download
memory/1752-13-0x0000000001E90000-0x0000000001F10000-memory.dmp

Filesize
512KB

Download
memory/1752-14-0x0000000001E90000-0x0000000001F10000-memory.dmp

Filesize
512KB

Download
memory/1752-15-0x0000000001E90000-0x0000000001F10000-memory.dmp

Filesize
512KB

Download
memory/1752-16-0x0000000001E90000-0x0000000001F10000-memory.dmp

Filesize
512KB

Download
memory/1752-17-0x000000001C7E0000-0x000000001C830000-memory.dmp

Filesize
320KB

Download
memory/1752-18-0x000000001BAD0000-0x000000001BAE8000-memory.dmp

Filesize
96KB

Download
memory/1752-19-0x000007FEEE2B0000-0x000007FEEEC9C000-memory.dmp

Filesize
9.9MB

Download
memory/1752-20-0x0000000001E90000-0x0000000001F10000-memory.dmp

Filesize
512KB

Download
memory/1752-21-0x0000000001E90000-0x0000000001F10000-memory.dmp

Filesize
512KB

Download
memory/1752-23-0x0000000001E90000-0x0000000001F10000-memory.dmp

Filesize
512KB

Download
memory/1752-24-0x00000000773F0000-0x0000000077599000-memory.dmp

Filesize
1.7MB

Download
memory/1752-25-0x000007FEEE2B0000-0x000007FEEEC9C000-memory.dmp

Filesize
9.9MB

Download
memory/1752-26-0x0000000001E90000-0x0000000001F10000-memory.dmp

Filesize
512KB

Download
memory/1752-28-0x00000000773F0000-0x0000000077599000-memory.dmp

Filesize
1.7MB

Download