asyncrat | 7549d4a121e1e7b5dc056cebe025d1af3d8c03440cad9bb23697c3f9bc6d07a9

Analysis

max time kernel
193s
max time network
224s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
11-10-2023 11:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

404967d9e5bf0c8c4158e88c8df50c913c334e62d54c9de0f1dbd1bf5da57497.ps1
Size

437KB
MD5

4d238bb8bfad4e8ccc3343ea91da991e
SHA1

a502910cb686be7a6fc9ce76a40078fb5d36f6da
SHA256

404967d9e5bf0c8c4158e88c8df50c913c334e62d54c9de0f1dbd1bf5da57497
SHA512

3f53c43e85bd189547a439734d147cb73f4400dc895562e1aa7c33f90e454f3f4e458be7e9bad2e1c8526aa0702975940747f2ced8709a298cb4544d0eb9dae3
SSDEEP

3072:o1AJasaQ315U3Apg4ypzUeE6Ue+VM8fpBTUv1vZuWQI2:o1AJH315U3Apg0VNRBRWQI2

Score

10^/10

asyncrat mac rat

Malware Config

Extracted

Family

asyncrat

Version

| Edit 3LOSH RAT

Botnet

MAC

74.208.105.80:7777

74.208.105.80:2005

mtest.loseyourip.com:7777

mtest.loseyourip.com:2005

Mutex

AsyncMutex_3losh

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral4/memory/4808-19-0x0000000000400000-0x0000000000416000-memory.dmp	asyncrat

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1896 set thread context of 4808	1896	powershell.exe	88

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1896	powershell.exe
1896	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1896	powershell.exe
Token: SeDebugPrivilege	4808	RegSvcs.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1896 wrote to memory of 4808	1896	powershell.exe	88
PID 1896 wrote to memory of 4808	1896	powershell.exe	88
PID 1896 wrote to memory of 4808	1896	powershell.exe	88
PID 1896 wrote to memory of 4808	1896	powershell.exe	88
PID 1896 wrote to memory of 4808	1896	powershell.exe	88
PID 1896 wrote to memory of 4808	1896	powershell.exe	88
PID 1896 wrote to memory of 4808	1896	powershell.exe	88
PID 1896 wrote to memory of 4808	1896	powershell.exe	88

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\404967d9e5bf0c8c4158e88c8df50c913c334e62d54c9de0f1dbd1bf5da57497.ps1
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1896
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4808

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_maforgtr.tzq.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/1896-16-0x000001C1F5860000-0x000001C1F5870000-memory.dmp

Filesize
64KB

Download
memory/1896-13-0x000001C1F5860000-0x000001C1F5870000-memory.dmp

Filesize
64KB

Download
memory/1896-17-0x000001C1F5860000-0x000001C1F5870000-memory.dmp

Filesize
64KB

Download
memory/1896-12-0x000001C1F5860000-0x000001C1F5870000-memory.dmp

Filesize
64KB

Download
memory/1896-18-0x000001C1F5BE0000-0x000001C1F5C0C000-memory.dmp

Filesize
176KB

Download
memory/1896-14-0x00007FFFF96F0000-0x00007FFFFA1B1000-memory.dmp

Filesize
10.8MB

Download
memory/1896-15-0x000001C1F5860000-0x000001C1F5870000-memory.dmp

Filesize
64KB

Download
memory/1896-22-0x00007FFFF96F0000-0x00007FFFFA1B1000-memory.dmp

Filesize
10.8MB

Download
memory/1896-11-0x000001C1F5860000-0x000001C1F5870000-memory.dmp

Filesize
64KB

Download
memory/1896-10-0x00007FFFF96F0000-0x00007FFFFA1B1000-memory.dmp

Filesize
10.8MB

Download
memory/1896-0-0x000001C1F5870000-0x000001C1F5892000-memory.dmp

Filesize
136KB

Download
memory/4808-19-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/4808-23-0x0000000074D30000-0x00000000754E0000-memory.dmp

Filesize
7.7MB

Download
memory/4808-24-0x0000000074D30000-0x00000000754E0000-memory.dmp

Filesize
7.7MB

Download
memory/4808-25-0x0000000002A40000-0x0000000002A50000-memory.dmp

Filesize
64KB

Download
memory/4808-26-0x0000000002A40000-0x0000000002A50000-memory.dmp

Filesize
64KB

Download
memory/4808-27-0x0000000005B90000-0x0000000006134000-memory.dmp

Filesize
5.6MB

Download