asyncrat | ecfe749ca04339d05d3356c3be6bd1302aec7774422a905ca5312bebf6df7000

Analysis

max time kernel
145s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
31/12/2023, 12:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

36bcd0bf1863c84be2cdb2398d205887.exe
Size

396KB
MD5

36bcd0bf1863c84be2cdb2398d205887
SHA1

d8165079d9616a3502a4393e27495644196461f0
SHA256

ecfe749ca04339d05d3356c3be6bd1302aec7774422a905ca5312bebf6df7000
SHA512

2fcf561add267895798a08fbc56fa53fd0e34407792f983d1df39448d309296cf75e877f6ffaf316105d883c55eb7015cb4b0c080bc1f288a9cabd17bbf8252e
SSDEEP

6144:n8WER+4xoaTZAvPT+Rd7bFso13zW4yhUp7v0G9BxQZNONJi3Ymz1g:n8Wwr/T2PT+RFqo1jW4csv0wOng

Score

10^/10

asyncrat default rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

Default

127.0.0.1:6606

127.0.0.1:7707

127.0.0.1:8808

Mutex

AsyncMutex_6SI8OkPnk

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 24 IoCs

rat

resource	yara_rule
behavioral2/memory/1236-36-0x00000000005D0000-0x00000000006D0000-memory.dmp	asyncrat
behavioral2/memory/1236-37-0x00000000005D0000-0x00000000006D0000-memory.dmp	asyncrat
behavioral2/memory/1236-41-0x00000000005D0000-0x00000000006D0000-memory.dmp	asyncrat
behavioral2/memory/1236-44-0x00000000005D0000-0x00000000006D0000-memory.dmp	asyncrat
behavioral2/memory/1236-47-0x00000000005D0000-0x00000000006D0000-memory.dmp	asyncrat
behavioral2/memory/1236-51-0x00000000005D0000-0x00000000006D0000-memory.dmp	asyncrat
behavioral2/memory/1236-50-0x00000000005D0000-0x00000000006D0000-memory.dmp	asyncrat
behavioral2/memory/1236-49-0x00000000005D0000-0x00000000006D0000-memory.dmp	asyncrat
behavioral2/memory/1236-48-0x00000000005D0000-0x00000000006D0000-memory.dmp	asyncrat
behavioral2/memory/1236-46-0x00000000005D0000-0x00000000006D0000-memory.dmp	asyncrat
behavioral2/memory/1236-45-0x00000000005D0000-0x00000000006D0000-memory.dmp	asyncrat
behavioral2/memory/1236-43-0x00000000005D0000-0x00000000006D0000-memory.dmp	asyncrat
behavioral2/memory/1236-42-0x00000000005D0000-0x00000000006D0000-memory.dmp	asyncrat
behavioral2/memory/1236-40-0x00000000005D0000-0x00000000006D0000-memory.dmp	asyncrat
behavioral2/memory/1236-38-0x00000000005D0000-0x00000000006D0000-memory.dmp	asyncrat
behavioral2/memory/1236-54-0x00000000005D0000-0x00000000006D0000-memory.dmp	asyncrat
behavioral2/memory/1236-56-0x00000000005D0000-0x00000000006D0000-memory.dmp	asyncrat
behavioral2/memory/1236-62-0x00000000005D0000-0x00000000006D0000-memory.dmp	asyncrat
behavioral2/memory/1236-73-0x00000000005D0000-0x00000000006D0000-memory.dmp	asyncrat
behavioral2/memory/4908-76-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat
behavioral2/memory/1236-66-0x00000000005D0000-0x00000000006D0000-memory.dmp	asyncrat
behavioral2/memory/4908-65-0x0000000000400000-0x0000000000417000-memory.dmp	asyncrat
behavioral2/memory/1236-63-0x00000000005D0000-0x00000000006D0000-memory.dmp	asyncrat
behavioral2/memory/1236-60-0x00000000005D0000-0x00000000006D0000-memory.dmp	asyncrat

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
4908	regasm.exe
4908	regasm.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1236 set thread context of 4908	1236	36bcd0bf1863c84be2cdb2398d205887.exe	95

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4908	regasm.exe
4908	regasm.exe
4908	regasm.exe
4908	regasm.exe
4908	regasm.exe
4908	regasm.exe
4908	regasm.exe
4908	regasm.exe
4908	regasm.exe
4908	regasm.exe
4908	regasm.exe
4908	regasm.exe
4908	regasm.exe
4908	regasm.exe
4908	regasm.exe
4908	regasm.exe
4908	regasm.exe
4908	regasm.exe
4908	regasm.exe
4908	regasm.exe
4908	regasm.exe
4908	regasm.exe
4908	regasm.exe
4908	regasm.exe
4908	regasm.exe
4908	regasm.exe
4908	regasm.exe
4908	regasm.exe
4908	regasm.exe
4908	regasm.exe
4908	regasm.exe
4908	regasm.exe
4908	regasm.exe
4908	regasm.exe
4908	regasm.exe
4908	regasm.exe
4908	regasm.exe
4908	regasm.exe
4908	regasm.exe
4908	regasm.exe
4908	regasm.exe
4908	regasm.exe
4908	regasm.exe
4908	regasm.exe
4908	regasm.exe
4908	regasm.exe
4908	regasm.exe
4908	regasm.exe
4908	regasm.exe
4908	regasm.exe
4908	regasm.exe
4908	regasm.exe
4908	regasm.exe
4908	regasm.exe
4908	regasm.exe
4908	regasm.exe
4908	regasm.exe
4908	regasm.exe
4908	regasm.exe
4908	regasm.exe
4908	regasm.exe
4908	regasm.exe
4908	regasm.exe
4908	regasm.exe

Suspicious behavior: MapViewOfSection 3 IoCs

pid	Process
1236	36bcd0bf1863c84be2cdb2398d205887.exe
1236	36bcd0bf1863c84be2cdb2398d205887.exe
1236	36bcd0bf1863c84be2cdb2398d205887.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1236	36bcd0bf1863c84be2cdb2398d205887.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1236 wrote to memory of 2856	1236	36bcd0bf1863c84be2cdb2398d205887.exe	97
PID 1236 wrote to memory of 2856	1236	36bcd0bf1863c84be2cdb2398d205887.exe	97
PID 1236 wrote to memory of 2856	1236	36bcd0bf1863c84be2cdb2398d205887.exe	97
PID 1236 wrote to memory of 2856	1236	36bcd0bf1863c84be2cdb2398d205887.exe	97
PID 1236 wrote to memory of 3748	1236	36bcd0bf1863c84be2cdb2398d205887.exe	96
PID 1236 wrote to memory of 3748	1236	36bcd0bf1863c84be2cdb2398d205887.exe	96
PID 1236 wrote to memory of 3748	1236	36bcd0bf1863c84be2cdb2398d205887.exe	96
PID 1236 wrote to memory of 3748	1236	36bcd0bf1863c84be2cdb2398d205887.exe	96
PID 1236 wrote to memory of 4908	1236	36bcd0bf1863c84be2cdb2398d205887.exe	95
PID 1236 wrote to memory of 4908	1236	36bcd0bf1863c84be2cdb2398d205887.exe	95
PID 1236 wrote to memory of 4908	1236	36bcd0bf1863c84be2cdb2398d205887.exe	95
PID 1236 wrote to memory of 4908	1236	36bcd0bf1863c84be2cdb2398d205887.exe	95

C:\Users\Admin\AppData\Local\Temp\36bcd0bf1863c84be2cdb2398d205887.exe
"C:\Users\Admin\AppData\Local\Temp\36bcd0bf1863c84be2cdb2398d205887.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1236
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  PID:4908
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"
  2⤵
  PID:3748
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"
  2⤵
  PID:2856

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1236-43-0x00000000005D0000-0x00000000006D0000-memory.dmp

Filesize
1024KB

Download
memory/1236-70-0x00000000022B0000-0x00000000022B9000-memory.dmp

Filesize
36KB

Download
memory/1236-9-0x00000000751A0000-0x00000000752FD000-memory.dmp

Filesize
1.4MB

Download
memory/1236-8-0x00000000005D0000-0x00000000006D0000-memory.dmp

Filesize
1024KB

Download
memory/1236-10-0x00000000005D0000-0x00000000006D0000-memory.dmp

Filesize
1024KB

Download
memory/1236-11-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/1236-12-0x00000000005D0000-0x00000000006D0000-memory.dmp

Filesize
1024KB

Download
memory/1236-13-0x00000000005D0000-0x00000000006D0000-memory.dmp

Filesize
1024KB

Download
memory/1236-20-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/1236-19-0x00000000005D0000-0x00000000006D0000-memory.dmp

Filesize
1024KB

Download
memory/1236-36-0x00000000005D0000-0x00000000006D0000-memory.dmp

Filesize
1024KB

Download
memory/1236-18-0x00000000005D0000-0x00000000006D0000-memory.dmp

Filesize
1024KB

Download
memory/1236-16-0x00000000005D0000-0x00000000006D0000-memory.dmp

Filesize
1024KB

Download
memory/1236-37-0x00000000005D0000-0x00000000006D0000-memory.dmp

Filesize
1024KB

Download
memory/1236-39-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/1236-41-0x00000000005D0000-0x00000000006D0000-memory.dmp

Filesize
1024KB

Download
memory/1236-44-0x00000000005D0000-0x00000000006D0000-memory.dmp

Filesize
1024KB

Download
memory/1236-47-0x00000000005D0000-0x00000000006D0000-memory.dmp

Filesize
1024KB

Download
memory/1236-51-0x00000000005D0000-0x00000000006D0000-memory.dmp

Filesize
1024KB

Download
memory/1236-50-0x00000000005D0000-0x00000000006D0000-memory.dmp

Filesize
1024KB

Download
memory/1236-49-0x00000000005D0000-0x00000000006D0000-memory.dmp

Filesize
1024KB

Download
memory/1236-48-0x00000000005D0000-0x00000000006D0000-memory.dmp

Filesize
1024KB

Download
memory/1236-46-0x00000000005D0000-0x00000000006D0000-memory.dmp

Filesize
1024KB

Download
memory/1236-45-0x00000000005D0000-0x00000000006D0000-memory.dmp

Filesize
1024KB

Download
memory/1236-6-0x0000000002240000-0x0000000002241000-memory.dmp

Filesize
4KB

Download
memory/1236-4-0x0000000077552000-0x0000000077553000-memory.dmp

Filesize
4KB

Download
memory/1236-40-0x00000000005D0000-0x00000000006D0000-memory.dmp

Filesize
1024KB

Download
memory/1236-38-0x00000000005D0000-0x00000000006D0000-memory.dmp

Filesize
1024KB

Download
memory/1236-54-0x00000000005D0000-0x00000000006D0000-memory.dmp

Filesize
1024KB

Download
memory/1236-58-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/1236-56-0x00000000005D0000-0x00000000006D0000-memory.dmp

Filesize
1024KB

Download
memory/1236-62-0x00000000005D0000-0x00000000006D0000-memory.dmp

Filesize
1024KB

Download
memory/1236-64-0x00000000751A0000-0x00000000752FD000-memory.dmp

Filesize
1.4MB

Download
memory/1236-67-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/1236-72-0x00000000751A0000-0x00000000752FD000-memory.dmp

Filesize
1.4MB

Download
memory/1236-60-0x00000000005D0000-0x00000000006D0000-memory.dmp

Filesize
1024KB

Download
memory/1236-63-0x00000000005D0000-0x00000000006D0000-memory.dmp

Filesize
1024KB

Download
memory/1236-73-0x00000000005D0000-0x00000000006D0000-memory.dmp

Filesize
1024KB

Download
memory/1236-66-0x00000000005D0000-0x00000000006D0000-memory.dmp

Filesize
1024KB

Download
memory/1236-42-0x00000000005D0000-0x00000000006D0000-memory.dmp

Filesize
1024KB

Download
memory/1236-71-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/1236-69-0x00000000005D0000-0x00000000006D0000-memory.dmp

Filesize
1024KB

Download
memory/4908-76-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/4908-77-0x0000000073E20000-0x00000000745D0000-memory.dmp

Filesize
7.7MB

Download
memory/4908-65-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/4908-74-0x0000000000FF0000-0x0000000000FF1000-memory.dmp

Filesize
4KB

Download
memory/4908-75-0x0000000077552000-0x0000000077553000-memory.dmp

Filesize
4KB

Download
memory/4908-78-0x0000000002F80000-0x0000000002F90000-memory.dmp

Filesize
64KB

Download
memory/4908-79-0x0000000073E20000-0x00000000745D0000-memory.dmp

Filesize
7.7MB

Download
memory/4908-80-0x0000000002F80000-0x0000000002F90000-memory.dmp

Filesize
64KB

Download