asyncrat | 920ee4d6e16da14af70de3df554004024590cd31ac4b57c5338761b7838b3291

Resubmissions

02/02/2024, 15:59

02/02/2024, 15:54

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
02/02/2024, 15:59

Target

SMS sender 2023/SMS sender 2023/Stub/Stub.exe
Size

165KB
MD5

42d8629b369faad755daeb690519f265
SHA1

6150c6865d440cd454d212312226e0eaeadc3d24
SHA256

014f68a3f73a8c94a12fa9842f12fc87ce2ad600dfe7fddea2ff7bc7ec79058f
SHA512

0b4139ad76944781fdece58f5318572b75bc3e367a7f01ce124495cc8c30daf8e512f0be77b7998aca21a0e03539f43f6e9fc7d4475b5573f54b19ad1e6d9a3d
SSDEEP

3072:Xj5R5s6Fmrw8bw4gSnaxkWdDzXqIPu/i9bOO2cq6+WpDheMGnWc:1mrw8E4gqanDbXPSi9bpMR

Score

10^/10

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
StormKitty
StormKitty is an open source info stealer written in C#.
stealer stormkitty

StormKitty payload 2 IoCs

resource	yara_rule
behavioral23/memory/1680-0-0x00000000002B0000-0x00000000002E0000-memory.dmp	family_stormkitty
behavioral23/memory/1680-2-0x0000000004360000-0x00000000043A0000-memory.dmp	family_stormkitty

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1848	1680	WerFault.exe	27

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1680	Stub.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1680 wrote to memory of 1848	1680	Stub.exe	28
PID 1680 wrote to memory of 1848	1680	Stub.exe	28
PID 1680 wrote to memory of 1848	1680	Stub.exe	28
PID 1680 wrote to memory of 1848	1680	Stub.exe	28

C:\Users\Admin\AppData\Local\Temp\SMS sender 2023\SMS sender 2023\Stub\Stub.exe
"C:\Users\Admin\AppData\Local\Temp\SMS sender 2023\SMS sender 2023\Stub\Stub.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1680
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1680 -s 612
  2⤵
  - Program crash
  PID:1848

memory/1680-1-0x00000000749F0000-0x00000000750DE000-memory.dmp

Filesize
6.9MB

Download
memory/1680-0-0x00000000002B0000-0x00000000002E0000-memory.dmp

Filesize
192KB

Download
memory/1680-2-0x0000000004360000-0x00000000043A0000-memory.dmp

Filesize
256KB

Download
memory/1680-3-0x00000000749F0000-0x00000000750DE000-memory.dmp

Filesize
6.9MB

Download
memory/1680-4-0x0000000004360000-0x00000000043A0000-memory.dmp

Filesize
256KB

Download