asyncrat | 43dbc039265a6a588f857a1847c19e431d241a6aa3824fca12ac16ecefcd0bfd

General

Target

06d3542e576cada63ced6c15f1166a0d_JaffaCakes118.exe
Size

287KB
MD5

06d3542e576cada63ced6c15f1166a0d
SHA1

a1b1685144d458580c813ca134e5a1843ecf934f
SHA256

43dbc039265a6a588f857a1847c19e431d241a6aa3824fca12ac16ecefcd0bfd
SHA512

898133326ff46d04053b8e8499b97ae1b0d7301c0be5a6c3b8f3e24efbfb40d7339bfc7bb1a4bad18a54f73e088ab38a6b827fe31a933ee74def089d948e4e81
SSDEEP

6144:eDO9b3gGtcsm3K4msOho0oS+PKYTfpmdIGiJ3EpxqlYXMu5S0Ka:eDOxgGaXa4/O7oS+PKcW/qCX/Ka

Score

10^/10

asyncrat default rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

Default

C2

185.222.57.71:00783

Mutex

AsyncMutex_6SI8OkPnk

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2076 set thread context of 2644	2076	06d3542e576cada63ced6c15f1166a0d_JaffaCakes118.exe	29

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2076	06d3542e576cada63ced6c15f1166a0d_JaffaCakes118.exe
2076	06d3542e576cada63ced6c15f1166a0d_JaffaCakes118.exe
2076	06d3542e576cada63ced6c15f1166a0d_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2076	06d3542e576cada63ced6c15f1166a0d_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 2076 wrote to memory of 2616	2076	06d3542e576cada63ced6c15f1166a0d_JaffaCakes118.exe	28
PID 2076 wrote to memory of 2616	2076	06d3542e576cada63ced6c15f1166a0d_JaffaCakes118.exe	28
PID 2076 wrote to memory of 2616	2076	06d3542e576cada63ced6c15f1166a0d_JaffaCakes118.exe	28
PID 2076 wrote to memory of 2616	2076	06d3542e576cada63ced6c15f1166a0d_JaffaCakes118.exe	28
PID 2076 wrote to memory of 2616	2076	06d3542e576cada63ced6c15f1166a0d_JaffaCakes118.exe	28
PID 2076 wrote to memory of 2616	2076	06d3542e576cada63ced6c15f1166a0d_JaffaCakes118.exe	28
PID 2076 wrote to memory of 2616	2076	06d3542e576cada63ced6c15f1166a0d_JaffaCakes118.exe	28
PID 2076 wrote to memory of 2644	2076	06d3542e576cada63ced6c15f1166a0d_JaffaCakes118.exe	29
PID 2076 wrote to memory of 2644	2076	06d3542e576cada63ced6c15f1166a0d_JaffaCakes118.exe	29
PID 2076 wrote to memory of 2644	2076	06d3542e576cada63ced6c15f1166a0d_JaffaCakes118.exe	29
PID 2076 wrote to memory of 2644	2076	06d3542e576cada63ced6c15f1166a0d_JaffaCakes118.exe	29
PID 2076 wrote to memory of 2644	2076	06d3542e576cada63ced6c15f1166a0d_JaffaCakes118.exe	29
PID 2076 wrote to memory of 2644	2076	06d3542e576cada63ced6c15f1166a0d_JaffaCakes118.exe	29
PID 2076 wrote to memory of 2644	2076	06d3542e576cada63ced6c15f1166a0d_JaffaCakes118.exe	29
PID 2076 wrote to memory of 2644	2076	06d3542e576cada63ced6c15f1166a0d_JaffaCakes118.exe	29
PID 2076 wrote to memory of 2644	2076	06d3542e576cada63ced6c15f1166a0d_JaffaCakes118.exe	29
PID 2076 wrote to memory of 2644	2076	06d3542e576cada63ced6c15f1166a0d_JaffaCakes118.exe	29
PID 2076 wrote to memory of 2644	2076	06d3542e576cada63ced6c15f1166a0d_JaffaCakes118.exe	29
PID 2076 wrote to memory of 2644	2076	06d3542e576cada63ced6c15f1166a0d_JaffaCakes118.exe	29

C:\Users\Admin\AppData\Local\Temp\06d3542e576cada63ced6c15f1166a0d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\06d3542e576cada63ced6c15f1166a0d_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2076
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  PID:2616
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  PID:2644

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2076-21-0x0000000073F30000-0x000000007461E000-memory.dmp

Filesize
6.9MB

Download
memory/2076-1-0x0000000073F30000-0x000000007461E000-memory.dmp

Filesize
6.9MB

Download
memory/2076-2-0x0000000001220000-0x0000000001260000-memory.dmp

Filesize
256KB

Download
memory/2076-3-0x0000000000470000-0x000000000047E000-memory.dmp

Filesize
56KB

Download
memory/2076-4-0x0000000073F30000-0x000000007461E000-memory.dmp

Filesize
6.9MB

Download
memory/2076-5-0x0000000001220000-0x0000000001260000-memory.dmp

Filesize
256KB

Download
memory/2076-6-0x0000000004880000-0x00000000048B4000-memory.dmp

Filesize
208KB

Download
memory/2076-0-0x00000000012C0000-0x000000000130E000-memory.dmp

Filesize
312KB

Download
memory/2644-11-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2644-9-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2644-16-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2644-14-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2644-12-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2644-20-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2644-18-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2644-7-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2644-22-0x0000000073F30000-0x000000007461E000-memory.dmp

Filesize
6.9MB

Download
memory/2644-23-0x0000000004BD0000-0x0000000004C10000-memory.dmp

Filesize
256KB

Download
memory/2644-24-0x0000000073F30000-0x000000007461E000-memory.dmp

Filesize
6.9MB

Download
memory/2644-25-0x0000000004BD0000-0x0000000004C10000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing