asyncrat | 43dbc039265a6a588f857a1847c19e431d241a6aa3824fca12ac16ecefcd0bfd

General

Target

06d3542e576cada63ced6c15f1166a0d_JaffaCakes118.exe
Size

287KB
MD5

06d3542e576cada63ced6c15f1166a0d
SHA1

a1b1685144d458580c813ca134e5a1843ecf934f
SHA256

43dbc039265a6a588f857a1847c19e431d241a6aa3824fca12ac16ecefcd0bfd
SHA512

898133326ff46d04053b8e8499b97ae1b0d7301c0be5a6c3b8f3e24efbfb40d7339bfc7bb1a4bad18a54f73e088ab38a6b827fe31a933ee74def089d948e4e81
SSDEEP

6144:eDO9b3gGtcsm3K4msOho0oS+PKYTfpmdIGiJ3EpxqlYXMu5S0Ka:eDOxgGaXa4/O7oS+PKcW/qCX/Ka

Score

10^/10

asyncrat default rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

Default

C2

185.222.57.71:00783

Mutex

AsyncMutex_6SI8OkPnk

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2604 set thread context of 808	2604	06d3542e576cada63ced6c15f1166a0d_JaffaCakes118.exe	105

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2604	06d3542e576cada63ced6c15f1166a0d_JaffaCakes118.exe
2604	06d3542e576cada63ced6c15f1166a0d_JaffaCakes118.exe
2604	06d3542e576cada63ced6c15f1166a0d_JaffaCakes118.exe
2604	06d3542e576cada63ced6c15f1166a0d_JaffaCakes118.exe
2604	06d3542e576cada63ced6c15f1166a0d_JaffaCakes118.exe
2604	06d3542e576cada63ced6c15f1166a0d_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2604	06d3542e576cada63ced6c15f1166a0d_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2604 wrote to memory of 3260	2604	06d3542e576cada63ced6c15f1166a0d_JaffaCakes118.exe	103
PID 2604 wrote to memory of 3260	2604	06d3542e576cada63ced6c15f1166a0d_JaffaCakes118.exe	103
PID 2604 wrote to memory of 3260	2604	06d3542e576cada63ced6c15f1166a0d_JaffaCakes118.exe	103
PID 2604 wrote to memory of 416	2604	06d3542e576cada63ced6c15f1166a0d_JaffaCakes118.exe	104
PID 2604 wrote to memory of 416	2604	06d3542e576cada63ced6c15f1166a0d_JaffaCakes118.exe	104
PID 2604 wrote to memory of 416	2604	06d3542e576cada63ced6c15f1166a0d_JaffaCakes118.exe	104
PID 2604 wrote to memory of 808	2604	06d3542e576cada63ced6c15f1166a0d_JaffaCakes118.exe	105
PID 2604 wrote to memory of 808	2604	06d3542e576cada63ced6c15f1166a0d_JaffaCakes118.exe	105
PID 2604 wrote to memory of 808	2604	06d3542e576cada63ced6c15f1166a0d_JaffaCakes118.exe	105
PID 2604 wrote to memory of 808	2604	06d3542e576cada63ced6c15f1166a0d_JaffaCakes118.exe	105
PID 2604 wrote to memory of 808	2604	06d3542e576cada63ced6c15f1166a0d_JaffaCakes118.exe	105
PID 2604 wrote to memory of 808	2604	06d3542e576cada63ced6c15f1166a0d_JaffaCakes118.exe	105
PID 2604 wrote to memory of 808	2604	06d3542e576cada63ced6c15f1166a0d_JaffaCakes118.exe	105
PID 2604 wrote to memory of 808	2604	06d3542e576cada63ced6c15f1166a0d_JaffaCakes118.exe	105

C:\Users\Admin\AppData\Local\Temp\06d3542e576cada63ced6c15f1166a0d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\06d3542e576cada63ced6c15f1166a0d_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2604
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  PID:3260
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  PID:416
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  PID:808

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4100 --field-trial-handle=3084,i,11997299123381683778,5904351605020331957,262144 --variations-seed-version /prefetch:8
1⤵
PID:4060

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/808-11-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/808-17-0x0000000005530000-0x0000000005540000-memory.dmp

Filesize
64KB

Download
memory/808-16-0x0000000074580000-0x0000000074D30000-memory.dmp

Filesize
7.7MB

Download
memory/808-15-0x0000000005530000-0x0000000005540000-memory.dmp

Filesize
64KB

Download
memory/808-13-0x0000000074580000-0x0000000074D30000-memory.dmp

Filesize
7.7MB

Download
memory/2604-4-0x0000000005A30000-0x0000000005A40000-memory.dmp

Filesize
64KB

Download
memory/2604-6-0x0000000005CB0000-0x0000000005CBE000-memory.dmp

Filesize
56KB

Download
memory/2604-7-0x0000000074580000-0x0000000074D30000-memory.dmp

Filesize
7.7MB

Download
memory/2604-8-0x0000000005A30000-0x0000000005A40000-memory.dmp

Filesize
64KB

Download
memory/2604-9-0x000000000A8F0000-0x000000000A98C000-memory.dmp

Filesize
624KB

Download
memory/2604-10-0x000000000A850000-0x000000000A884000-memory.dmp

Filesize
208KB

Download
memory/2604-5-0x0000000005910000-0x000000000591A000-memory.dmp

Filesize
40KB

Download
memory/2604-0-0x0000000074580000-0x0000000074D30000-memory.dmp

Filesize
7.7MB

Download
memory/2604-14-0x0000000074580000-0x0000000074D30000-memory.dmp

Filesize
7.7MB

Download
memory/2604-3-0x0000000005830000-0x00000000058C2000-memory.dmp

Filesize
584KB

Download
memory/2604-2-0x0000000005CF0000-0x0000000006294000-memory.dmp

Filesize
5.6MB

Download
memory/2604-1-0x0000000000E40000-0x0000000000E8E000-memory.dmp

Filesize
312KB

Download

Analysis

Sharing