asyncrat | 76797fc75ae4d4b0e61f2dd3db1432dfc9c1c275c4db5a7e166b871faf235329

General

Target

76797fc75ae4d4b0e61f2dd3db1432dfc9c1c275c4db5a7e166b871faf235329.exe
Size

418KB
MD5

cb3370e70e913a4275bc4cbac4c342c5
SHA1

60127d49c6ef89f11ff7195b308fcb1f3f4bd0b5
SHA256

76797fc75ae4d4b0e61f2dd3db1432dfc9c1c275c4db5a7e166b871faf235329
SHA512

0b2ac797e293f87e9960a63666c27f08ed4c6c9c379480a5af55797e903aa9d5cc296902918a5632e06b8675648db60ebce129e03a98f8348a4dfc24d224a52b
SSDEEP

3072:xIwobs0rlyJ2bHVMLuPKA3NSPWy/smX070faZ5VBK3Rw4lE2y16zI6I/V4OPcbRI:xIwC

Score

10^/10

asyncrat default rat

Malware Config

Extracted

Family

asyncrat

Version

1.0.7

Botnet

Default

C2

127.0.0.1:8848

127.0.0.1:5858

Mutex

DcRatMutex_qwqdanchun

Attributes

delay
1
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Detects executables attemping to enumerate video devices using WMI 5 IoCs

resource	yara_rule
behavioral1/memory/2284-6-0x0000000000400000-0x0000000000416000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice
behavioral1/memory/2284-5-0x0000000000400000-0x0000000000416000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice
behavioral1/memory/2284-4-0x0000000000400000-0x0000000000416000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice
behavioral1/memory/2284-8-0x0000000000400000-0x0000000000416000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice
behavioral1/memory/2284-9-0x0000000000400000-0x0000000000416000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice

Detects executables containing the string DcRatBy 5 IoCs

resource	yara_rule
behavioral1/memory/2284-6-0x0000000000400000-0x0000000000416000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_DcRatBy
behavioral1/memory/2284-5-0x0000000000400000-0x0000000000416000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_DcRatBy
behavioral1/memory/2284-4-0x0000000000400000-0x0000000000416000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_DcRatBy
behavioral1/memory/2284-8-0x0000000000400000-0x0000000000416000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_DcRatBy
behavioral1/memory/2284-9-0x0000000000400000-0x0000000000416000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_DcRatBy

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1752 set thread context of 2284	1752	76797fc75ae4d4b0e61f2dd3db1432dfc9c1c275c4db5a7e166b871faf235329.exe	28

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2284	RegAsm.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1752 wrote to memory of 2284	1752	76797fc75ae4d4b0e61f2dd3db1432dfc9c1c275c4db5a7e166b871faf235329.exe	28
PID 1752 wrote to memory of 2284	1752	76797fc75ae4d4b0e61f2dd3db1432dfc9c1c275c4db5a7e166b871faf235329.exe	28
PID 1752 wrote to memory of 2284	1752	76797fc75ae4d4b0e61f2dd3db1432dfc9c1c275c4db5a7e166b871faf235329.exe	28
PID 1752 wrote to memory of 2284	1752	76797fc75ae4d4b0e61f2dd3db1432dfc9c1c275c4db5a7e166b871faf235329.exe	28
PID 1752 wrote to memory of 2284	1752	76797fc75ae4d4b0e61f2dd3db1432dfc9c1c275c4db5a7e166b871faf235329.exe	28
PID 1752 wrote to memory of 2284	1752	76797fc75ae4d4b0e61f2dd3db1432dfc9c1c275c4db5a7e166b871faf235329.exe	28
PID 1752 wrote to memory of 2284	1752	76797fc75ae4d4b0e61f2dd3db1432dfc9c1c275c4db5a7e166b871faf235329.exe	28
PID 1752 wrote to memory of 2284	1752	76797fc75ae4d4b0e61f2dd3db1432dfc9c1c275c4db5a7e166b871faf235329.exe	28
PID 1752 wrote to memory of 2284	1752	76797fc75ae4d4b0e61f2dd3db1432dfc9c1c275c4db5a7e166b871faf235329.exe	28
PID 1752 wrote to memory of 2284	1752	76797fc75ae4d4b0e61f2dd3db1432dfc9c1c275c4db5a7e166b871faf235329.exe	28
PID 1752 wrote to memory of 2284	1752	76797fc75ae4d4b0e61f2dd3db1432dfc9c1c275c4db5a7e166b871faf235329.exe	28
PID 1752 wrote to memory of 2284	1752	76797fc75ae4d4b0e61f2dd3db1432dfc9c1c275c4db5a7e166b871faf235329.exe	28

C:\Users\Admin\AppData\Local\Temp\76797fc75ae4d4b0e61f2dd3db1432dfc9c1c275c4db5a7e166b871faf235329.exe
"C:\Users\Admin\AppData\Local\Temp\76797fc75ae4d4b0e61f2dd3db1432dfc9c1c275c4db5a7e166b871faf235329.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1752
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2284

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1752-0-0x0000000001160000-0x00000000011CE000-memory.dmp

Filesize
440KB

Download
memory/1752-2-0x0000000073F60000-0x000000007464E000-memory.dmp

Filesize
6.9MB

Download
memory/1752-1-0x0000000000260000-0x0000000000268000-memory.dmp

Filesize
32KB

Download
memory/1752-10-0x0000000073F60000-0x000000007464E000-memory.dmp

Filesize
6.9MB

Download
memory/2284-6-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/2284-5-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/2284-4-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/2284-3-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/2284-8-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/2284-9-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download

Analysis

Sharing