asyncrat | f7b398d27c0e269bf09dfefa9ee52559e953b1030ed432361c4e7d0a167b4438

Analysis

max time kernel
135s
max time network
148s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
22/04/2024, 01:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
001-NOTIFICACION JUDICIAL AUTO DE IMPUTACION POR INCUMPLIMIENTO FISCAL/001-NOTIFICACION JUDICIAL.exe
Size 63KB
Sample240422-b5j9eaeb3v
SHA256 bf933ccf86c55fc328e343b55dbf2e8ebd528e8a0a54f8f659cd0d4b4f261f26
MD5 ae224c5e196ff381836c9e95deebb7d5
SHA1 910446a2a0f4e53307b6fdeb1a3e236c929e2ef4
SHA512 f845dbb13b04f76b6823bec48e1c47f96bcbd6d02a834c8b128ac750fe338b53f775ee2a8784e8c443d49dfcb918c5b9d59b5492a1fe18743b8ba65b7d12514c
SSDEEP 1536:Wio8DVyYs7JZT0uPXn8OS6sIe3ekT5Z240jSZk:WkhyYIJZT0uPXn8OdsIe3c4Ql
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

asyncrat default rat

Malware Config

Extracted

Family

asyncrat

Version

| CRACKED BY https://t.me/xworm_v2

Botnet

Default

enviofinal.kozow.com:5051

Mutex

AsyncMutex_6SI8OkPnk

Attributes

delay
3
install
false
install_file
AnsyFelix
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2232 set thread context of 2372	2232	001-NOTIFICACION JUDICIAL.exe	28
PID 2372 set thread context of 2088	2372	cmd.exe	30

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\Quicktool.job	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2232	001-NOTIFICACION JUDICIAL.exe
2372	cmd.exe
2372	cmd.exe
2088	MSBuild.exe

Suspicious behavior: MapViewOfSection 3 IoCs

pid	Process
2232	001-NOTIFICACION JUDICIAL.exe
2372	cmd.exe
2372	cmd.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2088	MSBuild.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2088	MSBuild.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2232 wrote to memory of 2372	2232	001-NOTIFICACION JUDICIAL.exe	28
PID 2232 wrote to memory of 2372	2232	001-NOTIFICACION JUDICIAL.exe	28
PID 2232 wrote to memory of 2372	2232	001-NOTIFICACION JUDICIAL.exe	28
PID 2232 wrote to memory of 2372	2232	001-NOTIFICACION JUDICIAL.exe	28
PID 2232 wrote to memory of 2372	2232	001-NOTIFICACION JUDICIAL.exe	28
PID 2372 wrote to memory of 2088	2372	cmd.exe	30
PID 2372 wrote to memory of 2088	2372	cmd.exe	30
PID 2372 wrote to memory of 2088	2372	cmd.exe	30
PID 2372 wrote to memory of 2088	2372	cmd.exe	30
PID 2372 wrote to memory of 2088	2372	cmd.exe	30
PID 2372 wrote to memory of 2088	2372	cmd.exe	30

C:\Users\Admin\AppData\Local\Temp\001-NOTIFICACION JUDICIAL AUTO DE IMPUTACION POR INCUMPLIMIENTO FISCAL\001-NOTIFICACION JUDICIAL.exe
"C:\Users\Admin\AppData\Local\Temp\001-NOTIFICACION JUDICIAL AUTO DE IMPUTACION POR INCUMPLIMIENTO FISCAL\001-NOTIFICACION JUDICIAL.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2232
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\SysWOW64\cmd.exe
  2⤵
  - Suspicious use of SetThreadContext
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:2372
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:2088

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

8dfb2e8e

Path C:\Users\Admin\AppData\Local\Temp\8dfb2e8e
Size 776KB
SHA256 81f98ab5566768626ebb9113aae96c0f518c64f631b76ca4119a4241114d243b
MD5 6a8c29bef91d787641b1d17d18bd9eca
SHA1 15bdc8ced435fee1fd7f30eccaec5eb43098381a
SHA512 7017733dae3c3e3dd00564157a2d4ff6228834e1b8e3d4c7c7918d565b9ae0bb8acc981b58ed9a3be8a11ba37af7bdedc45bebd066ae7f2828b0d31b64d84d76
SSDEEP 24576:BkLcA2fz2OXRJsJGbSLCepm8wn/0RoKXRxy:B9B61wnMRoKvy
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2088-77-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Download

memory/2088-83-0x0000000000430000-0x0000000000470000-memory.dmp

Download

memory/2088-82-0x0000000073A80000-0x000000007416E000-memory.dmp

Download

memory/2088-81-0x0000000000430000-0x0000000000470000-memory.dmp

Download

memory/2088-80-0x0000000073A80000-0x000000007416E000-memory.dmp

Download

memory/2088-79-0x0000000000400000-0x0000000000416000-memory.dmp

Download

memory/2088-78-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Download

memory/2088-75-0x0000000072410000-0x0000000073472000-memory.dmp

Download

memory/2232-14-0x0000000074500000-0x0000000074674000-memory.dmp

Download

memory/2232-0-0x0000000000290000-0x0000000000398000-memory.dmp

Download

memory/2232-13-0x0000000074500000-0x0000000074674000-memory.dmp

Download

memory/2232-4-0x0000000076E90000-0x0000000077039000-memory.dmp

Download

memory/2232-3-0x0000000074500000-0x0000000074674000-memory.dmp

Download

memory/2232-2-0x0000000000E70000-0x0000000000E81000-memory.dmp

Download

memory/2372-65-0x0000000074500000-0x0000000074674000-memory.dmp

Download

memory/2372-72-0x0000000074500000-0x0000000074674000-memory.dmp

Download

memory/2372-73-0x0000000074500000-0x0000000074674000-memory.dmp

Download

memory/2372-76-0x0000000074500000-0x0000000074674000-memory.dmp

Download

memory/2372-63-0x0000000074500000-0x0000000074674000-memory.dmp

Download

memory/2372-18-0x0000000076E90000-0x0000000077039000-memory.dmp

Download

memory/2372-16-0x0000000074500000-0x0000000074674000-memory.dmp

Download