asyncrat | f198e0cfa503100d64d15ed39b2516587582587f42afea74ace075b28f663fb4

Analysis

max time kernel
151s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10/05/2024, 06:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2dc4302c0d1cc5a95896b77ac1783437_JaffaCakes118.exe
Size 153KB
Sample240510-g4ev7aff2s
SHA256 f198e0cfa503100d64d15ed39b2516587582587f42afea74ace075b28f663fb4
MD5 2dc4302c0d1cc5a95896b77ac1783437
SHA1 d8a97cbbd90b204a57b450b0f5ed3c8cef468cae
SHA512 88fd3f0930c3c6e68e52c44af381a4a1f0406baeda7aa36e2f9e13b56860c7e32ef93466f7e82ba20caeccda939902609897e469ccc2a8ad5d9ea10dc56a6de9
SSDEEP 3072:nOMHBmrnRX2X8RGGqxWRXAHDQVisZ+KQs0NX2LFE:OcB8+rJD0lHQsEX25
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

asyncrat default rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.7A

Botnet

Default

127.0.0.1:6606
127.0.0.1:7707
127.0.0.1:8808
bogdanxx90900.servemp3.com:6606
bogdanxx90900.servemp3.com:7707
bogdanxx90900.servemp3.com:8808

Mutex

nhcttvqfjy

Attributes

delay
1
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2252 set thread context of 2184	2252	2dc4302c0d1cc5a95896b77ac1783437_JaffaCakes118.exe	101

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2252	2dc4302c0d1cc5a95896b77ac1783437_JaffaCakes118.exe
2252	2dc4302c0d1cc5a95896b77ac1783437_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2252	2dc4302c0d1cc5a95896b77ac1783437_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2252 wrote to memory of 3708	2252	2dc4302c0d1cc5a95896b77ac1783437_JaffaCakes118.exe	100
PID 2252 wrote to memory of 3708	2252	2dc4302c0d1cc5a95896b77ac1783437_JaffaCakes118.exe	100
PID 2252 wrote to memory of 3708	2252	2dc4302c0d1cc5a95896b77ac1783437_JaffaCakes118.exe	100
PID 2252 wrote to memory of 2184	2252	2dc4302c0d1cc5a95896b77ac1783437_JaffaCakes118.exe	101
PID 2252 wrote to memory of 2184	2252	2dc4302c0d1cc5a95896b77ac1783437_JaffaCakes118.exe	101
PID 2252 wrote to memory of 2184	2252	2dc4302c0d1cc5a95896b77ac1783437_JaffaCakes118.exe	101
PID 2252 wrote to memory of 2184	2252	2dc4302c0d1cc5a95896b77ac1783437_JaffaCakes118.exe	101
PID 2252 wrote to memory of 2184	2252	2dc4302c0d1cc5a95896b77ac1783437_JaffaCakes118.exe	101
PID 2252 wrote to memory of 2184	2252	2dc4302c0d1cc5a95896b77ac1783437_JaffaCakes118.exe	101
PID 2252 wrote to memory of 2184	2252	2dc4302c0d1cc5a95896b77ac1783437_JaffaCakes118.exe	101
PID 2252 wrote to memory of 2184	2252	2dc4302c0d1cc5a95896b77ac1783437_JaffaCakes118.exe	101

C:\Users\Admin\AppData\Local\Temp\2dc4302c0d1cc5a95896b77ac1783437_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2dc4302c0d1cc5a95896b77ac1783437_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2252
- C:\Users\Admin\AppData\Local\Temp\2dc4302c0d1cc5a95896b77ac1783437_JaffaCakes118.exe
  "{path}"
  2⤵
  PID:3708
- C:\Users\Admin\AppData\Local\Temp\2dc4302c0d1cc5a95896b77ac1783437_JaffaCakes118.exe
  "{path}"
  2⤵
  PID:2184

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3996 --field-trial-handle=3084,i,4016110471176367543,14287608422419064331,262144 --variations-seed-version /prefetch:8
1⤵
PID:4752

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2184-9-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/2184-15-0x0000000074CB0000-0x0000000075460000-memory.dmp

Download

memory/2184-14-0x0000000074CB0000-0x0000000075460000-memory.dmp

Download

memory/2184-13-0x0000000074CB0000-0x0000000075460000-memory.dmp

Download

memory/2184-11-0x0000000074CB0000-0x0000000075460000-memory.dmp

Download

memory/2252-3-0x0000000005530000-0x00000000055C2000-memory.dmp

Download

memory/2252-6-0x0000000074CB0000-0x0000000075460000-memory.dmp

Download

memory/2252-7-0x00000000061F0000-0x000000000628C000-memory.dmp

Download

memory/2252-8-0x0000000006150000-0x000000000616A000-memory.dmp

Download

memory/2252-5-0x0000000074CBE000-0x0000000074CBF000-memory.dmp

Download

memory/2252-4-0x00000000055D0000-0x00000000055D8000-memory.dmp

Download

memory/2252-12-0x0000000074CB0000-0x0000000075460000-memory.dmp

Download

memory/2252-0-0x0000000074CBE000-0x0000000074CBF000-memory.dmp

Download

memory/2252-2-0x0000000005A40000-0x0000000005FE4000-memory.dmp

Download

memory/2252-1-0x0000000000B60000-0x0000000000B8C000-memory.dmp

Download