asyncrat | bab5cb442f212e03bc6d19c77077ac79f7cf27d1f28f5857702e390a9ba70f77

Analysis

max time kernel
143s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
18-05-2024 23:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bab5cb442f212e03bc6d19c77077ac79f7cf27d1f28f5857702e390a9ba70f77.exe
Size

230KB
MD5

38531b2b0413ec8925c2ab8d9755d24b
SHA1

fd6e9de1c60a58d9983e4bbdd04c9ab332d79bd4
SHA256

bab5cb442f212e03bc6d19c77077ac79f7cf27d1f28f5857702e390a9ba70f77
SHA512

f5395e839f1ee8e4214be12184fc75dc8765600b7a0f925592d301f3089395de56c1df507099bf2c1137173140c752c8cd63ee30639b584f6b1184f8d3d94ec1
SSDEEP

3072:YDKW1LgppLRHMY0TBfJvjcTp5XvXgOmEaRSzv24OhHNB6qfXV0mkbRYV:YDKW1Lgbdl0TBBvjc/ME6LLzgq94o

Score

10^/10

asyncrat rat

Malware Config

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 34 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1600-6-0x00000000050C0000-0x00000000050F0000-memory.dmp	family_asyncrat
behavioral1/memory/1600-48-0x00000000050C0000-0x00000000050EA000-memory.dmp	family_asyncrat
behavioral1/memory/1600-70-0x00000000050C0000-0x00000000050EA000-memory.dmp	family_asyncrat
behavioral1/memory/1600-69-0x00000000050C0000-0x00000000050EA000-memory.dmp	family_asyncrat
behavioral1/memory/1600-66-0x00000000050C0000-0x00000000050EA000-memory.dmp	family_asyncrat
behavioral1/memory/1600-64-0x00000000050C0000-0x00000000050EA000-memory.dmp	family_asyncrat
behavioral1/memory/1600-62-0x00000000050C0000-0x00000000050EA000-memory.dmp	family_asyncrat
behavioral1/memory/1600-60-0x00000000050C0000-0x00000000050EA000-memory.dmp	family_asyncrat
behavioral1/memory/1600-58-0x00000000050C0000-0x00000000050EA000-memory.dmp	family_asyncrat
behavioral1/memory/1600-56-0x00000000050C0000-0x00000000050EA000-memory.dmp	family_asyncrat
behavioral1/memory/1600-54-0x00000000050C0000-0x00000000050EA000-memory.dmp	family_asyncrat
behavioral1/memory/1600-52-0x00000000050C0000-0x00000000050EA000-memory.dmp	family_asyncrat
behavioral1/memory/1600-50-0x00000000050C0000-0x00000000050EA000-memory.dmp	family_asyncrat
behavioral1/memory/1600-46-0x00000000050C0000-0x00000000050EA000-memory.dmp	family_asyncrat
behavioral1/memory/1600-45-0x00000000050C0000-0x00000000050EA000-memory.dmp	family_asyncrat
behavioral1/memory/1600-43-0x00000000050C0000-0x00000000050EA000-memory.dmp	family_asyncrat
behavioral1/memory/1600-40-0x00000000050C0000-0x00000000050EA000-memory.dmp	family_asyncrat
behavioral1/memory/1600-38-0x00000000050C0000-0x00000000050EA000-memory.dmp	family_asyncrat
behavioral1/memory/1600-36-0x00000000050C0000-0x00000000050EA000-memory.dmp	family_asyncrat
behavioral1/memory/1600-34-0x00000000050C0000-0x00000000050EA000-memory.dmp	family_asyncrat
behavioral1/memory/1600-32-0x00000000050C0000-0x00000000050EA000-memory.dmp	family_asyncrat
behavioral1/memory/1600-31-0x00000000050C0000-0x00000000050EA000-memory.dmp	family_asyncrat
behavioral1/memory/1600-28-0x00000000050C0000-0x00000000050EA000-memory.dmp	family_asyncrat
behavioral1/memory/1600-26-0x00000000050C0000-0x00000000050EA000-memory.dmp	family_asyncrat
behavioral1/memory/1600-24-0x00000000050C0000-0x00000000050EA000-memory.dmp	family_asyncrat
behavioral1/memory/1600-22-0x00000000050C0000-0x00000000050EA000-memory.dmp	family_asyncrat
behavioral1/memory/1600-20-0x00000000050C0000-0x00000000050EA000-memory.dmp	family_asyncrat
behavioral1/memory/1600-18-0x00000000050C0000-0x00000000050EA000-memory.dmp	family_asyncrat
behavioral1/memory/1600-16-0x00000000050C0000-0x00000000050EA000-memory.dmp	family_asyncrat
behavioral1/memory/1600-14-0x00000000050C0000-0x00000000050EA000-memory.dmp	family_asyncrat
behavioral1/memory/1600-12-0x00000000050C0000-0x00000000050EA000-memory.dmp	family_asyncrat
behavioral1/memory/1600-10-0x00000000050C0000-0x00000000050EA000-memory.dmp	family_asyncrat
behavioral1/memory/1600-8-0x00000000050C0000-0x00000000050EA000-memory.dmp	family_asyncrat
behavioral1/memory/1600-7-0x00000000050C0000-0x00000000050EA000-memory.dmp	family_asyncrat

.NET Reactor proctector 35 IoCs

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

Processes:

resource	yara_rule
behavioral1/memory/1600-2-0x00000000024B0000-0x00000000024E2000-memory.dmp	net_reactor
behavioral1/memory/1600-6-0x00000000050C0000-0x00000000050F0000-memory.dmp	net_reactor
behavioral1/memory/1600-48-0x00000000050C0000-0x00000000050EA000-memory.dmp	net_reactor
behavioral1/memory/1600-70-0x00000000050C0000-0x00000000050EA000-memory.dmp	net_reactor
behavioral1/memory/1600-69-0x00000000050C0000-0x00000000050EA000-memory.dmp	net_reactor
behavioral1/memory/1600-66-0x00000000050C0000-0x00000000050EA000-memory.dmp	net_reactor
behavioral1/memory/1600-64-0x00000000050C0000-0x00000000050EA000-memory.dmp	net_reactor
behavioral1/memory/1600-62-0x00000000050C0000-0x00000000050EA000-memory.dmp	net_reactor
behavioral1/memory/1600-60-0x00000000050C0000-0x00000000050EA000-memory.dmp	net_reactor
behavioral1/memory/1600-58-0x00000000050C0000-0x00000000050EA000-memory.dmp	net_reactor
behavioral1/memory/1600-56-0x00000000050C0000-0x00000000050EA000-memory.dmp	net_reactor
behavioral1/memory/1600-54-0x00000000050C0000-0x00000000050EA000-memory.dmp	net_reactor
behavioral1/memory/1600-52-0x00000000050C0000-0x00000000050EA000-memory.dmp	net_reactor
behavioral1/memory/1600-50-0x00000000050C0000-0x00000000050EA000-memory.dmp	net_reactor
behavioral1/memory/1600-46-0x00000000050C0000-0x00000000050EA000-memory.dmp	net_reactor
behavioral1/memory/1600-45-0x00000000050C0000-0x00000000050EA000-memory.dmp	net_reactor
behavioral1/memory/1600-43-0x00000000050C0000-0x00000000050EA000-memory.dmp	net_reactor
behavioral1/memory/1600-40-0x00000000050C0000-0x00000000050EA000-memory.dmp	net_reactor
behavioral1/memory/1600-38-0x00000000050C0000-0x00000000050EA000-memory.dmp	net_reactor
behavioral1/memory/1600-36-0x00000000050C0000-0x00000000050EA000-memory.dmp	net_reactor
behavioral1/memory/1600-34-0x00000000050C0000-0x00000000050EA000-memory.dmp	net_reactor
behavioral1/memory/1600-32-0x00000000050C0000-0x00000000050EA000-memory.dmp	net_reactor
behavioral1/memory/1600-31-0x00000000050C0000-0x00000000050EA000-memory.dmp	net_reactor
behavioral1/memory/1600-28-0x00000000050C0000-0x00000000050EA000-memory.dmp	net_reactor
behavioral1/memory/1600-26-0x00000000050C0000-0x00000000050EA000-memory.dmp	net_reactor
behavioral1/memory/1600-24-0x00000000050C0000-0x00000000050EA000-memory.dmp	net_reactor
behavioral1/memory/1600-22-0x00000000050C0000-0x00000000050EA000-memory.dmp	net_reactor
behavioral1/memory/1600-20-0x00000000050C0000-0x00000000050EA000-memory.dmp	net_reactor
behavioral1/memory/1600-18-0x00000000050C0000-0x00000000050EA000-memory.dmp	net_reactor
behavioral1/memory/1600-16-0x00000000050C0000-0x00000000050EA000-memory.dmp	net_reactor
behavioral1/memory/1600-14-0x00000000050C0000-0x00000000050EA000-memory.dmp	net_reactor
behavioral1/memory/1600-12-0x00000000050C0000-0x00000000050EA000-memory.dmp	net_reactor
behavioral1/memory/1600-10-0x00000000050C0000-0x00000000050EA000-memory.dmp	net_reactor
behavioral1/memory/1600-8-0x00000000050C0000-0x00000000050EA000-memory.dmp	net_reactor
behavioral1/memory/1600-7-0x00000000050C0000-0x00000000050EA000-memory.dmp	net_reactor

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

5328 1600 WerFault.exe bab5cb442f212e03bc6d19c77077ac79f7cf27d1f28f5857702e390a9ba70f77.exe

pid	pid_target	process	target process
5328	1600	WerFault.exe	bab5cb442f212e03bc6d19c77077ac79f7cf27d1f28f5857702e390a9ba70f77.exe

Suspicious use of AdjustPrivilegeToken 43 IoCs

Processes:

bab5cb442f212e03bc6d19c77077ac79f7cf27d1f28f5857702e390a9ba70f77.exe

description	pid	process
Token: SeDebugPrivilege	1600	bab5cb442f212e03bc6d19c77077ac79f7cf27d1f28f5857702e390a9ba70f77.exe
Token: SeIncreaseQuotaPrivilege	1600	bab5cb442f212e03bc6d19c77077ac79f7cf27d1f28f5857702e390a9ba70f77.exe
Token: SeSecurityPrivilege	1600	bab5cb442f212e03bc6d19c77077ac79f7cf27d1f28f5857702e390a9ba70f77.exe
Token: SeTakeOwnershipPrivilege	1600	bab5cb442f212e03bc6d19c77077ac79f7cf27d1f28f5857702e390a9ba70f77.exe
Token: SeLoadDriverPrivilege	1600	bab5cb442f212e03bc6d19c77077ac79f7cf27d1f28f5857702e390a9ba70f77.exe
Token: SeSystemProfilePrivilege	1600	bab5cb442f212e03bc6d19c77077ac79f7cf27d1f28f5857702e390a9ba70f77.exe
Token: SeSystemtimePrivilege	1600	bab5cb442f212e03bc6d19c77077ac79f7cf27d1f28f5857702e390a9ba70f77.exe
Token: SeProfSingleProcessPrivilege	1600	bab5cb442f212e03bc6d19c77077ac79f7cf27d1f28f5857702e390a9ba70f77.exe
Token: SeIncBasePriorityPrivilege	1600	bab5cb442f212e03bc6d19c77077ac79f7cf27d1f28f5857702e390a9ba70f77.exe
Token: SeCreatePagefilePrivilege	1600	bab5cb442f212e03bc6d19c77077ac79f7cf27d1f28f5857702e390a9ba70f77.exe
Token: SeBackupPrivilege	1600	bab5cb442f212e03bc6d19c77077ac79f7cf27d1f28f5857702e390a9ba70f77.exe
Token: SeRestorePrivilege	1600	bab5cb442f212e03bc6d19c77077ac79f7cf27d1f28f5857702e390a9ba70f77.exe
Token: SeShutdownPrivilege	1600	bab5cb442f212e03bc6d19c77077ac79f7cf27d1f28f5857702e390a9ba70f77.exe
Token: SeDebugPrivilege	1600	bab5cb442f212e03bc6d19c77077ac79f7cf27d1f28f5857702e390a9ba70f77.exe
Token: SeSystemEnvironmentPrivilege	1600	bab5cb442f212e03bc6d19c77077ac79f7cf27d1f28f5857702e390a9ba70f77.exe
Token: SeRemoteShutdownPrivilege	1600	bab5cb442f212e03bc6d19c77077ac79f7cf27d1f28f5857702e390a9ba70f77.exe
Token: SeUndockPrivilege	1600	bab5cb442f212e03bc6d19c77077ac79f7cf27d1f28f5857702e390a9ba70f77.exe
Token: SeManageVolumePrivilege	1600	bab5cb442f212e03bc6d19c77077ac79f7cf27d1f28f5857702e390a9ba70f77.exe
Token: 33	1600	bab5cb442f212e03bc6d19c77077ac79f7cf27d1f28f5857702e390a9ba70f77.exe
Token: 34	1600	bab5cb442f212e03bc6d19c77077ac79f7cf27d1f28f5857702e390a9ba70f77.exe
Token: 35	1600	bab5cb442f212e03bc6d19c77077ac79f7cf27d1f28f5857702e390a9ba70f77.exe
Token: 36	1600	bab5cb442f212e03bc6d19c77077ac79f7cf27d1f28f5857702e390a9ba70f77.exe
Token: SeIncreaseQuotaPrivilege	1600	bab5cb442f212e03bc6d19c77077ac79f7cf27d1f28f5857702e390a9ba70f77.exe
Token: SeSecurityPrivilege	1600	bab5cb442f212e03bc6d19c77077ac79f7cf27d1f28f5857702e390a9ba70f77.exe
Token: SeTakeOwnershipPrivilege	1600	bab5cb442f212e03bc6d19c77077ac79f7cf27d1f28f5857702e390a9ba70f77.exe
Token: SeLoadDriverPrivilege	1600	bab5cb442f212e03bc6d19c77077ac79f7cf27d1f28f5857702e390a9ba70f77.exe
Token: SeSystemProfilePrivilege	1600	bab5cb442f212e03bc6d19c77077ac79f7cf27d1f28f5857702e390a9ba70f77.exe
Token: SeSystemtimePrivilege	1600	bab5cb442f212e03bc6d19c77077ac79f7cf27d1f28f5857702e390a9ba70f77.exe
Token: SeProfSingleProcessPrivilege	1600	bab5cb442f212e03bc6d19c77077ac79f7cf27d1f28f5857702e390a9ba70f77.exe
Token: SeIncBasePriorityPrivilege	1600	bab5cb442f212e03bc6d19c77077ac79f7cf27d1f28f5857702e390a9ba70f77.exe
Token: SeCreatePagefilePrivilege	1600	bab5cb442f212e03bc6d19c77077ac79f7cf27d1f28f5857702e390a9ba70f77.exe
Token: SeBackupPrivilege	1600	bab5cb442f212e03bc6d19c77077ac79f7cf27d1f28f5857702e390a9ba70f77.exe
Token: SeRestorePrivilege	1600	bab5cb442f212e03bc6d19c77077ac79f7cf27d1f28f5857702e390a9ba70f77.exe
Token: SeShutdownPrivilege	1600	bab5cb442f212e03bc6d19c77077ac79f7cf27d1f28f5857702e390a9ba70f77.exe
Token: SeDebugPrivilege	1600	bab5cb442f212e03bc6d19c77077ac79f7cf27d1f28f5857702e390a9ba70f77.exe
Token: SeSystemEnvironmentPrivilege	1600	bab5cb442f212e03bc6d19c77077ac79f7cf27d1f28f5857702e390a9ba70f77.exe
Token: SeRemoteShutdownPrivilege	1600	bab5cb442f212e03bc6d19c77077ac79f7cf27d1f28f5857702e390a9ba70f77.exe
Token: SeUndockPrivilege	1600	bab5cb442f212e03bc6d19c77077ac79f7cf27d1f28f5857702e390a9ba70f77.exe
Token: SeManageVolumePrivilege	1600	bab5cb442f212e03bc6d19c77077ac79f7cf27d1f28f5857702e390a9ba70f77.exe
Token: 33	1600	bab5cb442f212e03bc6d19c77077ac79f7cf27d1f28f5857702e390a9ba70f77.exe
Token: 34	1600	bab5cb442f212e03bc6d19c77077ac79f7cf27d1f28f5857702e390a9ba70f77.exe
Token: 35	1600	bab5cb442f212e03bc6d19c77077ac79f7cf27d1f28f5857702e390a9ba70f77.exe
Token: 36	1600	bab5cb442f212e03bc6d19c77077ac79f7cf27d1f28f5857702e390a9ba70f77.exe

C:\Users\Admin\AppData\Local\Temp\bab5cb442f212e03bc6d19c77077ac79f7cf27d1f28f5857702e390a9ba70f77.exe
"C:\Users\Admin\AppData\Local\Temp\bab5cb442f212e03bc6d19c77077ac79f7cf27d1f28f5857702e390a9ba70f77.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1600
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1600 -s 1412
  2⤵
  - Program crash
  PID:5328

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1416 --field-trial-handle=3240,i,13319578961094268484,16557498665191861597,262144 --variations-seed-version /prefetch:8
1⤵
PID:5012

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 1600 -ip 1600
1⤵
PID:5204

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1600-0-0x0000000074E7E000-0x0000000074E7F000-memory.dmp

Filesize
4KB

Download
memory/1600-1-0x0000000074E70000-0x0000000075620000-memory.dmp

Filesize
7.7MB

Download
memory/1600-2-0x00000000024B0000-0x00000000024E2000-memory.dmp

Filesize
200KB

Download
memory/1600-3-0x0000000074E70000-0x0000000075620000-memory.dmp

Filesize
7.7MB

Download
memory/1600-4-0x0000000074E70000-0x0000000075620000-memory.dmp

Filesize
7.7MB

Download
memory/1600-5-0x0000000004B10000-0x00000000050B4000-memory.dmp

Filesize
5.6MB

Download
memory/1600-6-0x00000000050C0000-0x00000000050F0000-memory.dmp

Filesize
192KB

Download
memory/1600-48-0x00000000050C0000-0x00000000050EA000-memory.dmp

Filesize
168KB

Download
memory/1600-70-0x00000000050C0000-0x00000000050EA000-memory.dmp

Filesize
168KB

Download
memory/1600-69-0x00000000050C0000-0x00000000050EA000-memory.dmp

Filesize
168KB

Download
memory/1600-66-0x00000000050C0000-0x00000000050EA000-memory.dmp

Filesize
168KB

Download
memory/1600-64-0x00000000050C0000-0x00000000050EA000-memory.dmp

Filesize
168KB

Download
memory/1600-62-0x00000000050C0000-0x00000000050EA000-memory.dmp

Filesize
168KB

Download
memory/1600-60-0x00000000050C0000-0x00000000050EA000-memory.dmp

Filesize
168KB

Download
memory/1600-58-0x00000000050C0000-0x00000000050EA000-memory.dmp

Filesize
168KB

Download
memory/1600-56-0x00000000050C0000-0x00000000050EA000-memory.dmp

Filesize
168KB

Download
memory/1600-54-0x00000000050C0000-0x00000000050EA000-memory.dmp

Filesize
168KB

Download
memory/1600-52-0x00000000050C0000-0x00000000050EA000-memory.dmp

Filesize
168KB

Download
memory/1600-50-0x00000000050C0000-0x00000000050EA000-memory.dmp

Filesize
168KB

Download
memory/1600-46-0x00000000050C0000-0x00000000050EA000-memory.dmp

Filesize
168KB

Download
memory/1600-45-0x00000000050C0000-0x00000000050EA000-memory.dmp

Filesize
168KB

Download
memory/1600-43-0x00000000050C0000-0x00000000050EA000-memory.dmp

Filesize
168KB

Download
memory/1600-40-0x00000000050C0000-0x00000000050EA000-memory.dmp

Filesize
168KB

Download
memory/1600-38-0x00000000050C0000-0x00000000050EA000-memory.dmp

Filesize
168KB

Download
memory/1600-36-0x00000000050C0000-0x00000000050EA000-memory.dmp

Filesize
168KB

Download
memory/1600-34-0x00000000050C0000-0x00000000050EA000-memory.dmp

Filesize
168KB

Download
memory/1600-32-0x00000000050C0000-0x00000000050EA000-memory.dmp

Filesize
168KB

Download
memory/1600-31-0x00000000050C0000-0x00000000050EA000-memory.dmp

Filesize
168KB

Download
memory/1600-28-0x00000000050C0000-0x00000000050EA000-memory.dmp

Filesize
168KB

Download
memory/1600-26-0x00000000050C0000-0x00000000050EA000-memory.dmp

Filesize
168KB

Download
memory/1600-24-0x00000000050C0000-0x00000000050EA000-memory.dmp

Filesize
168KB

Download
memory/1600-22-0x00000000050C0000-0x00000000050EA000-memory.dmp

Filesize
168KB

Download
memory/1600-20-0x00000000050C0000-0x00000000050EA000-memory.dmp

Filesize
168KB

Download
memory/1600-18-0x00000000050C0000-0x00000000050EA000-memory.dmp

Filesize
168KB

Download
memory/1600-16-0x00000000050C0000-0x00000000050EA000-memory.dmp

Filesize
168KB

Download
memory/1600-14-0x00000000050C0000-0x00000000050EA000-memory.dmp

Filesize
168KB

Download
memory/1600-12-0x00000000050C0000-0x00000000050EA000-memory.dmp

Filesize
168KB

Download
memory/1600-10-0x00000000050C0000-0x00000000050EA000-memory.dmp

Filesize
168KB

Download
memory/1600-8-0x00000000050C0000-0x00000000050EA000-memory.dmp

Filesize
168KB

Download
memory/1600-7-0x00000000050C0000-0x00000000050EA000-memory.dmp

Filesize
168KB

Download
memory/1600-454-0x0000000074E70000-0x0000000075620000-memory.dmp

Filesize
7.7MB

Download
memory/1600-455-0x0000000074E7E000-0x0000000074E7F000-memory.dmp

Filesize
4KB

Download
memory/1600-456-0x0000000074E70000-0x0000000075620000-memory.dmp

Filesize
7.7MB

Download
memory/1600-457-0x00000000056D0000-0x0000000005736000-memory.dmp

Filesize
408KB

Download
memory/1600-458-0x0000000074E70000-0x0000000075620000-memory.dmp

Filesize
7.7MB

Download
memory/1600-459-0x0000000074E70000-0x0000000075620000-memory.dmp

Filesize
7.7MB

Download