asyncrat | 9bc6e27c34e3b2cd3fef3fe683f34246c2e6049b4e7c0a046f2babf3a7412bba

Analysis

max time kernel
13s
max time network
4s
platform
windows11-21h2_x64
resource
win11-20240426-en
resource tags

arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system
submitted
22-05-2024 21:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

PEGASUS FULL VERSION.exe
Size

6.8MB
MD5

327ba7af9427fdb450a0628a27ae26de
SHA1

26fab46989dc26bc9b152ccb983c80ed09863ab8
SHA256

9bc6e27c34e3b2cd3fef3fe683f34246c2e6049b4e7c0a046f2babf3a7412bba
SHA512

a13f3095f643428a4713a7c6c5792c8c83c0ac2c02600761b9479caf2fe3def763248be32c3da7ea76ad07463165fda0e4f8baaa33ea24930eac59a1c62ba7bf
SSDEEP

49152:fRjkwtZPgeWCKxgt/HPEp7osQ3ANHAwnZN0lDuABhTf90fNfRPZxrJJlA26TKF8P:Bkw8A

Score

10^/10

asyncrat rat

Malware Config

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

1 raw.githubusercontent.com
3 raw.githubusercontent.com
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4624 2540 WerFault.exe PEGASUS FULL VERSION.exe
Modifies registry class 1 IoCs

Processes:

MiniSearchHost.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-2994005945-4089876968-1367784197-1000_Classes\Local Settings\MuiCache MiniSearchHost.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

PEGASUS FULL VERSION.exe

description pid process

Token: SeDebugPrivilege 2540 PEGASUS FULL VERSION.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

MiniSearchHost.exe

pid process

4780 MiniSearchHost.exe

flow	ioc
1	raw.githubusercontent.com
3	raw.githubusercontent.com

pid	pid_target	process	target process
4624	2540	WerFault.exe	PEGASUS FULL VERSION.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2994005945-4089876968-1367784197-1000_Classes\Local Settings\MuiCache	MiniSearchHost.exe

description	pid	process
Token: SeDebugPrivilege	2540	PEGASUS FULL VERSION.exe

pid	process
4780	MiniSearchHost.exe

C:\Users\Admin\AppData\Local\Temp\PEGASUS FULL VERSION.exe
"C:\Users\Admin\AppData\Local\Temp\PEGASUS FULL VERSION.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2540
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2540 -s 2032
  2⤵
  - Program crash
  PID:4624

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2540 -ip 2540
1⤵
PID:2492

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4780

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat

Filesize
10KB

MD5
394f971f95da279c2ebf1a4113ce8426

SHA1
74f73a16920c5919ccb7788e3c2429c291da34d3

SHA256
5555d03ce11acdeae26b199b7bdf7220be2f8a4668800c29644740857576659f

SHA512
1ea93d43096e70a182b4a5011b20b2a0c3558b907039c8ead7c3f89cc360b8ee635789b15398ef42f6a0c74a98d9f070290d5e98f786017e4d6bc3e25a042f33

Download Submit
memory/2540-0-0x00000000748FE000-0x00000000748FF000-memory.dmp

Filesize
4KB

Download
memory/2540-1-0x0000000000AF0000-0x00000000011C0000-memory.dmp

Filesize
6.8MB

Download
memory/2540-2-0x0000000006270000-0x0000000006816000-memory.dmp

Filesize
5.6MB

Download
memory/2540-3-0x0000000005D60000-0x0000000005DF2000-memory.dmp

Filesize
584KB

Download
memory/2540-4-0x00000000748F0000-0x00000000750A1000-memory.dmp

Filesize
7.7MB

Download
memory/2540-5-0x00000000748F0000-0x00000000750A1000-memory.dmp

Filesize
7.7MB

Download