asyncrat | b010fc8a5324e8c3f72bd5884f5f31cbc02dcb9df573cf5a82405560f4927687

Analysis

max time kernel
133s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
24-05-2024 06:51

Target

4516D516DCF02B03D700312E4AF2B58F.exe
Size

91KB
MD5

4516d516dcf02b03d700312e4af2b58f
SHA1

8a36bd779bfba8a87b5d8ee8e6c0d7c0a4faa3ca
SHA256

b010fc8a5324e8c3f72bd5884f5f31cbc02dcb9df573cf5a82405560f4927687
SHA512

0709c4069670d24c96d32f47fbf8a0eb0b3484cdce07205f5d2640b9b852fa8d0b1fda1b93d2858062ad76c44778cbc68ee831f3919e82422197c64e9a698f39
SSDEEP

1536:rMuBw+olasjN0Fu8MmiGRwOFSe4808VxdHDYIEgr69cmoLu0t0H:rMuBwsshLW/j4v8PdHsX9cmoLu0Y

Score

10^/10

asyncrat op rat

Family

asyncrat

Version

0.5.8

Botnet

20.117.108.240:5612

Mutex

HssS7dvHeccj

Attributes

aes.plain

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Suspicious use of SetThreadContext 1 IoCs

Processes:

4516D516DCF02B03D700312E4AF2B58F.exe

description pid process target process

PID 4500 set thread context of 1824 4500 4516D516DCF02B03D700312E4AF2B58F.exe RegAsm.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

4516D516DCF02B03D700312E4AF2B58F.exe

pid process

4500 4516D516DCF02B03D700312E4AF2B58F.exe
4500 4516D516DCF02B03D700312E4AF2B58F.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

4516D516DCF02B03D700312E4AF2B58F.exeRegAsm.exe

description pid process

Token: SeDebugPrivilege 4500 4516D516DCF02B03D700312E4AF2B58F.exe
Token: SeDebugPrivilege 1824 RegAsm.exe

description	pid	process	target process
PID 4500 set thread context of 1824	4500	4516D516DCF02B03D700312E4AF2B58F.exe	RegAsm.exe

pid	process
4500	4516D516DCF02B03D700312E4AF2B58F.exe
4500	4516D516DCF02B03D700312E4AF2B58F.exe

description	pid	process
Token: SeDebugPrivilege	4500	4516D516DCF02B03D700312E4AF2B58F.exe
Token: SeDebugPrivilege	1824	RegAsm.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

4516D516DCF02B03D700312E4AF2B58F.exe

description	pid	process	target process
PID 4500 wrote to memory of 1492	4500	4516D516DCF02B03D700312E4AF2B58F.exe	RegAsm.exe
PID 4500 wrote to memory of 1492	4500	4516D516DCF02B03D700312E4AF2B58F.exe	RegAsm.exe
PID 4500 wrote to memory of 1492	4500	4516D516DCF02B03D700312E4AF2B58F.exe	RegAsm.exe
PID 4500 wrote to memory of 1824	4500	4516D516DCF02B03D700312E4AF2B58F.exe	RegAsm.exe
PID 4500 wrote to memory of 1824	4500	4516D516DCF02B03D700312E4AF2B58F.exe	RegAsm.exe
PID 4500 wrote to memory of 1824	4500	4516D516DCF02B03D700312E4AF2B58F.exe	RegAsm.exe
PID 4500 wrote to memory of 1824	4500	4516D516DCF02B03D700312E4AF2B58F.exe	RegAsm.exe
PID 4500 wrote to memory of 1824	4500	4516D516DCF02B03D700312E4AF2B58F.exe	RegAsm.exe
PID 4500 wrote to memory of 1824	4500	4516D516DCF02B03D700312E4AF2B58F.exe	RegAsm.exe
PID 4500 wrote to memory of 1824	4500	4516D516DCF02B03D700312E4AF2B58F.exe	RegAsm.exe
PID 4500 wrote to memory of 1824	4500	4516D516DCF02B03D700312E4AF2B58F.exe	RegAsm.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
#system32
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1824

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=1424,i,6576818814118437872,11004518367271063231,262144 --variations-seed-version --mojo-platform-channel-handle=3944 /prefetch:8
1⤵
PID:4620

memory/1824-2-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1824-6-0x0000000074AD0000-0x0000000075280000-memory.dmp

Filesize
7.7MB

Download
memory/1824-7-0x0000000074AD0000-0x0000000075280000-memory.dmp

Filesize
7.7MB

Download
memory/1824-10-0x00000000056D0000-0x000000000576C000-memory.dmp

Filesize
624KB

Download
memory/1824-11-0x0000000005D20000-0x00000000062C4000-memory.dmp

Filesize
5.6MB

Download
memory/1824-12-0x00000000057E0000-0x0000000005846000-memory.dmp

Filesize
408KB

Download
memory/1824-13-0x0000000074AD0000-0x0000000075280000-memory.dmp

Filesize
7.7MB

Download
memory/1824-14-0x0000000074AD0000-0x0000000075280000-memory.dmp

Filesize
7.7MB

Download
memory/4500-0-0x0000000074ADE000-0x0000000074ADF000-memory.dmp

Filesize
4KB

Download
memory/4500-1-0x00000000005C0000-0x00000000005DE000-memory.dmp

Filesize
120KB

Download
memory/4500-4-0x0000000074AD0000-0x0000000075280000-memory.dmp

Filesize
7.7MB

Download
memory/4500-5-0x0000000074AD0000-0x0000000075280000-memory.dmp

Filesize
7.7MB

Download