asyncrat | e13360fe12492ad8b6f72d8cbd0969cfab0003e9898d13afe1c5de7bbb143b1f

Analysis

max time kernel
194s
max time network
258s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
24-05-2024 19:25

Target

Client.exe
Size

63KB
MD5

68a978592c6c5cc22da0b7dde87b2d44
SHA1

a0d7dd10bb29f769b68d6e7333dda1913b049250
SHA256

e13360fe12492ad8b6f72d8cbd0969cfab0003e9898d13afe1c5de7bbb143b1f
SHA512

b2a9963d7ddf8047a74d71aec720df1c3edec0dd0d17b7e6734addbe57b324bce103b322fdc174da979586f83856a75dc489d240e29114ff09d4ed50647054e5
SSDEEP

1536:QhB5LrUwk4XO01V5eeiIVrGbbXwUNeGODpqKmY7:QhB5LrUwk4XVVseXGbbX/NQgz

Score

10^/10

asyncrat client rat

Family

asyncrat

Version

5.0.5

Botnet

Client

uk2.localto.net:3793

Mutex

Venom_RAT_HVNC_Mutex_Venom RAT_HVNC

Attributes

aes.plain

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

2640 timeout.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Client.exe

description pid process

Token: SeDebugPrivilege 2676 Client.exe

pid	process
2640	timeout.exe

description	pid	process
Token: SeDebugPrivilege	2676	Client.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

Client.execmd.exe

description	pid	process	target process
PID 2676 wrote to memory of 1164	2676	Client.exe	cmd.exe
PID 2676 wrote to memory of 1164	2676	Client.exe	cmd.exe
PID 1164 wrote to memory of 2640	1164	cmd.exe	timeout.exe
PID 1164 wrote to memory of 2640	1164	cmd.exe	timeout.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp351B.tmp.bat""
2⤵
- Suspicious use of WriteProcessMemory
PID:1164

C:\Windows\system32\timeout.exe
timeout 3
3⤵
- Delays execution with timeout.exe
PID:2640

C:\Users\Admin\AppData\Local\Temp\tmp351B.tmp.bat
Filesize
158B

MD5
5f5c76c6b5adc9fe1db4c17ed2dd3687

SHA1
0621ffc0478000440704e9cbfd718dc19bed0381

SHA256
bc963de29c803e5080659affc56f467471f4627e766adf3d5c2fc5fd963c28db

SHA512
80f389d0a185db928f7bc8644ceeae0ff917f80490194aee38924bffb4de4ab68e4a56f00bbca30987031e4afbed969ff954788a108e21ed1aebcadf618df50e

Download Submit
memory/2676-0-0x0000000000650000-0x0000000000666000-memory.dmp

Filesize
88KB

Download
memory/2676-1-0x00007FFA5EE13000-0x00007FFA5EE14000-memory.dmp

Filesize
4KB

Download
memory/2676-2-0x00007FFA5EE10000-0x00007FFA5F7FC000-memory.dmp

Filesize
9.9MB

Download
memory/2676-3-0x00007FFA5EE10000-0x00007FFA5F7FC000-memory.dmp

Filesize
9.9MB

Download
memory/2676-6-0x00007FFA5EE13000-0x00007FFA5EE14000-memory.dmp

Filesize
4KB

Download
memory/2676-7-0x00007FFA5EE10000-0x00007FFA5F7FC000-memory.dmp

Filesize
9.9MB

Download
memory/2676-8-0x00007FFA5EE10000-0x00007FFA5F7FC000-memory.dmp

Filesize
9.9MB

Download
memory/2676-9-0x0000000000CA0000-0x0000000000D16000-memory.dmp

Filesize
472KB

Download
memory/2676-10-0x0000000000C20000-0x0000000000C84000-memory.dmp

Filesize
400KB

Download
memory/2676-11-0x0000000000DC0000-0x0000000000DDE000-memory.dmp

Filesize
120KB

Download
memory/2676-16-0x00007FFA5EE10000-0x00007FFA5F7FC000-memory.dmp

Filesize
9.9MB

Download