asyncrat | e13360fe12492ad8b6f72d8cbd0969cfab0003e9898d13afe1c5de7bbb143b1f

Analysis

max time kernel
190s
max time network
204s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
24-05-2024 19:25

Target

Client.exe
Size

63KB
MD5

68a978592c6c5cc22da0b7dde87b2d44
SHA1

a0d7dd10bb29f769b68d6e7333dda1913b049250
SHA256

e13360fe12492ad8b6f72d8cbd0969cfab0003e9898d13afe1c5de7bbb143b1f
SHA512

b2a9963d7ddf8047a74d71aec720df1c3edec0dd0d17b7e6734addbe57b324bce103b322fdc174da979586f83856a75dc489d240e29114ff09d4ed50647054e5
SSDEEP

1536:QhB5LrUwk4XO01V5eeiIVrGbbXwUNeGODpqKmY7:QhB5LrUwk4XVVseXGbbX/NQgz

Score

10^/10

asyncrat client rat

Family

asyncrat

Version

5.0.5

Botnet

Client

uk2.localto.net:3793

Mutex

Venom_RAT_HVNC_Mutex_Venom RAT_HVNC

Attributes

aes.plain

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

4704 timeout.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Client.exe

description pid process

Token: SeDebugPrivilege 4908 Client.exe

pid	process
4704	timeout.exe

description	pid	process
Token: SeDebugPrivilege	4908	Client.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

Client.execmd.exe

description	pid	process	target process
PID 4908 wrote to memory of 5672	4908	Client.exe	cmd.exe
PID 4908 wrote to memory of 5672	4908	Client.exe	cmd.exe
PID 5672 wrote to memory of 4704	5672	cmd.exe	timeout.exe
PID 5672 wrote to memory of 4704	5672	cmd.exe	timeout.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp14D1.tmp.bat""
2⤵
- Suspicious use of WriteProcessMemory
PID:5672

C:\Windows\system32\timeout.exe
timeout 3
3⤵
- Delays execution with timeout.exe
PID:4704

C:\Users\Admin\AppData\Local\Temp\tmp14D1.tmp.bat
Filesize
158B

MD5
b1fc78b505c793156312691a8e171c97

SHA1
bdbda88516aae71eed91222b8c6209546d551c30

SHA256
013dd804880c41442d61a235a887e66bde520dbadceac9116020742c600eab1a

SHA512
118a3286f9843dcad44c918412ee5907bbc746864be2aad832413e87e66b1e6462aeaf9f743f041e5c02ec739867fc7a6dc9e42e5930507b531576c0fd23f5f2

Download Submit
memory/4908-0-0x0000000000E30000-0x0000000000E46000-memory.dmp

Filesize
88KB

Download
memory/4908-1-0x00007FFAA59E3000-0x00007FFAA59E5000-memory.dmp

Filesize
8KB

Download
memory/4908-2-0x00007FFAA59E0000-0x00007FFAA64A1000-memory.dmp

Filesize
10.8MB

Download
memory/4908-3-0x00007FFAA59E0000-0x00007FFAA64A1000-memory.dmp

Filesize
10.8MB

Download
memory/4908-6-0x00007FFAA59E3000-0x00007FFAA59E5000-memory.dmp

Filesize
8KB

Download
memory/4908-7-0x00007FFAA59E0000-0x00007FFAA64A1000-memory.dmp

Filesize
10.8MB

Download
memory/4908-8-0x00007FFAA59E0000-0x00007FFAA64A1000-memory.dmp

Filesize
10.8MB

Download
memory/4908-9-0x000000001C610000-0x000000001C686000-memory.dmp

Filesize
472KB

Download
memory/4908-10-0x000000001C590000-0x000000001C5F4000-memory.dmp

Filesize
400KB

Download
memory/4908-11-0x000000001C5F0000-0x000000001C60E000-memory.dmp

Filesize
120KB

Download
memory/4908-16-0x00007FFAA59E0000-0x00007FFAA64A1000-memory.dmp

Filesize
10.8MB

Download