asyncrat | 4f9ae5b89c89e5c79c53db694d4d67e2d9b3c47c7389c8c3899dedbc9e92be76

Analysis

max time kernel
119s
max time network
144s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
24-05-2024 21:21

Target

9211293FDF6164567C9C0557CF200057.exe
Size

91KB
MD5

9211293fdf6164567c9c0557cf200057
SHA1

cef794bc498b0b4ffea444c8f0bd002f0ad717bc
SHA256

4f9ae5b89c89e5c79c53db694d4d67e2d9b3c47c7389c8c3899dedbc9e92be76
SHA512

bc858a5bf2f61a84718c204b1b3cef8883e91d88f5ca3f974b9531f433e44b62d2d7474a8f5f65213703146603ff531a5441a2640c7c63bf0e3b05de0671a609
SSDEEP

1536:nMZI65tohmg4x4mRpkKzk9c/8a95TmjsqeEPQk4SfV:nMuHdOpkKzuc/8afmjsqeEPQk4S9

Score

10^/10

asyncrat os rat

Family

asyncrat

Version

0.5.8

Botnet

20.117.108.240:7825

Mutex

IOr8QBoiV215

Attributes

aes.plain

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Suspicious use of SetThreadContext 1 IoCs

Processes:

9211293FDF6164567C9C0557CF200057.exe

description pid process target process

PID 2036 set thread context of 2356 2036 9211293FDF6164567C9C0557CF200057.exe RegAsm.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

RegAsm.exe

description pid process

Token: SeDebugPrivilege 2356 RegAsm.exe

description	pid	process	target process
PID 2036 set thread context of 2356	2036	9211293FDF6164567C9C0557CF200057.exe	RegAsm.exe

description	pid	process
Token: SeDebugPrivilege	2356	RegAsm.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

9211293FDF6164567C9C0557CF200057.exe

description	pid	process	target process
PID 2036 wrote to memory of 2356	2036	9211293FDF6164567C9C0557CF200057.exe	RegAsm.exe
PID 2036 wrote to memory of 2356	2036	9211293FDF6164567C9C0557CF200057.exe	RegAsm.exe
PID 2036 wrote to memory of 2356	2036	9211293FDF6164567C9C0557CF200057.exe	RegAsm.exe
PID 2036 wrote to memory of 2356	2036	9211293FDF6164567C9C0557CF200057.exe	RegAsm.exe
PID 2036 wrote to memory of 2356	2036	9211293FDF6164567C9C0557CF200057.exe	RegAsm.exe
PID 2036 wrote to memory of 2356	2036	9211293FDF6164567C9C0557CF200057.exe	RegAsm.exe
PID 2036 wrote to memory of 2356	2036	9211293FDF6164567C9C0557CF200057.exe	RegAsm.exe
PID 2036 wrote to memory of 2356	2036	9211293FDF6164567C9C0557CF200057.exe	RegAsm.exe
PID 2036 wrote to memory of 2356	2036	9211293FDF6164567C9C0557CF200057.exe	RegAsm.exe
PID 2036 wrote to memory of 2356	2036	9211293FDF6164567C9C0557CF200057.exe	RegAsm.exe
PID 2036 wrote to memory of 2356	2036	9211293FDF6164567C9C0557CF200057.exe	RegAsm.exe
PID 2036 wrote to memory of 2356	2036	9211293FDF6164567C9C0557CF200057.exe	RegAsm.exe

C:\Users\Admin\AppData\Local\Temp\9211293FDF6164567C9C0557CF200057.exe
"C:\Users\Admin\AppData\Local\Temp\9211293FDF6164567C9C0557CF200057.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2036
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  #system32
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2356

C:\Users\Admin\AppData\Local\Temp\Cab3822.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
memory/2036-0-0x00000000746FE000-0x00000000746FF000-memory.dmp

Filesize
4KB

Download
memory/2036-1-0x0000000001370000-0x000000000138C000-memory.dmp

Filesize
112KB

Download
memory/2036-2-0x00000000746F0000-0x0000000074DDE000-memory.dmp

Filesize
6.9MB

Download
memory/2036-15-0x00000000746F0000-0x0000000074DDE000-memory.dmp

Filesize
6.9MB

Download
memory/2356-6-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2356-5-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2356-10-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2356-14-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2356-12-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2356-8-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2356-4-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2356-3-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download