asyncrat | 4f9ae5b89c89e5c79c53db694d4d67e2d9b3c47c7389c8c3899dedbc9e92be76

Analysis

max time kernel
117s
max time network
145s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
25-05-2024 01:13

Target

4f9ae5b89c89e5c79c53db694d4d67e2d9b3c47c7389c8c3899dedbc9e92be76.exe
Size

91KB
MD5

9211293fdf6164567c9c0557cf200057
SHA1

cef794bc498b0b4ffea444c8f0bd002f0ad717bc
SHA256

4f9ae5b89c89e5c79c53db694d4d67e2d9b3c47c7389c8c3899dedbc9e92be76
SHA512

bc858a5bf2f61a84718c204b1b3cef8883e91d88f5ca3f974b9531f433e44b62d2d7474a8f5f65213703146603ff531a5441a2640c7c63bf0e3b05de0671a609
SSDEEP

1536:nMZI65tohmg4x4mRpkKzk9c/8a95TmjsqeEPQk4SfV:nMuHdOpkKzuc/8afmjsqeEPQk4S9

Score

10^/10

asyncrat os rat

Family

asyncrat

Version

0.5.8

Botnet

20.117.108.240:7825

Mutex

IOr8QBoiV215

Attributes

aes.plain

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Detects file containing reversed ASEP Autorun registry keys 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2292-9-0x0000000000400000-0x0000000000412000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse
behavioral1/memory/2292-13-0x0000000000400000-0x0000000000412000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse
behavioral1/memory/2292-7-0x0000000000400000-0x0000000000412000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse
behavioral1/memory/2292-17-0x0000000000400000-0x0000000000412000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse
behavioral1/memory/2292-15-0x0000000000400000-0x0000000000412000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse

Suspicious use of SetThreadContext 1 IoCs

Processes:

4f9ae5b89c89e5c79c53db694d4d67e2d9b3c47c7389c8c3899dedbc9e92be76.exe

description	pid	process	target process
PID 1968 set thread context of 2292	1968	4f9ae5b89c89e5c79c53db694d4d67e2d9b3c47c7389c8c3899dedbc9e92be76.exe	RegAsm.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

RegAsm.exe

description pid process

Token: SeDebugPrivilege 2292 RegAsm.exe

description	pid	process
Token: SeDebugPrivilege	2292	RegAsm.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

4f9ae5b89c89e5c79c53db694d4d67e2d9b3c47c7389c8c3899dedbc9e92be76.exe

description	pid	process	target process
PID 1968 wrote to memory of 2292	1968	4f9ae5b89c89e5c79c53db694d4d67e2d9b3c47c7389c8c3899dedbc9e92be76.exe	RegAsm.exe
PID 1968 wrote to memory of 2292	1968	4f9ae5b89c89e5c79c53db694d4d67e2d9b3c47c7389c8c3899dedbc9e92be76.exe	RegAsm.exe
PID 1968 wrote to memory of 2292	1968	4f9ae5b89c89e5c79c53db694d4d67e2d9b3c47c7389c8c3899dedbc9e92be76.exe	RegAsm.exe
PID 1968 wrote to memory of 2292	1968	4f9ae5b89c89e5c79c53db694d4d67e2d9b3c47c7389c8c3899dedbc9e92be76.exe	RegAsm.exe
PID 1968 wrote to memory of 2292	1968	4f9ae5b89c89e5c79c53db694d4d67e2d9b3c47c7389c8c3899dedbc9e92be76.exe	RegAsm.exe
PID 1968 wrote to memory of 2292	1968	4f9ae5b89c89e5c79c53db694d4d67e2d9b3c47c7389c8c3899dedbc9e92be76.exe	RegAsm.exe
PID 1968 wrote to memory of 2292	1968	4f9ae5b89c89e5c79c53db694d4d67e2d9b3c47c7389c8c3899dedbc9e92be76.exe	RegAsm.exe
PID 1968 wrote to memory of 2292	1968	4f9ae5b89c89e5c79c53db694d4d67e2d9b3c47c7389c8c3899dedbc9e92be76.exe	RegAsm.exe
PID 1968 wrote to memory of 2292	1968	4f9ae5b89c89e5c79c53db694d4d67e2d9b3c47c7389c8c3899dedbc9e92be76.exe	RegAsm.exe
PID 1968 wrote to memory of 2292	1968	4f9ae5b89c89e5c79c53db694d4d67e2d9b3c47c7389c8c3899dedbc9e92be76.exe	RegAsm.exe
PID 1968 wrote to memory of 2292	1968	4f9ae5b89c89e5c79c53db694d4d67e2d9b3c47c7389c8c3899dedbc9e92be76.exe	RegAsm.exe
PID 1968 wrote to memory of 2292	1968	4f9ae5b89c89e5c79c53db694d4d67e2d9b3c47c7389c8c3899dedbc9e92be76.exe	RegAsm.exe

C:\Users\Admin\AppData\Local\Temp\4f9ae5b89c89e5c79c53db694d4d67e2d9b3c47c7389c8c3899dedbc9e92be76.exe
"C:\Users\Admin\AppData\Local\Temp\4f9ae5b89c89e5c79c53db694d4d67e2d9b3c47c7389c8c3899dedbc9e92be76.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1968
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  #system32
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2292

memory/1968-0-0x000000007464E000-0x000000007464F000-memory.dmp

Filesize
4KB

Download
memory/1968-1-0x00000000000F0000-0x000000000010C000-memory.dmp

Filesize
112KB

Download
memory/1968-2-0x0000000074640000-0x0000000074D2E000-memory.dmp

Filesize
6.9MB

Download
memory/1968-18-0x0000000074640000-0x0000000074D2E000-memory.dmp

Filesize
6.9MB

Download
memory/2292-9-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2292-13-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2292-11-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2292-7-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2292-5-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2292-3-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2292-17-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2292-15-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download