asyncrat | 4f9ae5b89c89e5c79c53db694d4d67e2d9b3c47c7389c8c3899dedbc9e92be76

Analysis

max time kernel
135s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
25-05-2024 01:13

Target

4f9ae5b89c89e5c79c53db694d4d67e2d9b3c47c7389c8c3899dedbc9e92be76.exe
Size

91KB
MD5

9211293fdf6164567c9c0557cf200057
SHA1

cef794bc498b0b4ffea444c8f0bd002f0ad717bc
SHA256

4f9ae5b89c89e5c79c53db694d4d67e2d9b3c47c7389c8c3899dedbc9e92be76
SHA512

bc858a5bf2f61a84718c204b1b3cef8883e91d88f5ca3f974b9531f433e44b62d2d7474a8f5f65213703146603ff531a5441a2640c7c63bf0e3b05de0671a609
SSDEEP

1536:nMZI65tohmg4x4mRpkKzk9c/8a95TmjsqeEPQk4SfV:nMuHdOpkKzuc/8afmjsqeEPQk4S9

Score

10^/10

asyncrat os rat

Family

asyncrat

Version

0.5.8

Botnet

20.117.108.240:7825

Mutex

IOr8QBoiV215

Attributes

aes.plain

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Detects file containing reversed ASEP Autorun registry keys 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1556-2-0x0000000000400000-0x0000000000412000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse

Suspicious use of SetThreadContext 1 IoCs

Processes:

4f9ae5b89c89e5c79c53db694d4d67e2d9b3c47c7389c8c3899dedbc9e92be76.exe

description	pid	process	target process
PID 4196 set thread context of 1556	4196	4f9ae5b89c89e5c79c53db694d4d67e2d9b3c47c7389c8c3899dedbc9e92be76.exe	RegAsm.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

RegAsm.exe

description pid process

Token: SeDebugPrivilege 1556 RegAsm.exe

description	pid	process
Token: SeDebugPrivilege	1556	RegAsm.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

4f9ae5b89c89e5c79c53db694d4d67e2d9b3c47c7389c8c3899dedbc9e92be76.exe

description	pid	process	target process
PID 4196 wrote to memory of 1556	4196	4f9ae5b89c89e5c79c53db694d4d67e2d9b3c47c7389c8c3899dedbc9e92be76.exe	RegAsm.exe
PID 4196 wrote to memory of 1556	4196	4f9ae5b89c89e5c79c53db694d4d67e2d9b3c47c7389c8c3899dedbc9e92be76.exe	RegAsm.exe
PID 4196 wrote to memory of 1556	4196	4f9ae5b89c89e5c79c53db694d4d67e2d9b3c47c7389c8c3899dedbc9e92be76.exe	RegAsm.exe
PID 4196 wrote to memory of 1556	4196	4f9ae5b89c89e5c79c53db694d4d67e2d9b3c47c7389c8c3899dedbc9e92be76.exe	RegAsm.exe
PID 4196 wrote to memory of 1556	4196	4f9ae5b89c89e5c79c53db694d4d67e2d9b3c47c7389c8c3899dedbc9e92be76.exe	RegAsm.exe
PID 4196 wrote to memory of 1556	4196	4f9ae5b89c89e5c79c53db694d4d67e2d9b3c47c7389c8c3899dedbc9e92be76.exe	RegAsm.exe
PID 4196 wrote to memory of 1556	4196	4f9ae5b89c89e5c79c53db694d4d67e2d9b3c47c7389c8c3899dedbc9e92be76.exe	RegAsm.exe
PID 4196 wrote to memory of 1556	4196	4f9ae5b89c89e5c79c53db694d4d67e2d9b3c47c7389c8c3899dedbc9e92be76.exe	RegAsm.exe

C:\Users\Admin\AppData\Local\Temp\4f9ae5b89c89e5c79c53db694d4d67e2d9b3c47c7389c8c3899dedbc9e92be76.exe
"C:\Users\Admin\AppData\Local\Temp\4f9ae5b89c89e5c79c53db694d4d67e2d9b3c47c7389c8c3899dedbc9e92be76.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4196
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  #system32
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1556

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4028,i,13281073920029625837,8253721632651544158,262144 --variations-seed-version --mojo-platform-channel-handle=4492 /prefetch:8
1⤵
PID:4252

memory/1556-2-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1556-5-0x0000000075070000-0x0000000075820000-memory.dmp

Filesize
7.7MB

Download
memory/1556-6-0x0000000075070000-0x0000000075820000-memory.dmp

Filesize
7.7MB

Download
memory/1556-9-0x0000000005CF0000-0x0000000005D8C000-memory.dmp

Filesize
624KB

Download
memory/1556-10-0x0000000006340000-0x00000000068E4000-memory.dmp

Filesize
5.6MB

Download
memory/1556-11-0x0000000005E00000-0x0000000005E66000-memory.dmp

Filesize
408KB

Download
memory/1556-13-0x0000000075070000-0x0000000075820000-memory.dmp

Filesize
7.7MB

Download
memory/1556-14-0x0000000075070000-0x0000000075820000-memory.dmp

Filesize
7.7MB

Download
memory/4196-0-0x000000007507E000-0x000000007507F000-memory.dmp

Filesize
4KB

Download
memory/4196-1-0x0000000000620000-0x000000000063C000-memory.dmp

Filesize
112KB

Download
memory/4196-4-0x0000000075070000-0x0000000075820000-memory.dmp

Filesize
7.7MB

Download
memory/4196-12-0x0000000075070000-0x0000000075820000-memory.dmp

Filesize
7.7MB

Download