asyncrat | 04d34301da1223f252b3d413f20ba5a8e1998a9999785e20f5dc030d121e4977

Analysis

max time kernel
134s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
28-05-2024 18:32

Target

2024-05-28_d320e00747abb1d7fa430cbfb4f0e333_megazord.exe
Size

3.8MB
MD5

d320e00747abb1d7fa430cbfb4f0e333
SHA1

1e49b413e3ff83ca4ed626567a410bb504e2e05a
SHA256

04d34301da1223f252b3d413f20ba5a8e1998a9999785e20f5dc030d121e4977
SHA512

ab2a218f86db046b25e6dbeb2f41ab0baf87619237c793ae6ac8c75b1adcd1c9feda5267309a42c69c9c400a9c0836e0c0b56e6d091841c74ab1aae269c94c2e
SSDEEP

49152:YqUaD6IL/ZJYH6+Vl3Op3fBGF9Hjdt5BgCjWLq7xEv+P3Xbz0JERdPAht:bM3hDxEYcMdPWt

Score

10^/10

Family

asyncrat

Version

2.0.0

Botnet

Default

webwhatsapp.cc:65503

Mutex

ShiningForceRatMutex_cs_cs_cs

Attributes

aes.plain

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Detects executables attemping to enumerate video devices using WMI 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1816-0-0x0000000000400000-0x000000000041A000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice

Detects executables containing the string DcRatBy 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1816-0-0x0000000000400000-0x000000000041A000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_DcRatBy

Suspicious use of SetThreadContext 1 IoCs

Processes:

2024-05-28_d320e00747abb1d7fa430cbfb4f0e333_megazord.exe

description pid process target process

PID 4832 set thread context of 1816 4832 2024-05-28_d320e00747abb1d7fa430cbfb4f0e333_megazord.exe jsc.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

jsc.exe

description pid process

Token: SeDebugPrivilege 1816 jsc.exe

description	pid	process	target process
PID 4832 set thread context of 1816	4832	2024-05-28_d320e00747abb1d7fa430cbfb4f0e333_megazord.exe	jsc.exe

description	pid	process
Token: SeDebugPrivilege	1816	jsc.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

2024-05-28_d320e00747abb1d7fa430cbfb4f0e333_megazord.exe

description	pid	process	target process
PID 4832 wrote to memory of 1816	4832	2024-05-28_d320e00747abb1d7fa430cbfb4f0e333_megazord.exe	jsc.exe
PID 4832 wrote to memory of 1816	4832	2024-05-28_d320e00747abb1d7fa430cbfb4f0e333_megazord.exe	jsc.exe
PID 4832 wrote to memory of 1816	4832	2024-05-28_d320e00747abb1d7fa430cbfb4f0e333_megazord.exe	jsc.exe
PID 4832 wrote to memory of 1816	4832	2024-05-28_d320e00747abb1d7fa430cbfb4f0e333_megazord.exe	jsc.exe
PID 4832 wrote to memory of 1816	4832	2024-05-28_d320e00747abb1d7fa430cbfb4f0e333_megazord.exe	jsc.exe
PID 4832 wrote to memory of 1816	4832	2024-05-28_d320e00747abb1d7fa430cbfb4f0e333_megazord.exe	jsc.exe
PID 4832 wrote to memory of 1816	4832	2024-05-28_d320e00747abb1d7fa430cbfb4f0e333_megazord.exe	jsc.exe
PID 4832 wrote to memory of 1816	4832	2024-05-28_d320e00747abb1d7fa430cbfb4f0e333_megazord.exe	jsc.exe

C:\Users\Admin\AppData\Local\Temp\2024-05-28_d320e00747abb1d7fa430cbfb4f0e333_megazord.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-28_d320e00747abb1d7fa430cbfb4f0e333_megazord.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4832
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1816

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4216,i,14486271492189381216,15799931579469722648,262144 --variations-seed-version --mojo-platform-channel-handle=4072 /prefetch:8
1⤵
PID:5060

memory/1816-0-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/1816-1-0x0000000074C3E000-0x0000000074C3F000-memory.dmp

Filesize
4KB

Download
memory/1816-2-0x0000000074C30000-0x00000000753E0000-memory.dmp

Filesize
7.7MB

Download
memory/1816-3-0x0000000074C30000-0x00000000753E0000-memory.dmp

Filesize
7.7MB

Download
memory/1816-4-0x0000000074C3E000-0x0000000074C3F000-memory.dmp

Filesize
4KB

Download
memory/1816-5-0x0000000074C30000-0x00000000753E0000-memory.dmp

Filesize
7.7MB

Download
memory/1816-8-0x0000000005E90000-0x0000000005F2C000-memory.dmp

Filesize
624KB

Download
memory/1816-9-0x0000000006AC0000-0x0000000007064000-memory.dmp

Filesize
5.6MB

Download
memory/1816-10-0x0000000006580000-0x00000000065E6000-memory.dmp

Filesize
408KB

Download
memory/1816-11-0x0000000074C30000-0x00000000753E0000-memory.dmp

Filesize
7.7MB

Download