asyncrat | c1f22a60d29d14993576ee6093144960dd3b0c181569fd41c913b8d38ff3debd

Analysis

max time kernel
147s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20240426-en
resource tags

arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system
submitted
31/05/2024, 12:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c1f22a60d29d14993576ee6093144960dd3b0c181569fd41c913b8d38ff3debd.exe
Size 429KB
Sample240531-pr2s7aha7v
SHA256 c1f22a60d29d14993576ee6093144960dd3b0c181569fd41c913b8d38ff3debd
MD5 c6ea25255fd7c184d6dfb684ac82e351
SHA1 427e8c51fe469ac97d0150e7eeef493fe58618fa
SHA512 1ca511225bbd33073749ba7fa0792ced0c12d3516a57bff4f04eba6e4287593a4b76812d0249db61848c5fcc5b892d5363684800e8d46bfc11159f2b0e4276a4
SSDEEP 6144:Av0e3NdBFTOBJpuRrHh1phb3S9AFCACDXywV5R8wQU5dya8oRY2D/J8YUFvSs/j:OJfBBHhxTScrCLywV5Gk/XUFvS8
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

asyncrat fresh rat

Malware Config

Extracted

Family

asyncrat

Version

AsyncRAT

Botnet

Fresh

pepecasas123.net:4608

Mutex

AsyncMutex_5952

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4596 set thread context of 3224	4596	c1f22a60d29d14993576ee6093144960dd3b0c181569fd41c913b8d38ff3debd.exe	77

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
3224	installutil.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4596	c1f22a60d29d14993576ee6093144960dd3b0c181569fd41c913b8d38ff3debd.exe
Token: SeDebugPrivilege	3224	installutil.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3224	installutil.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 4596 wrote to memory of 3224	4596	c1f22a60d29d14993576ee6093144960dd3b0c181569fd41c913b8d38ff3debd.exe	77
PID 4596 wrote to memory of 3224	4596	c1f22a60d29d14993576ee6093144960dd3b0c181569fd41c913b8d38ff3debd.exe	77
PID 4596 wrote to memory of 3224	4596	c1f22a60d29d14993576ee6093144960dd3b0c181569fd41c913b8d38ff3debd.exe	77
PID 4596 wrote to memory of 3224	4596	c1f22a60d29d14993576ee6093144960dd3b0c181569fd41c913b8d38ff3debd.exe	77
PID 4596 wrote to memory of 3224	4596	c1f22a60d29d14993576ee6093144960dd3b0c181569fd41c913b8d38ff3debd.exe	77
PID 4596 wrote to memory of 3224	4596	c1f22a60d29d14993576ee6093144960dd3b0c181569fd41c913b8d38ff3debd.exe	77
PID 4596 wrote to memory of 3224	4596	c1f22a60d29d14993576ee6093144960dd3b0c181569fd41c913b8d38ff3debd.exe	77
PID 4596 wrote to memory of 3224	4596	c1f22a60d29d14993576ee6093144960dd3b0c181569fd41c913b8d38ff3debd.exe	77
PID 4596 wrote to memory of 1864	4596	c1f22a60d29d14993576ee6093144960dd3b0c181569fd41c913b8d38ff3debd.exe	78
PID 4596 wrote to memory of 1864	4596	c1f22a60d29d14993576ee6093144960dd3b0c181569fd41c913b8d38ff3debd.exe	78
PID 4596 wrote to memory of 1864	4596	c1f22a60d29d14993576ee6093144960dd3b0c181569fd41c913b8d38ff3debd.exe	78

C:\Users\Admin\AppData\Local\Temp\c1f22a60d29d14993576ee6093144960dd3b0c181569fd41c913b8d38ff3debd.exe
"C:\Users\Admin\AppData\Local\Temp\c1f22a60d29d14993576ee6093144960dd3b0c181569fd41c913b8d38ff3debd.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4596
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:3224
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
  2⤵
  PID:1864

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3224-14-0x00000000060C0000-0x000000000615C000-memory.dmp

Download

memory/3224-10-0x0000000005340000-0x00000000053D2000-memory.dmp

Download

memory/3224-17-0x0000000074D80000-0x0000000075531000-memory.dmp

Download

memory/3224-16-0x0000000074D8E000-0x0000000074D8F000-memory.dmp

Download

memory/3224-15-0x0000000006610000-0x0000000006676000-memory.dmp

Download

memory/3224-5-0x0000000000400000-0x0000000000416000-memory.dmp

Download

memory/3224-11-0x0000000005310000-0x000000000531A000-memory.dmp

Download

memory/3224-9-0x0000000005710000-0x0000000005CB6000-memory.dmp

Download

memory/3224-8-0x0000000074D80000-0x0000000075531000-memory.dmp

Download

memory/3224-6-0x0000000074D8E000-0x0000000074D8F000-memory.dmp

Download

memory/4596-7-0x00007FF9A4510000-0x00007FF9A4FD2000-memory.dmp

Download

memory/4596-1-0x00007FF9A4513000-0x00007FF9A4515000-memory.dmp

Download

memory/4596-0-0x00000233F0AD0000-0x00000233F0ADA000-memory.dmp

Download

memory/4596-4-0x00000233F3CD0000-0x00000233F3D38000-memory.dmp

Download

memory/4596-3-0x00000233F0F40000-0x00000233F0F46000-memory.dmp

Download

memory/4596-2-0x00007FF9A4510000-0x00007FF9A4FD2000-memory.dmp

Download