asyncrat | 48ebc663714ae75de7478dd0205b997244db6bf539e699ff3ab9533982b42045

General

Target

48ebc663714ae75de7478dd0205b997244db6bf539e699ff3ab9533982b42045.exe
Size

74KB
MD5

a5b01742cec671e5bcae18a7edc900f8
SHA1

1cd456a4185c19f03811cdf159df56a25e52c42f
SHA256

48ebc663714ae75de7478dd0205b997244db6bf539e699ff3ab9533982b42045
SHA512

da311b758aeb542158ff5b328ea474c4b4f945eee45f131651d5608efee403a844b726f5d5d6929aa4a75480580377076f9f231b7b510dc2472587c9b00aa58b
SSDEEP

1536:JXImvYaooWO4twEWsqaDOlI8PIpWk9rybuM8h2HNPCuxU31UL:ZYal4tP3qaaKlpWDbuhh2tbS32

Score

10^/10

asyncrat @microsoft rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

@Microsoft

C2

45.157.233.27:2222

Mutex

d7UH1abJuMSK

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Detects file containing reversed ASEP Autorun registry keys 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3076-11-0x0000000000400000-0x0000000000412000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse

Suspicious use of SetThreadContext 1 IoCs

Processes:

48ebc663714ae75de7478dd0205b997244db6bf539e699ff3ab9533982b42045.exe

description	pid	process	target process
PID 4044 set thread context of 3076	4044	48ebc663714ae75de7478dd0205b997244db6bf539e699ff3ab9533982b42045.exe	RegSvcs.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

48ebc663714ae75de7478dd0205b997244db6bf539e699ff3ab9533982b42045.exe

pid	process
4044	48ebc663714ae75de7478dd0205b997244db6bf539e699ff3ab9533982b42045.exe
4044	48ebc663714ae75de7478dd0205b997244db6bf539e699ff3ab9533982b42045.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

48ebc663714ae75de7478dd0205b997244db6bf539e699ff3ab9533982b42045.exeRegSvcs.exe

description	pid	process
Token: SeDebugPrivilege	4044	48ebc663714ae75de7478dd0205b997244db6bf539e699ff3ab9533982b42045.exe
Token: SeDebugPrivilege	3076	RegSvcs.exe
Token: SeDebugPrivilege	3076	RegSvcs.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

48ebc663714ae75de7478dd0205b997244db6bf539e699ff3ab9533982b42045.exe

description	pid	process	target process
PID 4044 wrote to memory of 1796	4044	48ebc663714ae75de7478dd0205b997244db6bf539e699ff3ab9533982b42045.exe	RegSvcs.exe
PID 4044 wrote to memory of 1796	4044	48ebc663714ae75de7478dd0205b997244db6bf539e699ff3ab9533982b42045.exe	RegSvcs.exe
PID 4044 wrote to memory of 1796	4044	48ebc663714ae75de7478dd0205b997244db6bf539e699ff3ab9533982b42045.exe	RegSvcs.exe
PID 4044 wrote to memory of 3076	4044	48ebc663714ae75de7478dd0205b997244db6bf539e699ff3ab9533982b42045.exe	RegSvcs.exe
PID 4044 wrote to memory of 3076	4044	48ebc663714ae75de7478dd0205b997244db6bf539e699ff3ab9533982b42045.exe	RegSvcs.exe
PID 4044 wrote to memory of 3076	4044	48ebc663714ae75de7478dd0205b997244db6bf539e699ff3ab9533982b42045.exe	RegSvcs.exe
PID 4044 wrote to memory of 3076	4044	48ebc663714ae75de7478dd0205b997244db6bf539e699ff3ab9533982b42045.exe	RegSvcs.exe
PID 4044 wrote to memory of 3076	4044	48ebc663714ae75de7478dd0205b997244db6bf539e699ff3ab9533982b42045.exe	RegSvcs.exe
PID 4044 wrote to memory of 3076	4044	48ebc663714ae75de7478dd0205b997244db6bf539e699ff3ab9533982b42045.exe	RegSvcs.exe
PID 4044 wrote to memory of 3076	4044	48ebc663714ae75de7478dd0205b997244db6bf539e699ff3ab9533982b42045.exe	RegSvcs.exe
PID 4044 wrote to memory of 3076	4044	48ebc663714ae75de7478dd0205b997244db6bf539e699ff3ab9533982b42045.exe	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\48ebc663714ae75de7478dd0205b997244db6bf539e699ff3ab9533982b42045.exe
"C:\Users\Admin\AppData\Local\Temp\48ebc663714ae75de7478dd0205b997244db6bf539e699ff3ab9533982b42045.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4044

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
2⤵
PID:1796

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3076

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3076-11-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/3076-17-0x00000000750E0000-0x0000000075890000-memory.dmp

Filesize
7.7MB

Download
memory/3076-16-0x00000000750E0000-0x0000000075890000-memory.dmp

Filesize
7.7MB

Download
memory/3076-15-0x00000000750E0000-0x0000000075890000-memory.dmp

Filesize
7.7MB

Download
memory/3076-13-0x00000000750E0000-0x0000000075890000-memory.dmp

Filesize
7.7MB

Download
memory/4044-4-0x00000000059D0000-0x00000000059DA000-memory.dmp

Filesize
40KB

Download
memory/4044-6-0x00000000750E0000-0x0000000075890000-memory.dmp

Filesize
7.7MB

Download
memory/4044-7-0x00000000750EE000-0x00000000750EF000-memory.dmp

Filesize
4KB

Download
memory/4044-8-0x00000000750E0000-0x0000000075890000-memory.dmp

Filesize
7.7MB

Download
memory/4044-9-0x00000000059C0000-0x00000000059D4000-memory.dmp

Filesize
80KB

Download
memory/4044-10-0x0000000005C50000-0x0000000005C6E000-memory.dmp

Filesize
120KB

Download
memory/4044-5-0x0000000005CF0000-0x0000000005D66000-memory.dmp

Filesize
472KB

Download
memory/4044-0-0x00000000750EE000-0x00000000750EF000-memory.dmp

Filesize
4KB

Download
memory/4044-14-0x00000000750E0000-0x0000000075890000-memory.dmp

Filesize
7.7MB

Download
memory/4044-3-0x0000000005A50000-0x0000000005AE2000-memory.dmp

Filesize
584KB

Download
memory/4044-2-0x0000000006000000-0x00000000065A4000-memory.dmp

Filesize
5.6MB

Download
memory/4044-1-0x0000000000FC0000-0x0000000000FDC000-memory.dmp

Filesize
112KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads