asyncrat | 510c31a30c94c1d46332356d8d4cf24171f3969c8d05e3dcecb492faa12fdc66

Resubmissions

07/07/2024, 08:48

240707-kqej2szhke 10

07/07/2024, 06:35

240707-hccr7awcpn 10

Analysis

max time kernel
150s
max time network
165s
platform
windows11-21h2_x64
resource
win11-20240704-en
resource tags

arch:x64arch:x86image:win11-20240704-enlocale:en-usos:windows11-21h2-x64system
submitted
07/07/2024, 06:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ZeroDay Executor.exe
Size

74KB
MD5

f0f3ba962df6f8d34d5f4e2a26b3516d
SHA1

32d897190c36c2d7a0d737fb20af984ffa5edb85
SHA256

510c31a30c94c1d46332356d8d4cf24171f3969c8d05e3dcecb492faa12fdc66
SHA512

dc45a90f3fafac1ebdfea08b1f136c55191f83203257a1b3b3461dfcd49fe4141631b88b766aa413eebc9352d4c6bccafa06d35a2232bbe87b5461d639905190
SSDEEP

1536:PU6gcxmd3CiWPMVkHbcT9AeLIgH1b9/9wnO+MQzcuLVclN:PUzcxmRdWPMVkHbABH1b9anDMQnBY

Score

10^/10

asyncrat default rat

Malware Config

Extracted

Family

asyncrat

Version

Venom RAT + HVNC + Stealer + Grabber v6.0.3

Botnet

Default

147.185.221.20:60349

Mutex

nduziwhzflylg

Attributes

delay
1
install
true
install_file
Windows Defender.exe
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Suspicious use of AdjustPrivilegeToken 43 IoCs

description	pid	Process
Token: SeDebugPrivilege	1496	ZeroDay Executor.exe
Token: SeIncreaseQuotaPrivilege	1496	ZeroDay Executor.exe
Token: SeSecurityPrivilege	1496	ZeroDay Executor.exe
Token: SeTakeOwnershipPrivilege	1496	ZeroDay Executor.exe
Token: SeLoadDriverPrivilege	1496	ZeroDay Executor.exe
Token: SeSystemProfilePrivilege	1496	ZeroDay Executor.exe
Token: SeSystemtimePrivilege	1496	ZeroDay Executor.exe
Token: SeProfSingleProcessPrivilege	1496	ZeroDay Executor.exe
Token: SeIncBasePriorityPrivilege	1496	ZeroDay Executor.exe
Token: SeCreatePagefilePrivilege	1496	ZeroDay Executor.exe
Token: SeBackupPrivilege	1496	ZeroDay Executor.exe
Token: SeRestorePrivilege	1496	ZeroDay Executor.exe
Token: SeShutdownPrivilege	1496	ZeroDay Executor.exe
Token: SeDebugPrivilege	1496	ZeroDay Executor.exe
Token: SeSystemEnvironmentPrivilege	1496	ZeroDay Executor.exe
Token: SeRemoteShutdownPrivilege	1496	ZeroDay Executor.exe
Token: SeUndockPrivilege	1496	ZeroDay Executor.exe
Token: SeManageVolumePrivilege	1496	ZeroDay Executor.exe
Token: 33	1496	ZeroDay Executor.exe
Token: 34	1496	ZeroDay Executor.exe
Token: 35	1496	ZeroDay Executor.exe
Token: 36	1496	ZeroDay Executor.exe
Token: SeIncreaseQuotaPrivilege	1496	ZeroDay Executor.exe
Token: SeSecurityPrivilege	1496	ZeroDay Executor.exe
Token: SeTakeOwnershipPrivilege	1496	ZeroDay Executor.exe
Token: SeLoadDriverPrivilege	1496	ZeroDay Executor.exe
Token: SeSystemProfilePrivilege	1496	ZeroDay Executor.exe
Token: SeSystemtimePrivilege	1496	ZeroDay Executor.exe
Token: SeProfSingleProcessPrivilege	1496	ZeroDay Executor.exe
Token: SeIncBasePriorityPrivilege	1496	ZeroDay Executor.exe
Token: SeCreatePagefilePrivilege	1496	ZeroDay Executor.exe
Token: SeBackupPrivilege	1496	ZeroDay Executor.exe
Token: SeRestorePrivilege	1496	ZeroDay Executor.exe
Token: SeShutdownPrivilege	1496	ZeroDay Executor.exe
Token: SeDebugPrivilege	1496	ZeroDay Executor.exe
Token: SeSystemEnvironmentPrivilege	1496	ZeroDay Executor.exe
Token: SeRemoteShutdownPrivilege	1496	ZeroDay Executor.exe
Token: SeUndockPrivilege	1496	ZeroDay Executor.exe
Token: SeManageVolumePrivilege	1496	ZeroDay Executor.exe
Token: 33	1496	ZeroDay Executor.exe
Token: 34	1496	ZeroDay Executor.exe
Token: 35	1496	ZeroDay Executor.exe
Token: 36	1496	ZeroDay Executor.exe

C:\Users\Admin\AppData\Local\Temp\ZeroDay Executor.exe
"C:\Users\Admin\AppData\Local\Temp\ZeroDay Executor.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1496

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1496-0-0x00007FFE76C53000-0x00007FFE76C55000-memory.dmp

Filesize
8KB

Download
memory/1496-1-0x0000000000BA0000-0x0000000000BB8000-memory.dmp

Filesize
96KB

Download
memory/1496-3-0x00007FFE76C50000-0x00007FFE77712000-memory.dmp

Filesize
10.8MB

Download
memory/1496-4-0x00007FFE76C50000-0x00007FFE77712000-memory.dmp

Filesize
10.8MB

Download