asyncrat | 0b5e7cdc5d5290f43799f61ef80cc36d163b3eed96480f77fd805d2cc34d44c8

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
08-07-2024 13:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

33.exe
Size

682KB
MD5

244173193de97b401b0f5391d71a6491
SHA1

d46357579f69a5db84a6ea93e777ae6a5b136c53
SHA256

0b5e7cdc5d5290f43799f61ef80cc36d163b3eed96480f77fd805d2cc34d44c8
SHA512

57fa5541eeca2515e6220cf38cb038323dc78b3f51a7981052a947359dee71a1fbddb4480cb128d513428e977a322fdfe48394996b9a46c0bddb14bcd0cd5ee7
SSDEEP

12288:Th1Lk70TnvjcWl93+2kBcRP+EjPrJ4wvu5b0Ye:Pk70TrcWv3+h6QE/jG50Ye

Score

10^/10

asyncrat rat

Malware Config

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 34 IoCs

rat

resource	yara_rule
behavioral1/memory/2452-5-0x00000000047E0000-0x00000000048AC000-memory.dmp	family_asyncrat
behavioral1/memory/2452-7-0x00000000047E0000-0x00000000048A7000-memory.dmp	family_asyncrat
behavioral1/memory/2452-8-0x00000000047E0000-0x00000000048A7000-memory.dmp	family_asyncrat
behavioral1/memory/2452-10-0x00000000047E0000-0x00000000048A7000-memory.dmp	family_asyncrat
behavioral1/memory/2452-12-0x00000000047E0000-0x00000000048A7000-memory.dmp	family_asyncrat
behavioral1/memory/2452-14-0x00000000047E0000-0x00000000048A7000-memory.dmp	family_asyncrat
behavioral1/memory/2452-18-0x00000000047E0000-0x00000000048A7000-memory.dmp	family_asyncrat
behavioral1/memory/2452-16-0x00000000047E0000-0x00000000048A7000-memory.dmp	family_asyncrat
behavioral1/memory/2452-20-0x00000000047E0000-0x00000000048A7000-memory.dmp	family_asyncrat
behavioral1/memory/2452-22-0x00000000047E0000-0x00000000048A7000-memory.dmp	family_asyncrat
behavioral1/memory/2452-24-0x00000000047E0000-0x00000000048A7000-memory.dmp	family_asyncrat
behavioral1/memory/2452-26-0x00000000047E0000-0x00000000048A7000-memory.dmp	family_asyncrat
behavioral1/memory/2452-30-0x00000000047E0000-0x00000000048A7000-memory.dmp	family_asyncrat
behavioral1/memory/2452-28-0x00000000047E0000-0x00000000048A7000-memory.dmp	family_asyncrat
behavioral1/memory/2452-32-0x00000000047E0000-0x00000000048A7000-memory.dmp	family_asyncrat
behavioral1/memory/2452-34-0x00000000047E0000-0x00000000048A7000-memory.dmp	family_asyncrat
behavioral1/memory/2452-36-0x00000000047E0000-0x00000000048A7000-memory.dmp	family_asyncrat
behavioral1/memory/2452-38-0x00000000047E0000-0x00000000048A7000-memory.dmp	family_asyncrat
behavioral1/memory/2452-40-0x00000000047E0000-0x00000000048A7000-memory.dmp	family_asyncrat
behavioral1/memory/2452-42-0x00000000047E0000-0x00000000048A7000-memory.dmp	family_asyncrat
behavioral1/memory/2452-44-0x00000000047E0000-0x00000000048A7000-memory.dmp	family_asyncrat
behavioral1/memory/2452-46-0x00000000047E0000-0x00000000048A7000-memory.dmp	family_asyncrat
behavioral1/memory/2452-48-0x00000000047E0000-0x00000000048A7000-memory.dmp	family_asyncrat
behavioral1/memory/2452-50-0x00000000047E0000-0x00000000048A7000-memory.dmp	family_asyncrat
behavioral1/memory/2452-52-0x00000000047E0000-0x00000000048A7000-memory.dmp	family_asyncrat
behavioral1/memory/2452-54-0x00000000047E0000-0x00000000048A7000-memory.dmp	family_asyncrat
behavioral1/memory/2452-56-0x00000000047E0000-0x00000000048A7000-memory.dmp	family_asyncrat
behavioral1/memory/2452-58-0x00000000047E0000-0x00000000048A7000-memory.dmp	family_asyncrat
behavioral1/memory/2452-60-0x00000000047E0000-0x00000000048A7000-memory.dmp	family_asyncrat
behavioral1/memory/2452-64-0x00000000047E0000-0x00000000048A7000-memory.dmp	family_asyncrat
behavioral1/memory/2452-62-0x00000000047E0000-0x00000000048A7000-memory.dmp	family_asyncrat
behavioral1/memory/2452-66-0x00000000047E0000-0x00000000048A7000-memory.dmp	family_asyncrat
behavioral1/memory/2452-68-0x00000000047E0000-0x00000000048A7000-memory.dmp	family_asyncrat
behavioral1/memory/2452-70-0x00000000047E0000-0x00000000048A7000-memory.dmp	family_asyncrat

.NET Reactor proctector 35 IoCs

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

resource	yara_rule
behavioral1/memory/2452-1-0x00000000048B0000-0x000000000497E000-memory.dmp	net_reactor
behavioral1/memory/2452-5-0x00000000047E0000-0x00000000048AC000-memory.dmp	net_reactor
behavioral1/memory/2452-7-0x00000000047E0000-0x00000000048A7000-memory.dmp	net_reactor
behavioral1/memory/2452-8-0x00000000047E0000-0x00000000048A7000-memory.dmp	net_reactor
behavioral1/memory/2452-10-0x00000000047E0000-0x00000000048A7000-memory.dmp	net_reactor
behavioral1/memory/2452-12-0x00000000047E0000-0x00000000048A7000-memory.dmp	net_reactor
behavioral1/memory/2452-14-0x00000000047E0000-0x00000000048A7000-memory.dmp	net_reactor
behavioral1/memory/2452-18-0x00000000047E0000-0x00000000048A7000-memory.dmp	net_reactor
behavioral1/memory/2452-16-0x00000000047E0000-0x00000000048A7000-memory.dmp	net_reactor
behavioral1/memory/2452-20-0x00000000047E0000-0x00000000048A7000-memory.dmp	net_reactor
behavioral1/memory/2452-22-0x00000000047E0000-0x00000000048A7000-memory.dmp	net_reactor
behavioral1/memory/2452-24-0x00000000047E0000-0x00000000048A7000-memory.dmp	net_reactor
behavioral1/memory/2452-26-0x00000000047E0000-0x00000000048A7000-memory.dmp	net_reactor
behavioral1/memory/2452-30-0x00000000047E0000-0x00000000048A7000-memory.dmp	net_reactor
behavioral1/memory/2452-28-0x00000000047E0000-0x00000000048A7000-memory.dmp	net_reactor
behavioral1/memory/2452-32-0x00000000047E0000-0x00000000048A7000-memory.dmp	net_reactor
behavioral1/memory/2452-34-0x00000000047E0000-0x00000000048A7000-memory.dmp	net_reactor
behavioral1/memory/2452-36-0x00000000047E0000-0x00000000048A7000-memory.dmp	net_reactor
behavioral1/memory/2452-38-0x00000000047E0000-0x00000000048A7000-memory.dmp	net_reactor
behavioral1/memory/2452-40-0x00000000047E0000-0x00000000048A7000-memory.dmp	net_reactor
behavioral1/memory/2452-42-0x00000000047E0000-0x00000000048A7000-memory.dmp	net_reactor
behavioral1/memory/2452-44-0x00000000047E0000-0x00000000048A7000-memory.dmp	net_reactor
behavioral1/memory/2452-46-0x00000000047E0000-0x00000000048A7000-memory.dmp	net_reactor
behavioral1/memory/2452-48-0x00000000047E0000-0x00000000048A7000-memory.dmp	net_reactor
behavioral1/memory/2452-50-0x00000000047E0000-0x00000000048A7000-memory.dmp	net_reactor
behavioral1/memory/2452-52-0x00000000047E0000-0x00000000048A7000-memory.dmp	net_reactor
behavioral1/memory/2452-54-0x00000000047E0000-0x00000000048A7000-memory.dmp	net_reactor
behavioral1/memory/2452-56-0x00000000047E0000-0x00000000048A7000-memory.dmp	net_reactor
behavioral1/memory/2452-58-0x00000000047E0000-0x00000000048A7000-memory.dmp	net_reactor
behavioral1/memory/2452-60-0x00000000047E0000-0x00000000048A7000-memory.dmp	net_reactor
behavioral1/memory/2452-64-0x00000000047E0000-0x00000000048A7000-memory.dmp	net_reactor
behavioral1/memory/2452-62-0x00000000047E0000-0x00000000048A7000-memory.dmp	net_reactor
behavioral1/memory/2452-66-0x00000000047E0000-0x00000000048A7000-memory.dmp	net_reactor
behavioral1/memory/2452-68-0x00000000047E0000-0x00000000048A7000-memory.dmp	net_reactor
behavioral1/memory/2452-70-0x00000000047E0000-0x00000000048A7000-memory.dmp	net_reactor

Executes dropped EXE 1 IoCs

pid	Process
7780	svhosts.exe

Loads dropped DLL 1 IoCs

pid	Process
7668	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
7724	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
7716	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2452	33.exe
2452	33.exe
2452	33.exe
2452	33.exe
2452	33.exe
2452	33.exe
2452	33.exe
7780	svhosts.exe
7780	svhosts.exe
7780	svhosts.exe
7780	svhosts.exe
7780	svhosts.exe
7780	svhosts.exe
7780	svhosts.exe
7780	svhosts.exe
7780	svhosts.exe
7780	svhosts.exe
7780	svhosts.exe
7780	svhosts.exe
7780	svhosts.exe
7780	svhosts.exe
7780	svhosts.exe
7780	svhosts.exe
7780	svhosts.exe
7780	svhosts.exe
7780	svhosts.exe
7780	svhosts.exe
7780	svhosts.exe
7780	svhosts.exe
7780	svhosts.exe
7780	svhosts.exe
7780	svhosts.exe
7780	svhosts.exe
7780	svhosts.exe
7780	svhosts.exe
7780	svhosts.exe
7780	svhosts.exe
7780	svhosts.exe
7780	svhosts.exe
7780	svhosts.exe
7780	svhosts.exe
7780	svhosts.exe
7780	svhosts.exe
7780	svhosts.exe
7780	svhosts.exe
7780	svhosts.exe
7780	svhosts.exe
7780	svhosts.exe
7780	svhosts.exe
7780	svhosts.exe
7780	svhosts.exe
7780	svhosts.exe
7780	svhosts.exe
7780	svhosts.exe
7780	svhosts.exe
7780	svhosts.exe
7780	svhosts.exe
7780	svhosts.exe
7780	svhosts.exe
7780	svhosts.exe
7780	svhosts.exe
7780	svhosts.exe
7780	svhosts.exe
7780	svhosts.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2452	33.exe
Token: SeDebugPrivilege	2452	33.exe
Token: SeDebugPrivilege	7780	svhosts.exe
Token: SeDebugPrivilege	7780	svhosts.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2452 wrote to memory of 7616	2452	33.exe	30
PID 2452 wrote to memory of 7616	2452	33.exe	30
PID 2452 wrote to memory of 7616	2452	33.exe	30
PID 2452 wrote to memory of 7616	2452	33.exe	30
PID 2452 wrote to memory of 7668	2452	33.exe	32
PID 2452 wrote to memory of 7668	2452	33.exe	32
PID 2452 wrote to memory of 7668	2452	33.exe	32
PID 2452 wrote to memory of 7668	2452	33.exe	32
PID 7668 wrote to memory of 7724	7668	cmd.exe	35
PID 7668 wrote to memory of 7724	7668	cmd.exe	35
PID 7668 wrote to memory of 7724	7668	cmd.exe	35
PID 7668 wrote to memory of 7724	7668	cmd.exe	35
PID 7616 wrote to memory of 7716	7616	cmd.exe	34
PID 7616 wrote to memory of 7716	7616	cmd.exe	34
PID 7616 wrote to memory of 7716	7616	cmd.exe	34
PID 7616 wrote to memory of 7716	7616	cmd.exe	34
PID 7668 wrote to memory of 7780	7668	cmd.exe	36
PID 7668 wrote to memory of 7780	7668	cmd.exe	36
PID 7668 wrote to memory of 7780	7668	cmd.exe	36
PID 7668 wrote to memory of 7780	7668	cmd.exe	36

C:\Users\Admin\AppData\Local\Temp\33.exe
"C:\Users\Admin\AppData\Local\Temp\33.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2452
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "svhosts" /tr '"C:\Users\Admin\AppData\Roaming\svhosts.exe"' & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:7616
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /f /sc onlogon /rl highest /tn "svhosts" /tr '"C:\Users\Admin\AppData\Roaming\svhosts.exe"'
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:7716
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp49BD.tmp.bat""
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:7668
- - C:\Windows\SysWOW64\timeout.exe
    timeout 3
    3⤵
    - Delays execution with timeout.exe
    PID:7724
- - C:\Users\Admin\AppData\Roaming\svhosts.exe
    "C:\Users\Admin\AppData\Roaming\svhosts.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:7780

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp49BD.tmp.bat

Filesize
151B

MD5
aa5103a83cde09a43dc8a403398063e7

SHA1
4c926a9dbd25a99085fc53b9a55176c1b82d5ac7

SHA256
6dd073bb7280564caefbb7940796e8a056667217014a17209acac1057c4421c3

SHA512
f1a0dd1b8cab66d28314647ba2d1b4e0e763f491dbe665132feb3640f002e0f00dbf1cfd80d4e3f145d6aab563f68529d52332f7f41c6ff96f5a2dca5877ac0a

Download Submit
C:\Users\Admin\AppData\Roaming\svhosts.exe

Filesize
682KB

MD5
244173193de97b401b0f5391d71a6491

SHA1
d46357579f69a5db84a6ea93e777ae6a5b136c53

SHA256
0b5e7cdc5d5290f43799f61ef80cc36d163b3eed96480f77fd805d2cc34d44c8

SHA512
57fa5541eeca2515e6220cf38cb038323dc78b3f51a7981052a947359dee71a1fbddb4480cb128d513428e977a322fdfe48394996b9a46c0bddb14bcd0cd5ee7

Download Submit
memory/2452-36-0x00000000047E0000-0x00000000048A7000-memory.dmp

Filesize
796KB

Download
memory/2452-10-0x00000000047E0000-0x00000000048A7000-memory.dmp

Filesize
796KB

Download
memory/2452-40-0x00000000047E0000-0x00000000048A7000-memory.dmp

Filesize
796KB

Download
memory/2452-5-0x00000000047E0000-0x00000000048AC000-memory.dmp

Filesize
816KB

Download
memory/2452-6-0x0000000074190000-0x000000007487E000-memory.dmp

Filesize
6.9MB

Download
memory/2452-7-0x00000000047E0000-0x00000000048A7000-memory.dmp

Filesize
796KB

Download
memory/2452-8-0x00000000047E0000-0x00000000048A7000-memory.dmp

Filesize
796KB

Download
memory/2452-38-0x00000000047E0000-0x00000000048A7000-memory.dmp

Filesize
796KB

Download
memory/2452-12-0x00000000047E0000-0x00000000048A7000-memory.dmp

Filesize
796KB

Download
memory/2452-14-0x00000000047E0000-0x00000000048A7000-memory.dmp

Filesize
796KB

Download
memory/2452-18-0x00000000047E0000-0x00000000048A7000-memory.dmp

Filesize
796KB

Download
memory/2452-16-0x00000000047E0000-0x00000000048A7000-memory.dmp

Filesize
796KB

Download
memory/2452-0-0x000000007419E000-0x000000007419F000-memory.dmp

Filesize
4KB

Download
memory/2452-22-0x00000000047E0000-0x00000000048A7000-memory.dmp

Filesize
796KB

Download
memory/2452-24-0x00000000047E0000-0x00000000048A7000-memory.dmp

Filesize
796KB

Download
memory/2452-26-0x00000000047E0000-0x00000000048A7000-memory.dmp

Filesize
796KB

Download
memory/2452-30-0x00000000047E0000-0x00000000048A7000-memory.dmp

Filesize
796KB

Download
memory/2452-28-0x00000000047E0000-0x00000000048A7000-memory.dmp

Filesize
796KB

Download
memory/2452-32-0x00000000047E0000-0x00000000048A7000-memory.dmp

Filesize
796KB

Download
memory/2452-34-0x00000000047E0000-0x00000000048A7000-memory.dmp

Filesize
796KB

Download
memory/2452-20-0x00000000047E0000-0x00000000048A7000-memory.dmp

Filesize
796KB

Download
memory/2452-3-0x0000000074190000-0x000000007487E000-memory.dmp

Filesize
6.9MB

Download
memory/2452-4-0x0000000074190000-0x000000007487E000-memory.dmp

Filesize
6.9MB

Download
memory/2452-42-0x00000000047E0000-0x00000000048A7000-memory.dmp

Filesize
796KB

Download
memory/2452-44-0x00000000047E0000-0x00000000048A7000-memory.dmp

Filesize
796KB

Download
memory/2452-46-0x00000000047E0000-0x00000000048A7000-memory.dmp

Filesize
796KB

Download
memory/2452-48-0x00000000047E0000-0x00000000048A7000-memory.dmp

Filesize
796KB

Download
memory/2452-50-0x00000000047E0000-0x00000000048A7000-memory.dmp

Filesize
796KB

Download
memory/2452-52-0x00000000047E0000-0x00000000048A7000-memory.dmp

Filesize
796KB

Download
memory/2452-54-0x00000000047E0000-0x00000000048A7000-memory.dmp

Filesize
796KB

Download
memory/2452-56-0x00000000047E0000-0x00000000048A7000-memory.dmp

Filesize
796KB

Download
memory/2452-58-0x00000000047E0000-0x00000000048A7000-memory.dmp

Filesize
796KB

Download
memory/2452-60-0x00000000047E0000-0x00000000048A7000-memory.dmp

Filesize
796KB

Download
memory/2452-64-0x00000000047E0000-0x00000000048A7000-memory.dmp

Filesize
796KB

Download
memory/2452-62-0x00000000047E0000-0x00000000048A7000-memory.dmp

Filesize
796KB

Download
memory/2452-66-0x00000000047E0000-0x00000000048A7000-memory.dmp

Filesize
796KB

Download
memory/2452-68-0x00000000047E0000-0x00000000048A7000-memory.dmp

Filesize
796KB

Download
memory/2452-70-0x00000000047E0000-0x00000000048A7000-memory.dmp

Filesize
796KB

Download
memory/2452-2715-0x0000000074190000-0x000000007487E000-memory.dmp

Filesize
6.9MB

Download
memory/2452-2-0x0000000074190000-0x000000007487E000-memory.dmp

Filesize
6.9MB

Download
memory/2452-2725-0x0000000074190000-0x000000007487E000-memory.dmp

Filesize
6.9MB

Download
memory/2452-1-0x00000000048B0000-0x000000000497E000-memory.dmp

Filesize
824KB

Download