asyncrat | c9866af2cb943cbe5f4d971518d30ec93e686e8d8e31345fe0e923c0ec121603

Analysis

max time kernel
146s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
11/07/2024, 02:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c9866af2cb943cbe5f4d971518d30ec93e686e8d8e31345fe0e923c0ec121603.exe
Size

2.6MB
MD5

dd007b6a486b6336cea0c9c2dfd307ca
SHA1

f9d1987deb32ae3b244ba8b281d3c75ea149979d
SHA256

c9866af2cb943cbe5f4d971518d30ec93e686e8d8e31345fe0e923c0ec121603
SHA512

210e997ec4e5b8c64539b19052e694fea48415f1100d0f1d2dae418f5a6e7ec032f9e328dbb7af6b299614b402b9ebc6720a256a3c058b177a830b78783a7dd4
SSDEEP

49152:CHV9arGDFfPHRi63T+reNM7I2BnJGQ2sqmsSql2ESrB6jPF:CHkGNPxT6r08p32m9G7SmF

Score

10^/10

asyncrat zzz6 persistence rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

ZZZ6

andresarbosa2003.con-ip.com:4040

Mutex

AsyncMutex_6SI8OkPnk

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Neouopdwf = "C:\\Users\\Admin\\AppData\\Roaming\\Neouopdwf.exe"	c9866af2cb943cbe5f4d971518d30ec93e686e8d8e31345fe0e923c0ec121603.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 184 set thread context of 4912	184	c9866af2cb943cbe5f4d971518d30ec93e686e8d8e31345fe0e923c0ec121603.exe	90

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	184	c9866af2cb943cbe5f4d971518d30ec93e686e8d8e31345fe0e923c0ec121603.exe
Token: SeDebugPrivilege	184	c9866af2cb943cbe5f4d971518d30ec93e686e8d8e31345fe0e923c0ec121603.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 184 wrote to memory of 4912	184	c9866af2cb943cbe5f4d971518d30ec93e686e8d8e31345fe0e923c0ec121603.exe	90
PID 184 wrote to memory of 4912	184	c9866af2cb943cbe5f4d971518d30ec93e686e8d8e31345fe0e923c0ec121603.exe	90
PID 184 wrote to memory of 4912	184	c9866af2cb943cbe5f4d971518d30ec93e686e8d8e31345fe0e923c0ec121603.exe	90
PID 184 wrote to memory of 4912	184	c9866af2cb943cbe5f4d971518d30ec93e686e8d8e31345fe0e923c0ec121603.exe	90
PID 184 wrote to memory of 4912	184	c9866af2cb943cbe5f4d971518d30ec93e686e8d8e31345fe0e923c0ec121603.exe	90
PID 184 wrote to memory of 4912	184	c9866af2cb943cbe5f4d971518d30ec93e686e8d8e31345fe0e923c0ec121603.exe	90
PID 184 wrote to memory of 4912	184	c9866af2cb943cbe5f4d971518d30ec93e686e8d8e31345fe0e923c0ec121603.exe	90
PID 184 wrote to memory of 4912	184	c9866af2cb943cbe5f4d971518d30ec93e686e8d8e31345fe0e923c0ec121603.exe	90

C:\Users\Admin\AppData\Local\Temp\c9866af2cb943cbe5f4d971518d30ec93e686e8d8e31345fe0e923c0ec121603.exe
"C:\Users\Admin\AppData\Local\Temp\c9866af2cb943cbe5f4d971518d30ec93e686e8d8e31345fe0e923c0ec121603.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:184
- C:\Users\Admin\AppData\Local\Temp\c9866af2cb943cbe5f4d971518d30ec93e686e8d8e31345fe0e923c0ec121603.exe
  "C:\Users\Admin\AppData\Local\Temp\c9866af2cb943cbe5f4d971518d30ec93e686e8d8e31345fe0e923c0ec121603.exe"
  2⤵
  PID:4912

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\c9866af2cb943cbe5f4d971518d30ec93e686e8d8e31345fe0e923c0ec121603.exe.log

Filesize
805B

MD5
58a9108e39c2ea50e65c23be3a9407cf

SHA1
fb21f7b9330aa1a77080a3243b81b49035102d7b

SHA256
6049be83020702896a539b5c8c13270add224d7b91b3ee0bebc328791b74a84b

SHA512
93804ee8a4560503e47c07f5fa4a959e23355a01aba406c103d339debc9b2b1d20a345cdbb8d8069dac97b9151f228cf559ac3dde1500e3484fba1a4126842bf

Download Submit
memory/184-0-0x00000000752AE000-0x00000000752AF000-memory.dmp

Filesize
4KB

Download
memory/184-1-0x0000000000B30000-0x0000000000DD4000-memory.dmp

Filesize
2.6MB

Download
memory/184-2-0x00000000058D0000-0x0000000005AF2000-memory.dmp

Filesize
2.1MB

Download
memory/184-3-0x00000000752A0000-0x0000000075A50000-memory.dmp

Filesize
7.7MB

Download
memory/184-4-0x00000000060A0000-0x0000000006644000-memory.dmp

Filesize
5.6MB

Download
memory/184-5-0x0000000005BF0000-0x0000000005C82000-memory.dmp

Filesize
584KB

Download
memory/184-6-0x00000000058D0000-0x0000000005AEC000-memory.dmp

Filesize
2.1MB

Download
memory/184-7-0x00000000058D0000-0x0000000005AEC000-memory.dmp

Filesize
2.1MB

Download
memory/184-33-0x00000000058D0000-0x0000000005AEC000-memory.dmp

Filesize
2.1MB

Download
memory/184-31-0x00000000058D0000-0x0000000005AEC000-memory.dmp

Filesize
2.1MB

Download
memory/184-29-0x00000000058D0000-0x0000000005AEC000-memory.dmp

Filesize
2.1MB

Download
memory/184-27-0x00000000058D0000-0x0000000005AEC000-memory.dmp

Filesize
2.1MB

Download
memory/184-25-0x00000000058D0000-0x0000000005AEC000-memory.dmp

Filesize
2.1MB

Download
memory/184-23-0x00000000058D0000-0x0000000005AEC000-memory.dmp

Filesize
2.1MB

Download
memory/184-21-0x00000000058D0000-0x0000000005AEC000-memory.dmp

Filesize
2.1MB

Download
memory/184-19-0x00000000058D0000-0x0000000005AEC000-memory.dmp

Filesize
2.1MB

Download
memory/184-17-0x00000000058D0000-0x0000000005AEC000-memory.dmp

Filesize
2.1MB

Download
memory/184-15-0x00000000058D0000-0x0000000005AEC000-memory.dmp

Filesize
2.1MB

Download
memory/184-13-0x00000000058D0000-0x0000000005AEC000-memory.dmp

Filesize
2.1MB

Download
memory/184-11-0x00000000058D0000-0x0000000005AEC000-memory.dmp

Filesize
2.1MB

Download
memory/184-9-0x00000000058D0000-0x0000000005AEC000-memory.dmp

Filesize
2.1MB

Download
memory/184-65-0x00000000058D0000-0x0000000005AEC000-memory.dmp

Filesize
2.1MB

Download
memory/184-69-0x00000000058D0000-0x0000000005AEC000-memory.dmp

Filesize
2.1MB

Download
memory/184-67-0x00000000058D0000-0x0000000005AEC000-memory.dmp

Filesize
2.1MB

Download
memory/184-63-0x00000000058D0000-0x0000000005AEC000-memory.dmp

Filesize
2.1MB

Download
memory/184-61-0x00000000058D0000-0x0000000005AEC000-memory.dmp

Filesize
2.1MB

Download
memory/184-59-0x00000000058D0000-0x0000000005AEC000-memory.dmp

Filesize
2.1MB

Download
memory/184-57-0x00000000058D0000-0x0000000005AEC000-memory.dmp

Filesize
2.1MB

Download
memory/184-55-0x00000000058D0000-0x0000000005AEC000-memory.dmp

Filesize
2.1MB

Download
memory/184-53-0x00000000058D0000-0x0000000005AEC000-memory.dmp

Filesize
2.1MB

Download
memory/184-51-0x00000000058D0000-0x0000000005AEC000-memory.dmp

Filesize
2.1MB

Download
memory/184-49-0x00000000058D0000-0x0000000005AEC000-memory.dmp

Filesize
2.1MB

Download
memory/184-48-0x00000000058D0000-0x0000000005AEC000-memory.dmp

Filesize
2.1MB

Download
memory/184-45-0x00000000058D0000-0x0000000005AEC000-memory.dmp

Filesize
2.1MB

Download
memory/184-43-0x00000000058D0000-0x0000000005AEC000-memory.dmp

Filesize
2.1MB

Download
memory/184-41-0x00000000058D0000-0x0000000005AEC000-memory.dmp

Filesize
2.1MB

Download
memory/184-39-0x00000000058D0000-0x0000000005AEC000-memory.dmp

Filesize
2.1MB

Download
memory/184-37-0x00000000058D0000-0x0000000005AEC000-memory.dmp

Filesize
2.1MB

Download
memory/184-35-0x00000000058D0000-0x0000000005AEC000-memory.dmp

Filesize
2.1MB

Download
memory/184-4892-0x00000000752A0000-0x0000000075A50000-memory.dmp

Filesize
7.7MB

Download
memory/184-4894-0x0000000005DB0000-0x0000000005DFC000-memory.dmp

Filesize
304KB

Download
memory/184-4893-0x0000000005D50000-0x0000000005DAC000-memory.dmp

Filesize
368KB

Download
memory/184-4895-0x00000000752AE000-0x00000000752AF000-memory.dmp

Filesize
4KB

Download
memory/184-4896-0x00000000752A0000-0x0000000075A50000-memory.dmp

Filesize
7.7MB

Download
memory/184-4897-0x00000000011D0000-0x0000000001224000-memory.dmp

Filesize
336KB

Download
memory/184-4903-0x00000000752A0000-0x0000000075A50000-memory.dmp

Filesize
7.7MB

Download
memory/4912-4904-0x00000000752A0000-0x0000000075A50000-memory.dmp

Filesize
7.7MB

Download
memory/4912-4902-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/4912-4905-0x00000000752A0000-0x0000000075A50000-memory.dmp

Filesize
7.7MB

Download
memory/4912-4906-0x00000000752A0000-0x0000000075A50000-memory.dmp

Filesize
7.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads