asyncrat | a8c77f963eaac332a19464a164c89a6420b4896363a06e1a61e242b69e2bff0e

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
11-07-2024 12:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Client.exe
Size

48KB
MD5

f955dfcf0c69e5d30bb5d5cd3b6939fe
SHA1

e1e50a7d16a0555babdd206550369961b6459ef7
SHA256

a8c77f963eaac332a19464a164c89a6420b4896363a06e1a61e242b69e2bff0e
SHA512

46b083265b96e668b4f19bd11de9401e800e193a8c55fd6081ae0d3c2e75036e0aa935bd4245d754196ed5e6861f938d8f9428ffef7170f0298fec7b0a3b68e0
SSDEEP

768:CH1fhILbkJt+RiUtelDSN+iV08YbygeRGOUvEgK/J4ZVc6KN:CH1NvUtKDs4zb1yGFnkJ4ZVclN

Score

10^/10

asyncrat default rat

Malware Config

Extracted

Family

asyncrat

Version

1.0.7

Botnet

Default

127.0.0.1:8848

https://ooo.fluffiflower.xyz/:8848

ooo.fluffiflower.xyz:8848

2.132.191.110:8848

0.0.0.0:8848

Mutex

DcRatMutex_qwqdanchun

Attributes

delay
1
install
false
install_file
Explorer.exe
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Drops file in System32 directory 11 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.chk	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.jcp	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.jtx	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSStmp.log	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSSres00002.jrs	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.dat	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.log	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSSres00001.jrs	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.chk	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.jfm	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.dat	svchost.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000_Classes\Local Settings	mspaint.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
3856	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1376	mspaint.exe
1376	mspaint.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1376	mspaint.exe
2416	OpenWith.exe

C:\Users\Admin\AppData\Local\Temp\Client.exe
"C:\Users\Admin\AppData\Local\Temp\Client.exe"
1⤵
PID:2524

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1652

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Downloads\ResetSync.jpg" /ForceBootstrapPaint3D
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1376

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s DsSvc
1⤵
- Drops file in System32 directory
PID:4252

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:2416

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\SearchClear.cmd" "
1⤵
PID:752

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\SearchClear.cmd" "
1⤵
PID:3804

C:\Windows\System32\NOTEPAD.EXE
"C:\Windows\System32\NOTEPAD.EXE" C:\Users\Admin\Downloads\SearchClear.cmd
1⤵
- Opens file in notepad (likely ransom note)
PID:3856

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2524-0-0x0000000000960000-0x0000000000972000-memory.dmp

Filesize
72KB

Download
memory/2524-1-0x00007FFA55E33000-0x00007FFA55E35000-memory.dmp

Filesize
8KB

Download
memory/2524-2-0x00007FFA55E30000-0x00007FFA568F1000-memory.dmp

Filesize
10.8MB

Download
memory/2524-3-0x00007FFA55E30000-0x00007FFA568F1000-memory.dmp

Filesize
10.8MB

Download
memory/4252-4-0x000001DCF8D70000-0x000001DCF8D80000-memory.dmp

Filesize
64KB

Download
memory/4252-8-0x000001DCF8DB0000-0x000001DCF8DC0000-memory.dmp

Filesize
64KB

Download
memory/4252-15-0x000001DCFDA00000-0x000001DCFDA01000-memory.dmp

Filesize
4KB

Download
memory/4252-17-0x000001DCFDA80000-0x000001DCFDA81000-memory.dmp

Filesize
4KB

Download
memory/4252-19-0x000001DCFDA80000-0x000001DCFDA81000-memory.dmp

Filesize
4KB

Download
memory/4252-20-0x000001DCFDB10000-0x000001DCFDB11000-memory.dmp

Filesize
4KB

Download
memory/4252-21-0x000001DCFDB10000-0x000001DCFDB11000-memory.dmp

Filesize
4KB

Download
memory/4252-22-0x000001DCFDB20000-0x000001DCFDB21000-memory.dmp

Filesize
4KB

Download
memory/4252-23-0x000001DCFDB20000-0x000001DCFDB21000-memory.dmp

Filesize
4KB

Download