asyncrat | 25d8056c1359d49a58ee002ee700f2258250ed896024446f6513a7ec1c078cbc

Resubmissions

13/07/2024, 00:31

240713-avdhfaxflm 10

13/07/2024, 00:14

240713-ajcrrszbpa 10

Analysis

max time kernel
147s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20240709-en
resource tags

arch:x64arch:x86image:win11-20240709-enlocale:en-usos:windows11-21h2-x64system
submitted
13/07/2024, 00:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

aitstatic.exe
Size

91KB
MD5

e6c995a0e7501ec3225445715167d8dc
SHA1

79b02d623f87d34eb1c2377951f7175aca20d13b
SHA256

411fff49f678ead45849d655d50084f667bef58a12f298b86697f2cf0fedbef6
SHA512

617aac88b90264f0f8b3f5659f9c987291bd872f84289eec2d1e727275d54e973c4cee8f3e7b3c5089eeff620db7c728e061ef58f31606ecddffd81d37936868
SSDEEP

1536:hM5PfX2tIAHgjWwKVF+DF9J4IstZsEaLBosLNkkFD74ptKq6:hM1fm/gjWw8+DTJ4IstgL6uNkkFD74pe

Score

10^/10

asyncrat t rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

20.199.8.16:1726

Mutex

31FGTEWnaxDE

Attributes

delay
3
install
false
install_file
SeacrhIndexer
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1572 set thread context of 4704	1572	aitstatic.exe	78
PID 2888 set thread context of 1276	2888	aitstatic.exe	85

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4704	RegAsm.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1572 wrote to memory of 4704	1572	aitstatic.exe	78
PID 1572 wrote to memory of 4704	1572	aitstatic.exe	78
PID 1572 wrote to memory of 4704	1572	aitstatic.exe	78
PID 1572 wrote to memory of 4704	1572	aitstatic.exe	78
PID 1572 wrote to memory of 4704	1572	aitstatic.exe	78
PID 1572 wrote to memory of 4704	1572	aitstatic.exe	78
PID 1572 wrote to memory of 4704	1572	aitstatic.exe	78
PID 1572 wrote to memory of 4704	1572	aitstatic.exe	78
PID 2888 wrote to memory of 1276	2888	aitstatic.exe	85
PID 2888 wrote to memory of 1276	2888	aitstatic.exe	85
PID 2888 wrote to memory of 1276	2888	aitstatic.exe	85
PID 2888 wrote to memory of 1276	2888	aitstatic.exe	85
PID 2888 wrote to memory of 1276	2888	aitstatic.exe	85
PID 2888 wrote to memory of 1276	2888	aitstatic.exe	85
PID 2888 wrote to memory of 1276	2888	aitstatic.exe	85
PID 2888 wrote to memory of 1276	2888	aitstatic.exe	85

C:\Users\Admin\AppData\Local\Temp\aitstatic.exe
"C:\Users\Admin\AppData\Local\Temp\aitstatic.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1572
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  #system32
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4704

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3852

C:\Users\Admin\AppData\Local\Temp\aitstatic.exe
"C:\Users\Admin\AppData\Local\Temp\aitstatic.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2888
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  #system32
  2⤵
  PID:1276

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\aitstatic.exe.log

Filesize
226B

MD5
1294de804ea5400409324a82fdc7ec59

SHA1
9a39506bc6cadf99c1f2129265b610c69d1518f7

SHA256
494398ec6108c68573c366c96aae23d35e7f9bdbb440a4aab96e86fcad5871d0

SHA512
033905cc5b4d0c0ffab2138da47e3223765146fa751c9f84b199284b653a04874c32a23aae577d2e06ce6c6b34fec62331b5fc928e3baf68dc53263ecdfa10c1

Download Submit
memory/1572-4-0x0000000074A40000-0x00000000751F1000-memory.dmp

Filesize
7.7MB

Download
memory/1572-0-0x0000000074A4E000-0x0000000074A4F000-memory.dmp

Filesize
4KB

Download
memory/1572-1-0x0000000000CB0000-0x0000000000CCE000-memory.dmp

Filesize
120KB

Download
memory/1572-12-0x0000000074A40000-0x00000000751F1000-memory.dmp

Filesize
7.7MB

Download
memory/4704-2-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/4704-5-0x0000000074A40000-0x00000000751F1000-memory.dmp

Filesize
7.7MB

Download
memory/4704-6-0x0000000074A40000-0x00000000751F1000-memory.dmp

Filesize
7.7MB

Download
memory/4704-7-0x0000000005A10000-0x0000000005AAC000-memory.dmp

Filesize
624KB

Download
memory/4704-8-0x0000000006060000-0x0000000006606000-memory.dmp

Filesize
5.6MB

Download
memory/4704-9-0x0000000005B20000-0x0000000005B86000-memory.dmp

Filesize
408KB

Download
memory/4704-14-0x0000000074A40000-0x00000000751F1000-memory.dmp

Filesize
7.7MB

Download
memory/4704-15-0x0000000074A40000-0x00000000751F1000-memory.dmp

Filesize
7.7MB

Download