asyncrat | a07479025c1100c57c7240d438305e85db5ea96d4d31f7103c3f27f044e19bd3

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
13-07-2024 11:25

Target

a07479025c1100c57c7240d438305e85db5ea96d4d31f7103c3f27f044e19bd3.exe
Size

187KB
MD5

114cfb0a1a06cb6c621edfbe35c6de7d
SHA1

c8f44299a96807e741507423fae47e46afa8d434
SHA256

a07479025c1100c57c7240d438305e85db5ea96d4d31f7103c3f27f044e19bd3
SHA512

4540a0a25cb29a6aa7d296ca9a0ff2a19c28177cea2623e57b32ec22b356a4dd7744e5c95852dd5b83c9c1390664a6dbf2c9db3789b38c60e885e899ea12fe61
SSDEEP

3072:a4BXIEcFjraWaHC9dZa6y/WKiHCDF2s87j34Ih0TiRurbPaxR:hXKcXi9dZa6kWKrhKj/h0Tsuvc

Score

10^/10

Family

asyncrat

Version

Venom RAT + HVNC + Stealer + Grabber v6.0.3

Botnet

Default

64.112.85.3:4449

Mutex

ufaaryvntrlyhwcwq

Attributes

aes.plain

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1972 set thread context of 3136	1972	a07479025c1100c57c7240d438305e85db5ea96d4d31f7103c3f27f044e19bd3.exe	84

Suspicious behavior: EnumeratesProcesses 8 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3136	aspnet_regbrowsers.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3136	aspnet_regbrowsers.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1972 wrote to memory of 3136	1972	a07479025c1100c57c7240d438305e85db5ea96d4d31f7103c3f27f044e19bd3.exe	84
PID 1972 wrote to memory of 3136	1972	a07479025c1100c57c7240d438305e85db5ea96d4d31f7103c3f27f044e19bd3.exe	84
PID 1972 wrote to memory of 3136	1972	a07479025c1100c57c7240d438305e85db5ea96d4d31f7103c3f27f044e19bd3.exe	84
PID 1972 wrote to memory of 3136	1972	a07479025c1100c57c7240d438305e85db5ea96d4d31f7103c3f27f044e19bd3.exe	84
PID 1972 wrote to memory of 3136	1972	a07479025c1100c57c7240d438305e85db5ea96d4d31f7103c3f27f044e19bd3.exe	84
PID 1972 wrote to memory of 3136	1972	a07479025c1100c57c7240d438305e85db5ea96d4d31f7103c3f27f044e19bd3.exe	84
PID 1972 wrote to memory of 3136	1972	a07479025c1100c57c7240d438305e85db5ea96d4d31f7103c3f27f044e19bd3.exe	84
PID 1972 wrote to memory of 3136	1972	a07479025c1100c57c7240d438305e85db5ea96d4d31f7103c3f27f044e19bd3.exe	84

memory/1972-0-0x0000000000290000-0x00000000002C4000-memory.dmp

Filesize
208KB

Download
memory/1972-1-0x00007FFFAA693000-0x00007FFFAA695000-memory.dmp

Filesize
8KB

Download
memory/3136-2-0x0000000008980000-0x000000000899F000-memory.dmp

Filesize
124KB

Download
memory/3136-4-0x000000007507E000-0x000000007507F000-memory.dmp

Filesize
4KB

Download
memory/3136-5-0x0000000008980000-0x0000000008998000-memory.dmp

Filesize
96KB

Download
memory/3136-6-0x0000000005150000-0x00000000056F4000-memory.dmp

Filesize
5.6MB

Download
memory/3136-8-0x0000000075070000-0x0000000075820000-memory.dmp

Filesize
7.7MB

Download
memory/3136-9-0x0000000004F40000-0x0000000004FD2000-memory.dmp

Filesize
584KB

Download
memory/3136-10-0x0000000075070000-0x0000000075820000-memory.dmp

Filesize
7.7MB

Download
memory/3136-11-0x0000000004EB0000-0x0000000004EBA000-memory.dmp

Filesize
40KB

Download
memory/3136-12-0x000000007507E000-0x000000007507F000-memory.dmp

Filesize
4KB

Download
memory/3136-13-0x0000000075070000-0x0000000075820000-memory.dmp

Filesize
7.7MB

Download
memory/3136-14-0x0000000075070000-0x0000000075820000-memory.dmp

Filesize
7.7MB

Download