asyncrat | 9b41bf8f85747590a77dcb1f08634cc250eec349b6b3f25d640fb4cf0c69713f

Analysis

max time kernel
144s
max time network
147s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
14-07-2024 11:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4589e8f916643c5d21b413d5ddaa0105_JaffaCakes118.exe
Size

417KB
MD5

4589e8f916643c5d21b413d5ddaa0105
SHA1

9632ee7d485059e9fe8bbc70ba55a7b45427d530
SHA256

9b41bf8f85747590a77dcb1f08634cc250eec349b6b3f25d640fb4cf0c69713f
SHA512

2b1331432a5af40320664572b3dc86f194c4ab8e1bb010389ddab4871d8e690ac4eadd0f421bf5e6974862a75ea627c502c4a5c14ee4e727e1567574cfecc34f
SSDEEP

3072:pwAM4NjvB4vMdq5hs5Uz/nVu4wLT+4aHBgMwYX7aVKiEgjeSTsxCatgfVapBXt:pc4vq5hs5I/nc4w0oVKiEgKaratgMZ

Score

10^/10

asyncrat 1 persistence rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

185.157.160.136:1973

Mutex

df4Rtg34dFjwr7ujp3

Attributes

delay
38
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\jm = "C:\\Users\\Admin\\AppData\\Roaming\\jk\\jp.exe"	4589e8f916643c5d21b413d5ddaa0105_JaffaCakes118.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2360 set thread context of 3028	2360	4589e8f916643c5d21b413d5ddaa0105_JaffaCakes118.exe	32

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2360	4589e8f916643c5d21b413d5ddaa0105_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 2360 wrote to memory of 3024	2360	4589e8f916643c5d21b413d5ddaa0105_JaffaCakes118.exe	31
PID 2360 wrote to memory of 3024	2360	4589e8f916643c5d21b413d5ddaa0105_JaffaCakes118.exe	31
PID 2360 wrote to memory of 3024	2360	4589e8f916643c5d21b413d5ddaa0105_JaffaCakes118.exe	31
PID 2360 wrote to memory of 3024	2360	4589e8f916643c5d21b413d5ddaa0105_JaffaCakes118.exe	31
PID 2360 wrote to memory of 3024	2360	4589e8f916643c5d21b413d5ddaa0105_JaffaCakes118.exe	31
PID 2360 wrote to memory of 3024	2360	4589e8f916643c5d21b413d5ddaa0105_JaffaCakes118.exe	31
PID 2360 wrote to memory of 3024	2360	4589e8f916643c5d21b413d5ddaa0105_JaffaCakes118.exe	31
PID 2360 wrote to memory of 3028	2360	4589e8f916643c5d21b413d5ddaa0105_JaffaCakes118.exe	32
PID 2360 wrote to memory of 3028	2360	4589e8f916643c5d21b413d5ddaa0105_JaffaCakes118.exe	32
PID 2360 wrote to memory of 3028	2360	4589e8f916643c5d21b413d5ddaa0105_JaffaCakes118.exe	32
PID 2360 wrote to memory of 3028	2360	4589e8f916643c5d21b413d5ddaa0105_JaffaCakes118.exe	32
PID 2360 wrote to memory of 3028	2360	4589e8f916643c5d21b413d5ddaa0105_JaffaCakes118.exe	32
PID 2360 wrote to memory of 3028	2360	4589e8f916643c5d21b413d5ddaa0105_JaffaCakes118.exe	32
PID 2360 wrote to memory of 3028	2360	4589e8f916643c5d21b413d5ddaa0105_JaffaCakes118.exe	32
PID 2360 wrote to memory of 3028	2360	4589e8f916643c5d21b413d5ddaa0105_JaffaCakes118.exe	32
PID 2360 wrote to memory of 3028	2360	4589e8f916643c5d21b413d5ddaa0105_JaffaCakes118.exe	32
PID 2360 wrote to memory of 3028	2360	4589e8f916643c5d21b413d5ddaa0105_JaffaCakes118.exe	32
PID 2360 wrote to memory of 3028	2360	4589e8f916643c5d21b413d5ddaa0105_JaffaCakes118.exe	32
PID 2360 wrote to memory of 3028	2360	4589e8f916643c5d21b413d5ddaa0105_JaffaCakes118.exe	32

C:\Users\Admin\AppData\Local\Temp\4589e8f916643c5d21b413d5ddaa0105_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\4589e8f916643c5d21b413d5ddaa0105_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2360
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  PID:3024
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  PID:3028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3028-8-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/3028-6-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/3028-4-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/3028-9-0x0000000074C7E000-0x0000000074C7F000-memory.dmp

Filesize
4KB

Download
memory/3028-10-0x0000000074C70000-0x000000007535E000-memory.dmp

Filesize
6.9MB

Download
memory/3028-11-0x0000000074C70000-0x000000007535E000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads