Overview

overview

10

Static

static

10

AsyncRAT/AsyncRAT.exe

windows10-2004-x64

10

AsyncRAT/P...at.dll

windows10-2004-x64

1

AsyncRAT/P...ra.dll

windows10-2004-x64

1

AsyncRAT/P...er.dll

windows10-2004-x64

1

AsyncRAT/P...er.dll

windows10-2004-x64

1

AsyncRAT/P...er.dll

windows10-2004-x64

1

AsyncRAT/P...us.dll

windows10-2004-x64

1

AsyncRAT/P...ns.dll

windows10-2004-x64

1

AsyncRAT/P...er.dll

windows10-2004-x64

1

AsyncRAT/P...ry.dll

windows10-2004-x64

1

AsyncRAT/P...ra.dll

windows10-2004-x64

1

AsyncRAT/P...op.dll

windows10-2004-x64

1

AsyncRAT/P...le.dll

windows10-2004-x64

1

AsyncRAT/P...ry.dll

windows10-2004-x64

1

AsyncRAT/S...ub.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    283s
  • max time network
    206s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15-07-2024 07:56

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    AsyncRAT/AsyncRAT.exe

  • Size

    6.4MB

  • MD5

    97a429c4b6a2cb95ece0ddb24c3c2152

  • SHA1

    6fcc26793dd474c0c7113b3360ff29240d9a9020

  • SHA256

    06899071233d61009a64c726a4523aa13d81c2517a0486cc99ac5931837008e5

  • SHA512

    524a63f39e472bd052a258a313ff4f2005041b31f11da4774d3d97f72773f3edb40df316fa9cc2a0f51ea5d8ac404cfdd486bab6718bae60f0d860e98e533f89

  • SSDEEP

    98304:+bPmDVa3VxobFwUN5xXhAqin1MNuSZTKA0t9FFPEG6xJJ33Je2PsBpCz6Ry:+7aIXUN5htin2bk9fcPHJDE7Cz60

Score
10/10
asyncratdefaultevasionratspywarestealer

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

C2

127.0.0.1:6606

127.0.0.1:7707

127.0.0.1:8808
Mutex

V0HPM74cEASN

Attributes
  • delay

    3

  • install

    false

  • install_folder

    %AppData%

aes.plain

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat
  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Async RAT payload 2 IoCs
    rat
  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\AsyncRAT\AsyncRAT.exe
    "C:\Users\Admin\AppData\Local\Temp\AsyncRAT\AsyncRAT.exe"
    1⤵
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    PID:3636
  • C:\Windows\system32\wbem\WmiApSrv.exe
    C:\Windows\system32\wbem\WmiApSrv.exe
    1⤵
      PID:4776
    • C:\Windows\system32\taskmgr.exe
      "C:\Windows\system32\taskmgr.exe" /0
      1⤵
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:3404
    • C:\Users\Admin\Desktop\AsyncClient.exe
      "C:\Users\Admin\Desktop\AsyncClient.exe"
      1⤵
      • Modifies visibility of file extensions in Explorer
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4992
      • C:\Windows\SysWOW64\cmd.exe
        "cmd"
        2⤵
          PID:3860

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Server\AsyncRAT.exe_Url_bsozgjfh10ettuvlzzecwz2b2kv3ubbv\0.5.8.0\user.config
        Filesize

        319B

        MD5

        f71f55112253acc1ef2ecd0a61935970

        SHA1

        faa9d50656e386e460278d31b1d9247fdd947bb7

        SHA256

        d1ad588a08c8c0799d7a14509f1e0a7ae04c519102ed9d328a83fe65999e6179

        SHA512

        761b5c13e39bd4ae21d298084bbe747ae71c383fedf9a51fd5e9723a8b3b4547de459d82bac7f3f8f3bfc11cfb0528a4f1057b51996d7d046583109a53317b44

        Download Submit

      • C:\Users\Admin\AppData\Local\Server\AsyncRAT.exe_Url_bsozgjfh10ettuvlzzecwz2b2kv3ubbv\0.5.8.0\user.config
        Filesize

        1KB

        MD5

        fa1735ee067b96995c667f635bee3f2a

        SHA1

        a54e37741d2ffd369f8f918e432e9a89dfc5d0be

        SHA256

        4d609d4a705f8cfd4c0a3b959c7b32024c49664a14d7a7cfee8367fb27d073fd

        SHA512

        e6e16e1e5bc03d73c8123a8b5f2deefcaf0f4111169fd7f5f1036d24c5e68b60472700910fba6080ab5628a402a0ebc8a9f944489562f349272331d2871ddb4b

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\AsyncRAT\ServerCertificate.p12
        Filesize

        4KB

        MD5

        351d9f2636b56a0522ec967ea5005d78

        SHA1

        5399c877b689c306877d86f49da5fa003030b9e6

        SHA256

        8004770a84e762385602e1bd7f20ffc4204b1008612406e988dd65925d385e86

        SHA512

        b11e3c4a1a36cd85e4158e7b6262e564da97ec812b34e53f3e613b5b511278bd2c8e29236b416eb19e233600ecd43ccf70e6314a3871698f83ffa851acc7602b

        Download Submit

      • C:\Users\Admin\Desktop\AsyncClient.exe
        Filesize

        45KB

        MD5

        c25cc15aeccd4b5d2c58e85a7ab13002

        SHA1

        f402e8e4d362ca296586059b7dd3672917b5c7c2

        SHA256

        dba6bf3406a55aab1222de327323fa81371fb733902a07ec009589625c8c70ab

        SHA512

        c26e14728a43298294c7b32735e82424e241be9ffec4ee340e642c665d52a49092bcd39b124f34df3946a99cb890beb320b147b8f4d3503c080f5dbfda755a22

        Download Submit

      • C:\Users\Admin\Desktop\AsyncClient.exe
        Filesize

        47KB

        MD5

        8d311822b8149ecba73a7294845d832d

        SHA1

        e5eb35c7826912611568752edd6b37e729d7f83f

        SHA256

        487e0ff73811c3d30c7d801a9a2fbc241ee4d47b2644309cba06be35a63f6610

        SHA512

        6fe9503cf3edf9d249c50cc43f681e31dbc926df10519b88cc86dbbf2581d37784900b477fded24c71c3643fb817e6a713a5dfea7a8d214052a4569914eff4e2

        Download Submit

      • memory/3404-64-0x0000024DCB870000-0x0000024DCB871000-memory.dmp

        Filesize

        4KB

        Download

      • memory/3404-63-0x0000024DCB870000-0x0000024DCB871000-memory.dmp

        Filesize

        4KB

        Download

      • memory/3404-65-0x0000024DCB870000-0x0000024DCB871000-memory.dmp

        Filesize

        4KB

        Download

      • memory/3404-66-0x0000024DCB870000-0x0000024DCB871000-memory.dmp

        Filesize

        4KB

        Download

      • memory/3404-67-0x0000024DCB870000-0x0000024DCB871000-memory.dmp

        Filesize

        4KB

        Download

      • memory/3404-68-0x0000024DCB870000-0x0000024DCB871000-memory.dmp

        Filesize

        4KB

        Download

      • memory/3404-69-0x0000024DCB870000-0x0000024DCB871000-memory.dmp

        Filesize

        4KB

        Download

      • memory/3404-59-0x0000024DCB870000-0x0000024DCB871000-memory.dmp

        Filesize

        4KB

        Download

      • memory/3404-58-0x0000024DCB870000-0x0000024DCB871000-memory.dmp

        Filesize

        4KB

        Download

      • memory/3404-57-0x0000024DCB870000-0x0000024DCB871000-memory.dmp

        Filesize

        4KB

        Download

      • memory/3636-19-0x00007FFEF9080000-0x00007FFEF9B41000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/3636-4-0x00007FFEF9080000-0x00007FFEF9B41000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/3636-26-0x000002DC60490000-0x000002DC60498000-memory.dmp

        Filesize

        32KB

        Download

      • memory/3636-50-0x000002DC604A0000-0x000002DC604BA000-memory.dmp

        Filesize

        104KB

        Download

      • memory/3636-25-0x00007FFEF9080000-0x00007FFEF9B41000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/3636-24-0x00007FFEF9080000-0x00007FFEF9B41000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/3636-20-0x00007FFEF9080000-0x00007FFEF9B41000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/3636-0-0x00007FFEF9083000-0x00007FFEF9085000-memory.dmp

        Filesize

        8KB

        Download

      • memory/3636-18-0x00007FFEF9080000-0x00007FFEF9B41000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/3636-17-0x00007FFEF9083000-0x00007FFEF9085000-memory.dmp

        Filesize

        8KB

        Download

      • memory/3636-9-0x000002DC62C00000-0x000002DC62E80000-memory.dmp

        Filesize

        2.5MB

        Download

      • memory/3636-8-0x000002DC5F8A0000-0x000002DC5F8B2000-memory.dmp

        Filesize

        72KB

        Download

      • memory/3636-7-0x00007FFEF9080000-0x00007FFEF9B41000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/3636-6-0x000002DC5F890000-0x000002DC5F89A000-memory.dmp

        Filesize

        40KB

        Download

      • memory/3636-5-0x00007FFEF9080000-0x00007FFEF9B41000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/3636-29-0x000002DC65E70000-0x000002DC65F96000-memory.dmp

        Filesize

        1.1MB

        Download

      • memory/3636-3-0x000002DC5F460000-0x000002DC5F6B2000-memory.dmp

        Filesize

        2.3MB

        Download

      • memory/3636-1-0x000002DC44720000-0x000002DC44D8A000-memory.dmp

        Filesize

        6.4MB

        Download

      • memory/4992-125-0x0000000007080000-0x000000000709E000-memory.dmp

        Filesize

        120KB

        Download

      • memory/4992-119-0x0000000005840000-0x00000000058A6000-memory.dmp

        Filesize

        408KB

        Download

      • memory/4992-120-0x0000000005C70000-0x0000000005D0C000-memory.dmp

        Filesize

        624KB

        Download

      • memory/4992-121-0x0000000006600000-0x0000000006BA4000-memory.dmp

        Filesize

        5.6MB

        Download

      • memory/4992-123-0x00000000070B0000-0x0000000007126000-memory.dmp

        Filesize

        472KB

        Download

      • memory/4992-124-0x0000000007330000-0x00000000073CC000-memory.dmp

        Filesize

        624KB

        Download

      • memory/4992-118-0x0000000000E40000-0x0000000000E52000-memory.dmp

        Filesize

        72KB

        Download

      • memory/4992-126-0x00000000073D0000-0x0000000007410000-memory.dmp

        Filesize

        256KB

        Download

      • memory/4992-127-0x0000000007410000-0x000000000741A000-memory.dmp

        Filesize

        40KB

        Download

      • memory/4992-128-0x0000000001380000-0x00000000013F8000-memory.dmp

        Filesize

        480KB

        Download

      • memory/4992-129-0x00000000075A0000-0x0000000007608000-memory.dmp

        Filesize

        416KB

        Download

      • memory/4992-130-0x00000000078B0000-0x0000000007942000-memory.dmp

        Filesize

        584KB

        Download

      • memory/4992-131-0x0000000007950000-0x00000000079E2000-memory.dmp

        Filesize

        584KB

        Download