asyncrat | 2aff770fe1841fccf58566e3fd9548ce18d13cf7d74cda8b938bafa90bfa23ea

Analysis

max time kernel
127s
max time network
137s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
22-07-2024 10:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SOA_SEPT.exe
Size

492KB
MD5

59921d02db3b8cdb6a293cfc4ba0acf1
SHA1

ba2db3254521f8b0840c04606433d88ec431e030
SHA256

8d87c0f9ca64bba08ba818b6910ca84623ac53931aa0f00d0b85367990e0c11d
SHA512

6ec6bd6fcf06ad8606899424d9e9b00caa9c6810b8dd40a185ea29631b1804c4847551610e151cb87c9c1bd09a9f05c7ea15fae402cae2c5eb81cad17291d404
SSDEEP

12288:FI5I046Mnq0UnsO5lJkKzUvoPUu9Y/Ba7yt8+BnLtMLwadEzb:gUBa7T+BnLtMLXd

Score

10^/10

asyncrat default rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

Default

45.137.22.115:14496

Mutex

AsyncMutex_6SI8OkPnk

Attributes

delay
20
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2260 set thread context of 2920	2260	SOA_SEPT.exe	30

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2260	SOA_SEPT.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2260 wrote to memory of 2920	2260	SOA_SEPT.exe	30
PID 2260 wrote to memory of 2920	2260	SOA_SEPT.exe	30
PID 2260 wrote to memory of 2920	2260	SOA_SEPT.exe	30
PID 2260 wrote to memory of 2920	2260	SOA_SEPT.exe	30
PID 2260 wrote to memory of 2920	2260	SOA_SEPT.exe	30
PID 2260 wrote to memory of 2920	2260	SOA_SEPT.exe	30
PID 2260 wrote to memory of 2920	2260	SOA_SEPT.exe	30
PID 2260 wrote to memory of 2920	2260	SOA_SEPT.exe	30
PID 2260 wrote to memory of 2920	2260	SOA_SEPT.exe	30
PID 2260 wrote to memory of 2920	2260	SOA_SEPT.exe	30
PID 2260 wrote to memory of 2920	2260	SOA_SEPT.exe	30
PID 2260 wrote to memory of 2920	2260	SOA_SEPT.exe	30

C:\Users\Admin\AppData\Local\Temp\SOA_SEPT.exe
"C:\Users\Admin\AppData\Local\Temp\SOA_SEPT.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2260
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "{path}"
  2⤵
  PID:2920

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2260-0-0x000000007406E000-0x000000007406F000-memory.dmp

Filesize
4KB

Download
memory/2260-1-0x0000000000C90000-0x0000000000D12000-memory.dmp

Filesize
520KB

Download
memory/2260-2-0x0000000074060000-0x000000007474E000-memory.dmp

Filesize
6.9MB

Download
memory/2260-3-0x0000000000420000-0x0000000000434000-memory.dmp

Filesize
80KB

Download
memory/2260-4-0x000000007406E000-0x000000007406F000-memory.dmp

Filesize
4KB

Download
memory/2260-5-0x0000000074060000-0x000000007474E000-memory.dmp

Filesize
6.9MB

Download
memory/2260-6-0x0000000004D40000-0x0000000004DA4000-memory.dmp

Filesize
400KB

Download
memory/2260-7-0x0000000000920000-0x0000000000932000-memory.dmp

Filesize
72KB

Download
memory/2260-19-0x0000000074060000-0x000000007474E000-memory.dmp

Filesize
6.9MB

Download
memory/2920-14-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2920-9-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2920-12-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2920-11-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2920-10-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2920-16-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2920-18-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2920-8-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2920-20-0x0000000074060000-0x000000007474E000-memory.dmp

Filesize
6.9MB

Download
memory/2920-21-0x0000000074060000-0x000000007474E000-memory.dmp

Filesize
6.9MB

Download
memory/2920-22-0x0000000074060000-0x000000007474E000-memory.dmp

Filesize
6.9MB

Download
memory/2920-23-0x0000000074060000-0x000000007474E000-memory.dmp

Filesize
6.9MB

Download