asyncrat | 758da04589faf3a8aedeae4f9e26c90c4a7530f5e8368a368efe8ef792f167d9

Analysis

max time kernel
56s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
06-08-2024 11:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

BoratRat_Cracked.exe
Size

20.0MB
MD5

c68cf8d1c438a9c59878deb36d17e197
SHA1

fc6158fbab2762f1da42c7a486fd04bd8b547f05
SHA256

9e7e71f470c44d253d72a78f1ccdde34b4a0bff6242d86006cd6e364b6bbf79c
SHA512

67bad918bf1b4d1d1461ae949c7ef9e953fe447df46e7d32484914ef74cc658d8746b5bb2fb354f8c07fb961d9e4b395e7c2dab4e49e6b26d0af51aad5b27ccf
SSDEEP

393216:nm2XTCP+Zw6NLIsFfskh1BmXGnfBd+Ly:nmmTCP+Zlnk0rmkBYLy

Score

10^/10

asyncrat rat

Malware Config

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2816	BoratRat_Cracked.exe
2816	BoratRat_Cracked.exe
2816	BoratRat_Cracked.exe
2816	BoratRat_Cracked.exe
2816	BoratRat_Cracked.exe
2816	BoratRat_Cracked.exe
2816	BoratRat_Cracked.exe
2816	BoratRat_Cracked.exe
2816	BoratRat_Cracked.exe
2816	BoratRat_Cracked.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2816	BoratRat_Cracked.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2816	BoratRat_Cracked.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2816	BoratRat_Cracked.exe
2816	BoratRat_Cracked.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
2816	BoratRat_Cracked.exe

C:\Users\Admin\AppData\Local\Temp\BoratRat_Cracked.exe
"C:\Users\Admin\AppData\Local\Temp\BoratRat_Cracked.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2816

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:2744

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Server\BoratRat_Cracked.exe_Url_wi0iqtchtc4kqw3og201wkj2ust21obp\1.0.7.0\user.config

Filesize
309B

MD5
0c6e4f57ebaba0cc4acfc8bb65c589f8

SHA1
8c021c2371b87f2570d226b419c64c3102b8d434

SHA256
a9539ba4eae9035b2ff715f0e755aa772b499d72ccab23af2bf5a2dc2bcfa41c

SHA512
c6b877ff887d029e29bf35f53006b8c84704f73b74c616bf97696d06c6ef237dff85269bdf8dfb432457b031dd52410e2b883fd86c3f54b09f0a072a689a08c0

Download Submit
C:\Users\Admin\AppData\Local\Server\BoratRat_Cracked.exe_Url_wi0iqtchtc4kqw3og201wkj2ust21obp\1.0.7.0\user.config

Filesize
422B

MD5
389aafca07a441b28d6e8997e55938d8

SHA1
b20636d21fc2643649a497b4ccc29e566b980e75

SHA256
f1b0349f3c2a25efb0b7ffc9a09c3ed6d9c684b9ee592bba2fbe6b4b11263fa8

SHA512
e0cc2fc0975264159f44ba15c4291bc6843e6ac94425da843a431630af7c1eabb4f739aedb2816c82b09925385d5515a57cf5ef64b15e6415557eaa4220c818d

Download Submit
memory/2816-0-0x000007FEF5703000-0x000007FEF5704000-memory.dmp

Filesize
4KB

Download
memory/2816-1-0x0000000000010000-0x0000000001416000-memory.dmp

Filesize
20.0MB

Download
memory/2816-2-0x000007FEF5700000-0x000007FEF60EC000-memory.dmp

Filesize
9.9MB

Download
memory/2816-3-0x000007FEF5700000-0x000007FEF60EC000-memory.dmp

Filesize
9.9MB

Download
memory/2816-4-0x000007FEF5700000-0x000007FEF60EC000-memory.dmp

Filesize
9.9MB

Download
memory/2816-14-0x000007FEF5703000-0x000007FEF5704000-memory.dmp

Filesize
4KB

Download
memory/2816-15-0x000007FEF5700000-0x000007FEF60EC000-memory.dmp

Filesize
9.9MB

Download
memory/2816-16-0x000007FEF5700000-0x000007FEF60EC000-memory.dmp

Filesize
9.9MB

Download
memory/2816-17-0x000007FEF5700000-0x000007FEF60EC000-memory.dmp

Filesize
9.9MB

Download