asyncrat | af2980102594b1fcb1db78bdf5e63c3e98b5de48a0cedba2dc698778db133af4

Analysis

max time kernel
21s
max time network
24s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
13-08-2024 01:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

paid windows safety client.exe
Size

74KB
MD5

8474fc112a36e9ea98649c1b144a77d9
SHA1

358646e91c619abf3b113e2a204400df1e9ff640
SHA256

af2980102594b1fcb1db78bdf5e63c3e98b5de48a0cedba2dc698778db133af4
SHA512

cd1839cf28ce9c25733b7e08d6c05fd4c708d14b500cadce7c15882167f688da2f9a9ef18bd283671cb5a2463fdc5de8f652951b9f98b8debdf6d5e3e8fcd396
SSDEEP

1536:wU6Acx2l/Cx2PMVPGNeoM3qjnlI0JH1bQ/8JCUPRQzcGrVclN:wUjcx2Bq2PMV+9fxJH1bQEXpQfhY

Score

10^/10

asyncrat default rat

Malware Config

Extracted

Family

asyncrat

Version

Venom RAT + HVNC + Stealer + Grabber v6.0.3

Botnet

Default

127.0.0.1:4449

127.0.0.1:8888

Mutex

rypwysioyxzuiwozg

Attributes

delay
1
install
true
install_file
system32.exe
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Suspicious use of AdjustPrivilegeToken 43 IoCs

description	pid	Process
Token: SeDebugPrivilege	4964	paid windows safety client.exe
Token: SeIncreaseQuotaPrivilege	4964	paid windows safety client.exe
Token: SeSecurityPrivilege	4964	paid windows safety client.exe
Token: SeTakeOwnershipPrivilege	4964	paid windows safety client.exe
Token: SeLoadDriverPrivilege	4964	paid windows safety client.exe
Token: SeSystemProfilePrivilege	4964	paid windows safety client.exe
Token: SeSystemtimePrivilege	4964	paid windows safety client.exe
Token: SeProfSingleProcessPrivilege	4964	paid windows safety client.exe
Token: SeIncBasePriorityPrivilege	4964	paid windows safety client.exe
Token: SeCreatePagefilePrivilege	4964	paid windows safety client.exe
Token: SeBackupPrivilege	4964	paid windows safety client.exe
Token: SeRestorePrivilege	4964	paid windows safety client.exe
Token: SeShutdownPrivilege	4964	paid windows safety client.exe
Token: SeDebugPrivilege	4964	paid windows safety client.exe
Token: SeSystemEnvironmentPrivilege	4964	paid windows safety client.exe
Token: SeRemoteShutdownPrivilege	4964	paid windows safety client.exe
Token: SeUndockPrivilege	4964	paid windows safety client.exe
Token: SeManageVolumePrivilege	4964	paid windows safety client.exe
Token: 33	4964	paid windows safety client.exe
Token: 34	4964	paid windows safety client.exe
Token: 35	4964	paid windows safety client.exe
Token: 36	4964	paid windows safety client.exe
Token: SeIncreaseQuotaPrivilege	4964	paid windows safety client.exe
Token: SeSecurityPrivilege	4964	paid windows safety client.exe
Token: SeTakeOwnershipPrivilege	4964	paid windows safety client.exe
Token: SeLoadDriverPrivilege	4964	paid windows safety client.exe
Token: SeSystemProfilePrivilege	4964	paid windows safety client.exe
Token: SeSystemtimePrivilege	4964	paid windows safety client.exe
Token: SeProfSingleProcessPrivilege	4964	paid windows safety client.exe
Token: SeIncBasePriorityPrivilege	4964	paid windows safety client.exe
Token: SeCreatePagefilePrivilege	4964	paid windows safety client.exe
Token: SeBackupPrivilege	4964	paid windows safety client.exe
Token: SeRestorePrivilege	4964	paid windows safety client.exe
Token: SeShutdownPrivilege	4964	paid windows safety client.exe
Token: SeDebugPrivilege	4964	paid windows safety client.exe
Token: SeSystemEnvironmentPrivilege	4964	paid windows safety client.exe
Token: SeRemoteShutdownPrivilege	4964	paid windows safety client.exe
Token: SeUndockPrivilege	4964	paid windows safety client.exe
Token: SeManageVolumePrivilege	4964	paid windows safety client.exe
Token: 33	4964	paid windows safety client.exe
Token: 34	4964	paid windows safety client.exe
Token: 35	4964	paid windows safety client.exe
Token: 36	4964	paid windows safety client.exe

C:\Users\Admin\AppData\Local\Temp\paid windows safety client.exe
"C:\Users\Admin\AppData\Local\Temp\paid windows safety client.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4964

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4964-0-0x00007FFFB6A63000-0x00007FFFB6A64000-memory.dmp

Filesize
4KB

Download
memory/4964-1-0x0000000000260000-0x0000000000278000-memory.dmp

Filesize
96KB

Download
memory/4964-3-0x00007FFFB6A60000-0x00007FFFB744C000-memory.dmp

Filesize
9.9MB

Download
memory/4964-4-0x00007FFFB6A60000-0x00007FFFB744C000-memory.dmp

Filesize
9.9MB

Download