asyncrat | 2367c310a7b927c7725037f0b42e5942594226c7eef9583332a385b773888fea

General

Target

2367c310a7b927c7725037f0b42e5942594226c7eef9583332a385b773888fea.exe
Size

74KB
MD5

539f3a26178a41d84108e19d84170869
SHA1

169e5c984226f3af86357475634b9e094d99b24a
SHA256

2367c310a7b927c7725037f0b42e5942594226c7eef9583332a385b773888fea
SHA512

f0dee8399829e74b19fd2fde9ce199b7a9dc7893acd1f926c14c5eb4f789cf159ac8b6b6846ea130b33a450ac9524c4a6819fb1a164f13be5bcaeadbac7f14b1
SSDEEP

1536:8RU98cxpeaC/zPMVCe9VdQuDI6H1bf/ItII4Qzc06VclN:iU+cxp7AzPMVCe9VdQsH1bfPQlIY

Score

10^/10

asyncrat default rat

Malware Config

Extracted

Family

asyncrat

Version

Venom RAT + HVNC + Stealer + Grabber v6.0.3

Botnet

Default

C2

127.0.0.1:4449

Mutex

12492

Attributes

delay
1
install
true
install_file
12492.exe
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

VenomRAT 1 IoCs

Detects VenomRAT.

rat

Processes:

resource	yara_rule
behavioral1/memory/1724-1-0x0000000000C40000-0x0000000000C58000-memory.dmp	VenomRAT

Suspicious use of AdjustPrivilegeToken 41 IoCs

Processes:

2367c310a7b927c7725037f0b42e5942594226c7eef9583332a385b773888fea.exe

description	pid	process
Token: SeDebugPrivilege	1724	2367c310a7b927c7725037f0b42e5942594226c7eef9583332a385b773888fea.exe
Token: SeIncreaseQuotaPrivilege	1724	2367c310a7b927c7725037f0b42e5942594226c7eef9583332a385b773888fea.exe
Token: SeSecurityPrivilege	1724	2367c310a7b927c7725037f0b42e5942594226c7eef9583332a385b773888fea.exe
Token: SeTakeOwnershipPrivilege	1724	2367c310a7b927c7725037f0b42e5942594226c7eef9583332a385b773888fea.exe
Token: SeLoadDriverPrivilege	1724	2367c310a7b927c7725037f0b42e5942594226c7eef9583332a385b773888fea.exe
Token: SeSystemProfilePrivilege	1724	2367c310a7b927c7725037f0b42e5942594226c7eef9583332a385b773888fea.exe
Token: SeSystemtimePrivilege	1724	2367c310a7b927c7725037f0b42e5942594226c7eef9583332a385b773888fea.exe
Token: SeProfSingleProcessPrivilege	1724	2367c310a7b927c7725037f0b42e5942594226c7eef9583332a385b773888fea.exe
Token: SeIncBasePriorityPrivilege	1724	2367c310a7b927c7725037f0b42e5942594226c7eef9583332a385b773888fea.exe
Token: SeCreatePagefilePrivilege	1724	2367c310a7b927c7725037f0b42e5942594226c7eef9583332a385b773888fea.exe
Token: SeBackupPrivilege	1724	2367c310a7b927c7725037f0b42e5942594226c7eef9583332a385b773888fea.exe
Token: SeRestorePrivilege	1724	2367c310a7b927c7725037f0b42e5942594226c7eef9583332a385b773888fea.exe
Token: SeShutdownPrivilege	1724	2367c310a7b927c7725037f0b42e5942594226c7eef9583332a385b773888fea.exe
Token: SeDebugPrivilege	1724	2367c310a7b927c7725037f0b42e5942594226c7eef9583332a385b773888fea.exe
Token: SeSystemEnvironmentPrivilege	1724	2367c310a7b927c7725037f0b42e5942594226c7eef9583332a385b773888fea.exe
Token: SeRemoteShutdownPrivilege	1724	2367c310a7b927c7725037f0b42e5942594226c7eef9583332a385b773888fea.exe
Token: SeUndockPrivilege	1724	2367c310a7b927c7725037f0b42e5942594226c7eef9583332a385b773888fea.exe
Token: SeManageVolumePrivilege	1724	2367c310a7b927c7725037f0b42e5942594226c7eef9583332a385b773888fea.exe
Token: 33	1724	2367c310a7b927c7725037f0b42e5942594226c7eef9583332a385b773888fea.exe
Token: 34	1724	2367c310a7b927c7725037f0b42e5942594226c7eef9583332a385b773888fea.exe
Token: 35	1724	2367c310a7b927c7725037f0b42e5942594226c7eef9583332a385b773888fea.exe
Token: SeIncreaseQuotaPrivilege	1724	2367c310a7b927c7725037f0b42e5942594226c7eef9583332a385b773888fea.exe
Token: SeSecurityPrivilege	1724	2367c310a7b927c7725037f0b42e5942594226c7eef9583332a385b773888fea.exe
Token: SeTakeOwnershipPrivilege	1724	2367c310a7b927c7725037f0b42e5942594226c7eef9583332a385b773888fea.exe
Token: SeLoadDriverPrivilege	1724	2367c310a7b927c7725037f0b42e5942594226c7eef9583332a385b773888fea.exe
Token: SeSystemProfilePrivilege	1724	2367c310a7b927c7725037f0b42e5942594226c7eef9583332a385b773888fea.exe
Token: SeSystemtimePrivilege	1724	2367c310a7b927c7725037f0b42e5942594226c7eef9583332a385b773888fea.exe
Token: SeProfSingleProcessPrivilege	1724	2367c310a7b927c7725037f0b42e5942594226c7eef9583332a385b773888fea.exe
Token: SeIncBasePriorityPrivilege	1724	2367c310a7b927c7725037f0b42e5942594226c7eef9583332a385b773888fea.exe
Token: SeCreatePagefilePrivilege	1724	2367c310a7b927c7725037f0b42e5942594226c7eef9583332a385b773888fea.exe
Token: SeBackupPrivilege	1724	2367c310a7b927c7725037f0b42e5942594226c7eef9583332a385b773888fea.exe
Token: SeRestorePrivilege	1724	2367c310a7b927c7725037f0b42e5942594226c7eef9583332a385b773888fea.exe
Token: SeShutdownPrivilege	1724	2367c310a7b927c7725037f0b42e5942594226c7eef9583332a385b773888fea.exe
Token: SeDebugPrivilege	1724	2367c310a7b927c7725037f0b42e5942594226c7eef9583332a385b773888fea.exe
Token: SeSystemEnvironmentPrivilege	1724	2367c310a7b927c7725037f0b42e5942594226c7eef9583332a385b773888fea.exe
Token: SeRemoteShutdownPrivilege	1724	2367c310a7b927c7725037f0b42e5942594226c7eef9583332a385b773888fea.exe
Token: SeUndockPrivilege	1724	2367c310a7b927c7725037f0b42e5942594226c7eef9583332a385b773888fea.exe
Token: SeManageVolumePrivilege	1724	2367c310a7b927c7725037f0b42e5942594226c7eef9583332a385b773888fea.exe
Token: 33	1724	2367c310a7b927c7725037f0b42e5942594226c7eef9583332a385b773888fea.exe
Token: 34	1724	2367c310a7b927c7725037f0b42e5942594226c7eef9583332a385b773888fea.exe
Token: 35	1724	2367c310a7b927c7725037f0b42e5942594226c7eef9583332a385b773888fea.exe

C:\Users\Admin\AppData\Local\Temp\2367c310a7b927c7725037f0b42e5942594226c7eef9583332a385b773888fea.exe
"C:\Users\Admin\AppData\Local\Temp\2367c310a7b927c7725037f0b42e5942594226c7eef9583332a385b773888fea.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1724

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1724-0-0x000007FEF5F53000-0x000007FEF5F54000-memory.dmp

Filesize
4KB

Download
memory/1724-1-0x0000000000C40000-0x0000000000C58000-memory.dmp

Filesize
96KB

Download
memory/1724-3-0x000007FEF5F50000-0x000007FEF693C000-memory.dmp

Filesize
9.9MB

Download
memory/1724-4-0x000007FEF5F50000-0x000007FEF693C000-memory.dmp

Filesize
9.9MB

Download

Analysis

Sharing