asyncrat | 723984ea90da0fde7d45c656f26e1196d6f933c2e47a287ab06f1d4051706e55

Analysis

max time kernel
65s
max time network
71s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
30-09-2024 18:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Family.exe
Size

123KB
MD5

3d84114b1b545e01154f0fd09514a505
SHA1

6a76912c8df51b4ac632ec355ccdfc04069448d8
SHA256

723984ea90da0fde7d45c656f26e1196d6f933c2e47a287ab06f1d4051706e55
SHA512

ca55f8dfb0d861d0add789c62086b6502891da4c09476df2bdd35427addcd7482a30b7a01e89e35c0aa353fcff3f94290a37987d61b589f689ad656aa7ff22dd
SSDEEP

3072:btQ5N91hoocvLSZY4nBJTwjs4MU7P9KK0XAh1NAIsf:JQ5N912v+Y4B9wjs4P5L0XAH6

Score

10^/10

asyncrat nymeria rat

Malware Config

Extracted

Family

asyncrat

Version

Venom RAT + HVNC + Stealer + Grabber v6.0.3

Botnet

Nymeria

94.232.249.235:4449

94.232.249.235:13001

Mutex

lndumyrztqffbe

Attributes

delay
1
install
false
install_folder
%Temp%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Suspicious use of SetThreadContext 1 IoCs

Processes:

Family.exe

description pid process target process

PID 1572 set thread context of 2016 1572 Family.exe csc.exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

csc.exe

pid process

2016 csc.exe
2016 csc.exe
2016 csc.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

Family.exe

pid process

1572 Family.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

csc.exe

description pid process

Token: SeDebugPrivilege 2016 csc.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

csc.exe

pid process

2016 csc.exe

description	pid	process	target process
PID 1572 set thread context of 2016	1572	Family.exe	csc.exe

pid	process
2016	csc.exe
2016	csc.exe
2016	csc.exe

pid	process
1572	Family.exe

description	pid	process
Token: SeDebugPrivilege	2016	csc.exe

pid	process
2016	csc.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

Family.exe

description	pid	process	target process
PID 1572 wrote to memory of 2016	1572	Family.exe	csc.exe
PID 1572 wrote to memory of 2016	1572	Family.exe	csc.exe
PID 1572 wrote to memory of 2016	1572	Family.exe	csc.exe
PID 1572 wrote to memory of 2016	1572	Family.exe	csc.exe
PID 1572 wrote to memory of 2016	1572	Family.exe	csc.exe
PID 1572 wrote to memory of 2016	1572	Family.exe	csc.exe

C:\Users\Admin\AppData\Local\Temp\Family.exe
"C:\Users\Admin\AppData\Local\Temp\Family.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1572

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2016

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1572-0-0x00007FFB35283000-0x00007FFB35284000-memory.dmp

Filesize
4KB

Download
memory/1572-1-0x0000000000100000-0x0000000000122000-memory.dmp

Filesize
136KB

Download
memory/1572-223-0x00007FFB35280000-0x00007FFB35C6C000-memory.dmp

Filesize
9.9MB

Download
memory/1572-7-0x00007FFB35280000-0x00007FFB35C6C000-memory.dmp

Filesize
9.9MB

Download
memory/2016-222-0x00007FFB35280000-0x00007FFB35C6C000-memory.dmp

Filesize
9.9MB

Download
memory/2016-225-0x00007FFB35280000-0x00007FFB35C6C000-memory.dmp

Filesize
9.9MB

Download
memory/2016-20-0x00007FFB35280000-0x00007FFB35C6C000-memory.dmp

Filesize
9.9MB

Download
memory/2016-221-0x00007FFB35280000-0x00007FFB35C6C000-memory.dmp

Filesize
9.9MB

Download
memory/2016-12-0x00007FFB35280000-0x00007FFB35C6C000-memory.dmp

Filesize
9.9MB

Download
memory/2016-2-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/2016-224-0x00007FFB35280000-0x00007FFB35C6C000-memory.dmp

Filesize
9.9MB

Download
memory/2016-13-0x00007FFB35280000-0x00007FFB35C6C000-memory.dmp

Filesize
9.9MB

Download
memory/2016-226-0x00007FFB35280000-0x00007FFB35C6C000-memory.dmp

Filesize
9.9MB

Download
memory/2016-227-0x00007FFB35280000-0x00007FFB35C6C000-memory.dmp

Filesize
9.9MB

Download
memory/2016-228-0x00007FFB35280000-0x00007FFB35C6C000-memory.dmp

Filesize
9.9MB

Download
memory/2016-229-0x0000021F22AA0000-0x0000021F22B16000-memory.dmp

Filesize
472KB

Download
memory/2016-230-0x0000021F09C50000-0x0000021F09C60000-memory.dmp

Filesize
64KB

Download
memory/2016-231-0x0000021F22670000-0x0000021F2268E000-memory.dmp

Filesize
120KB

Download