asyncrat | d76cc5c56d2e4228700f9f4a085ec68a77dd63f25f43a73eea2586c21c6c88fe

Analysis

max time kernel
118s
max time network
124s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
12-10-2024 13:28

Target

SkibidiRat/Stub/Stub.exe
Size

60KB
MD5

fd7b1162b84b0add4146e3bc0d13b7dd
SHA1

1fb46807f499267832aa444e12c403df880855bb
SHA256

972c912943000017fe92e563d4b7a5147f15825718edcb17307af79f85ac5f10
SHA512

6f5ff1aff1c899f9ae48cd177fd1bb277b2b9a7395858de1077392c293a4c68307d55d84a7c9968342da5a1296e720b00d8cd6f42b5faa11b7c643260eac300d
SSDEEP

768:NRgZXw8fNxs48AZYfEq586BHPcxLwM5QXWaRcW1Uo4blGNjj6MpqKYhY7:NR7586vcx35QXWaRB1UqiMpqKmY7

Score

10^/10

asyncrat rat

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

Stub.exe

description	pid	process	target process
PID 2760 wrote to memory of 2876	2760	Stub.exe	WerFault.exe
PID 2760 wrote to memory of 2876	2760	Stub.exe	WerFault.exe
PID 2760 wrote to memory of 2876	2760	Stub.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\SkibidiRat\Stub\Stub.exe
"C:\Users\Admin\AppData\Local\Temp\SkibidiRat\Stub\Stub.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2760

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2760 -s 512
2⤵
PID:2876

memory/2760-0-0x000007FEF6503000-0x000007FEF6504000-memory.dmp

Filesize
4KB

Download
memory/2760-1-0x0000000000DD0000-0x0000000000DE4000-memory.dmp

Filesize
80KB

Download