asyncrat | 8a214f55a71c9df656632466e18e2f1524ff97b169cead4076736ccbe41b28c5

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
16-10-2024 18:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

test.exe
Size

74KB
MD5

88762ec3fd40f35393b2328c4f20fe2d
SHA1

f3293a6439ad9e1f85e958f1e3150a6260f2ffde
SHA256

8a214f55a71c9df656632466e18e2f1524ff97b169cead4076736ccbe41b28c5
SHA512

c3e92b0fc4112cd53b798118f9cdcb228ef1e046d66675723c4f538788926d9cffe43b12c40f2a7543259123883693a741447328b2ad9614ca3506aa99dcf7e5
SSDEEP

1536:2UKkcx9pXCTyPMVn4SfSzyIrH1bi/tzQzcmLVclN:2UDcx958yPMVn4SSH1bihQ/BY

Score

10^/10

asyncrat default rat

Malware Config

Extracted

Family

asyncrat

Version

Venom RAT + HVNC + Stealer + Grabber v6.0.3

Botnet

Default

127.0.0.1:4848

127.0.0.1:4040

Mutex

wasspix

Attributes

delay
1
install
true
install_file
wasspix.exe
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Suspicious use of AdjustPrivilegeToken 41 IoCs

Processes:

test.exe

description	pid	process
Token: SeDebugPrivilege	2656	test.exe
Token: SeIncreaseQuotaPrivilege	2656	test.exe
Token: SeSecurityPrivilege	2656	test.exe
Token: SeTakeOwnershipPrivilege	2656	test.exe
Token: SeLoadDriverPrivilege	2656	test.exe
Token: SeSystemProfilePrivilege	2656	test.exe
Token: SeSystemtimePrivilege	2656	test.exe
Token: SeProfSingleProcessPrivilege	2656	test.exe
Token: SeIncBasePriorityPrivilege	2656	test.exe
Token: SeCreatePagefilePrivilege	2656	test.exe
Token: SeBackupPrivilege	2656	test.exe
Token: SeRestorePrivilege	2656	test.exe
Token: SeShutdownPrivilege	2656	test.exe
Token: SeDebugPrivilege	2656	test.exe
Token: SeSystemEnvironmentPrivilege	2656	test.exe
Token: SeRemoteShutdownPrivilege	2656	test.exe
Token: SeUndockPrivilege	2656	test.exe
Token: SeManageVolumePrivilege	2656	test.exe
Token: 33	2656	test.exe
Token: 34	2656	test.exe
Token: 35	2656	test.exe
Token: SeIncreaseQuotaPrivilege	2656	test.exe
Token: SeSecurityPrivilege	2656	test.exe
Token: SeTakeOwnershipPrivilege	2656	test.exe
Token: SeLoadDriverPrivilege	2656	test.exe
Token: SeSystemProfilePrivilege	2656	test.exe
Token: SeSystemtimePrivilege	2656	test.exe
Token: SeProfSingleProcessPrivilege	2656	test.exe
Token: SeIncBasePriorityPrivilege	2656	test.exe
Token: SeCreatePagefilePrivilege	2656	test.exe
Token: SeBackupPrivilege	2656	test.exe
Token: SeRestorePrivilege	2656	test.exe
Token: SeShutdownPrivilege	2656	test.exe
Token: SeDebugPrivilege	2656	test.exe
Token: SeSystemEnvironmentPrivilege	2656	test.exe
Token: SeRemoteShutdownPrivilege	2656	test.exe
Token: SeUndockPrivilege	2656	test.exe
Token: SeManageVolumePrivilege	2656	test.exe
Token: 33	2656	test.exe
Token: 34	2656	test.exe
Token: 35	2656	test.exe

C:\Users\Admin\AppData\Local\Temp\test.exe
"C:\Users\Admin\AppData\Local\Temp\test.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2656

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2656-0-0x000007FEF5C53000-0x000007FEF5C54000-memory.dmp

Filesize
4KB

Download
memory/2656-1-0x0000000000D90000-0x0000000000DA8000-memory.dmp

Filesize
96KB

Download
memory/2656-3-0x000007FEF5C50000-0x000007FEF663C000-memory.dmp

Filesize
9.9MB

Download
memory/2656-4-0x000007FEF5C50000-0x000007FEF663C000-memory.dmp

Filesize
9.9MB

Download