asyncrat | 8a214f55a71c9df656632466e18e2f1524ff97b169cead4076736ccbe41b28c5

Analysis

max time kernel
141s
max time network
108s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
16-10-2024 18:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

test.exe
Size

74KB
MD5

88762ec3fd40f35393b2328c4f20fe2d
SHA1

f3293a6439ad9e1f85e958f1e3150a6260f2ffde
SHA256

8a214f55a71c9df656632466e18e2f1524ff97b169cead4076736ccbe41b28c5
SHA512

c3e92b0fc4112cd53b798118f9cdcb228ef1e046d66675723c4f538788926d9cffe43b12c40f2a7543259123883693a741447328b2ad9614ca3506aa99dcf7e5
SSDEEP

1536:2UKkcx9pXCTyPMVn4SfSzyIrH1bi/tzQzcmLVclN:2UDcx958yPMVn4SSH1bihQ/BY

Score

10^/10

asyncrat default rat

Malware Config

Extracted

Family

asyncrat

Version

Venom RAT + HVNC + Stealer + Grabber v6.0.3

Botnet

Default

127.0.0.1:4848

127.0.0.1:4040

Mutex

wasspix

Attributes

delay
1
install
true
install_file
wasspix.exe
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Suspicious use of AdjustPrivilegeToken 43 IoCs

Processes:

test.exe

description	pid	process
Token: SeDebugPrivilege	2108	test.exe
Token: SeIncreaseQuotaPrivilege	2108	test.exe
Token: SeSecurityPrivilege	2108	test.exe
Token: SeTakeOwnershipPrivilege	2108	test.exe
Token: SeLoadDriverPrivilege	2108	test.exe
Token: SeSystemProfilePrivilege	2108	test.exe
Token: SeSystemtimePrivilege	2108	test.exe
Token: SeProfSingleProcessPrivilege	2108	test.exe
Token: SeIncBasePriorityPrivilege	2108	test.exe
Token: SeCreatePagefilePrivilege	2108	test.exe
Token: SeBackupPrivilege	2108	test.exe
Token: SeRestorePrivilege	2108	test.exe
Token: SeShutdownPrivilege	2108	test.exe
Token: SeDebugPrivilege	2108	test.exe
Token: SeSystemEnvironmentPrivilege	2108	test.exe
Token: SeRemoteShutdownPrivilege	2108	test.exe
Token: SeUndockPrivilege	2108	test.exe
Token: SeManageVolumePrivilege	2108	test.exe
Token: 33	2108	test.exe
Token: 34	2108	test.exe
Token: 35	2108	test.exe
Token: 36	2108	test.exe
Token: SeIncreaseQuotaPrivilege	2108	test.exe
Token: SeSecurityPrivilege	2108	test.exe
Token: SeTakeOwnershipPrivilege	2108	test.exe
Token: SeLoadDriverPrivilege	2108	test.exe
Token: SeSystemProfilePrivilege	2108	test.exe
Token: SeSystemtimePrivilege	2108	test.exe
Token: SeProfSingleProcessPrivilege	2108	test.exe
Token: SeIncBasePriorityPrivilege	2108	test.exe
Token: SeCreatePagefilePrivilege	2108	test.exe
Token: SeBackupPrivilege	2108	test.exe
Token: SeRestorePrivilege	2108	test.exe
Token: SeShutdownPrivilege	2108	test.exe
Token: SeDebugPrivilege	2108	test.exe
Token: SeSystemEnvironmentPrivilege	2108	test.exe
Token: SeRemoteShutdownPrivilege	2108	test.exe
Token: SeUndockPrivilege	2108	test.exe
Token: SeManageVolumePrivilege	2108	test.exe
Token: 33	2108	test.exe
Token: 34	2108	test.exe
Token: 35	2108	test.exe
Token: 36	2108	test.exe

C:\Users\Admin\AppData\Local\Temp\test.exe
"C:\Users\Admin\AppData\Local\Temp\test.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2108

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2108-0-0x00007FF814CB3000-0x00007FF814CB5000-memory.dmp

Filesize
8KB

Download
memory/2108-1-0x00000000002E0000-0x00000000002F8000-memory.dmp

Filesize
96KB

Download
memory/2108-3-0x00007FF814CB0000-0x00007FF815771000-memory.dmp

Filesize
10.8MB

Download
memory/2108-4-0x00007FF814CB0000-0x00007FF815771000-memory.dmp

Filesize
10.8MB

Download