asyncrat | d1be1638433de6b9fee0d915a719d69f639ba6cadb0a31e9eaea034ebd562b12

Analysis

max time kernel
139s
max time network
134s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
20-10-2024 09:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

hello.exe
Size

74KB
MD5

74157d6bda58b1d9c8690a3a5c11dda1
SHA1

c8d43e462620b65c1452bcc45f63eeedb51d0d56
SHA256

d1be1638433de6b9fee0d915a719d69f639ba6cadb0a31e9eaea034ebd562b12
SHA512

ead09464c5bdbfdc2702413c58bd17efcc35e15f068dcfcf55c905c003711b524997ffdd6e089999f6be724f9a5f5185e8c026ce1bb3f4a632024b9955230e38
SSDEEP

1536:gUUPcxVteCW7PMV+Ydj/yLEgItH1bc/ThQzcyLVclN:gUmcxV4x7PMVF/nTH1bcNQjBY

Score

10^/10

asyncrat default rat

Malware Config

Extracted

Family

asyncrat

Version

Venom RAT + HVNC + Stealer + Grabber v6.0.3

Botnet

Default

127.0.0.1:4449

Mutex

whbdpkgbrimkqqf

Attributes

delay
1
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

VenomRAT 1 IoCs

Detects VenomRAT.

rat

Processes:

resource	yara_rule
behavioral2/memory/1880-1-0x0000000000560000-0x0000000000578000-memory.dmp	VenomRAT

Suspicious use of AdjustPrivilegeToken 43 IoCs

Processes:

hello.exe

description	pid	Process
Token: SeDebugPrivilege	1880	hello.exe
Token: SeIncreaseQuotaPrivilege	1880	hello.exe
Token: SeSecurityPrivilege	1880	hello.exe
Token: SeTakeOwnershipPrivilege	1880	hello.exe
Token: SeLoadDriverPrivilege	1880	hello.exe
Token: SeSystemProfilePrivilege	1880	hello.exe
Token: SeSystemtimePrivilege	1880	hello.exe
Token: SeProfSingleProcessPrivilege	1880	hello.exe
Token: SeIncBasePriorityPrivilege	1880	hello.exe
Token: SeCreatePagefilePrivilege	1880	hello.exe
Token: SeBackupPrivilege	1880	hello.exe
Token: SeRestorePrivilege	1880	hello.exe
Token: SeShutdownPrivilege	1880	hello.exe
Token: SeDebugPrivilege	1880	hello.exe
Token: SeSystemEnvironmentPrivilege	1880	hello.exe
Token: SeRemoteShutdownPrivilege	1880	hello.exe
Token: SeUndockPrivilege	1880	hello.exe
Token: SeManageVolumePrivilege	1880	hello.exe
Token: 33	1880	hello.exe
Token: 34	1880	hello.exe
Token: 35	1880	hello.exe
Token: 36	1880	hello.exe
Token: SeIncreaseQuotaPrivilege	1880	hello.exe
Token: SeSecurityPrivilege	1880	hello.exe
Token: SeTakeOwnershipPrivilege	1880	hello.exe
Token: SeLoadDriverPrivilege	1880	hello.exe
Token: SeSystemProfilePrivilege	1880	hello.exe
Token: SeSystemtimePrivilege	1880	hello.exe
Token: SeProfSingleProcessPrivilege	1880	hello.exe
Token: SeIncBasePriorityPrivilege	1880	hello.exe
Token: SeCreatePagefilePrivilege	1880	hello.exe
Token: SeBackupPrivilege	1880	hello.exe
Token: SeRestorePrivilege	1880	hello.exe
Token: SeShutdownPrivilege	1880	hello.exe
Token: SeDebugPrivilege	1880	hello.exe
Token: SeSystemEnvironmentPrivilege	1880	hello.exe
Token: SeRemoteShutdownPrivilege	1880	hello.exe
Token: SeUndockPrivilege	1880	hello.exe
Token: SeManageVolumePrivilege	1880	hello.exe
Token: 33	1880	hello.exe
Token: 34	1880	hello.exe
Token: 35	1880	hello.exe
Token: 36	1880	hello.exe

C:\Users\Admin\AppData\Local\Temp\hello.exe
"C:\Users\Admin\AppData\Local\Temp\hello.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1880

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1880-0-0x00007FFC9E503000-0x00007FFC9E505000-memory.dmp

Filesize
8KB

Download
memory/1880-1-0x0000000000560000-0x0000000000578000-memory.dmp

Filesize
96KB

Download
memory/1880-3-0x00007FFC9E500000-0x00007FFC9EFC1000-memory.dmp

Filesize
10.8MB

Download
memory/1880-4-0x00007FFC9E500000-0x00007FFC9EFC1000-memory.dmp

Filesize
10.8MB

Download