asyncrat | 3af2d8280ca274b2d5d06e2494a7e99ba1b26c439e426335bf98c1eb640e38fc

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
28-10-2024 19:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Rose_1_1_4_2/Rose_İnjector.exe
Size

108KB
MD5

17f7206a7e2535c2757a2e28af6c13c8
SHA1

5cea3e60c35b8da9e1520832071ca52b98991797
SHA256

8f1d00324051a90eb2ca14d2d68946b78d89e36ed3ce9082af05da5b38c04457
SHA512

15c3ea73fd01290171448f0e0dea4a3b2919448c35116d9bcce99f6e81be063ba6fccef7ec1b71fcce3056c15f0099130d21edd5372fb7f46cfcae5f7c2dec39
SSDEEP

1536:eztgRnOxvwiHj+4c4ajjlKINra4Op/XiCwVjq0CHKX9xB:ez6O2iqKCjjm1/Xi34HKX9L

Score

10^/10

asyncrat sazan rat

Malware Config

Extracted

Family

asyncrat

Version

Venom RAT + HVNC + Stealer + Grabber v6.0.3

Botnet

sazan

Mutex

rdzbojdvoiqafvcuqj

Attributes

delay
1
install
false
install_folder
%AppData%
pastebin_config
https://pastebin.ai/raw/it4zrvblz1

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Asyncrat family
asyncrat

Async RAT payload 1 IoCs

rat

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Roaming\Client.exe	family_asyncrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Rose_İnjector.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	Rose_İnjector.exe

Executes dropped EXE 2 IoCs

Processes:

Client.exeRose_Injector.exe

pid process

1932 Client.exe
2420 Rose_Injector.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
1932	Client.exe
2420	Rose_Injector.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

Processes:

Rose_Injector.exeClient.exe

pid	process
2420	Rose_Injector.exe
2420	Rose_Injector.exe
2420	Rose_Injector.exe
2420	Rose_Injector.exe
1932	Client.exe
1932	Client.exe
1932	Client.exe
1932	Client.exe
1932	Client.exe
1932	Client.exe
1932	Client.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Client.exeRose_Injector.exe

description pid process

Token: SeDebugPrivilege 1932 Client.exe
Token: SeDebugPrivilege 2420 Rose_Injector.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

Client.exe

pid process

1932 Client.exe

description	pid	process
Token: SeDebugPrivilege	1932	Client.exe
Token: SeDebugPrivilege	2420	Rose_Injector.exe

pid	process
1932	Client.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

Rose_İnjector.exe

description	pid	process	target process
PID 924 wrote to memory of 1932	924	Rose_İnjector.exe	Client.exe
PID 924 wrote to memory of 1932	924	Rose_İnjector.exe	Client.exe
PID 924 wrote to memory of 2420	924	Rose_İnjector.exe	Rose_Injector.exe
PID 924 wrote to memory of 2420	924	Rose_İnjector.exe	Rose_Injector.exe

C:\Users\Admin\AppData\Local\Temp\Rose_1_1_4_2\Rose_İnjector.exe
"C:\Users\Admin\AppData\Local\Temp\Rose_1_1_4_2\Rose_İnjector.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:924

C:\Users\Admin\AppData\Roaming\Client.exe
"C:\Users\Admin\AppData\Roaming\Client.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1932

C:\Users\Admin\AppData\Roaming\Rose_Injector.exe
"C:\Users\Admin\AppData\Roaming\Rose_Injector.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2420

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Client.exe

Filesize
74KB

MD5
1e62f2d4b2155fe336bc8f449100554a

SHA1
2506734f15d2b69270be7c922f008e7de9d839dd

SHA256
16a3ba1c991f0d2c666e7f41528ccf65c477c094a8ff75b924289f564bf11498

SHA512
a14d75b76935b73af946f81370aa7c6874240dd907336bfdb09a70e8e088a8c6e1341fb8da7277477fb1328251ea1a52a9e8c1126d3c4b59b8dcf99191266ebf

Download Submit
C:\Users\Admin\AppData\Roaming\Rose_Injector.exe

Filesize
27KB

MD5
8be0e3590df0a1337f9fb82630852376

SHA1
6f0d6bc2ba3ab5cbbff94a944dd24c0eda0771d5

SHA256
36a340af2f3f63c9be3546704985accb516135860a575ef6c655819d7998ed39

SHA512
48714538160ddeddd9ff1834056daaef50f261401bd19e44b60af628f46ebc741c32dcc73ccbb546b325da79fd336cbfa79f31215008bf3578ea070ff8156d16

Download Submit
memory/924-0-0x00007FFA97F90000-0x00007FFA98259000-memory.dmp

Filesize
2.8MB

Download
memory/924-1-0x00000000001B0000-0x00000000001D2000-memory.dmp

Filesize
136KB

Download
memory/924-3-0x00007FFA97F90000-0x00007FFA98259000-memory.dmp

Filesize
2.8MB

Download
memory/924-24-0x00007FFA97F90000-0x00007FFA98259000-memory.dmp

Filesize
2.8MB

Download
memory/1932-22-0x00007FFA97F90000-0x00007FFA98259000-memory.dmp

Filesize
2.8MB

Download
memory/1932-23-0x0000000000980000-0x0000000000998000-memory.dmp

Filesize
96KB

Download
memory/1932-26-0x00007FFA97F90000-0x00007FFA98259000-memory.dmp

Filesize
2.8MB

Download
memory/1932-28-0x00007FFA97F90000-0x00007FFA98259000-memory.dmp

Filesize
2.8MB

Download