asyncrat | 266d1af2cb4893a07df7b3e99b9c63dd997cc1e48f6b721878eedf393a392c52

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
02/12/2024, 14:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Test.exe
Size

74KB
MD5

d19a6f265293b9a714760f3a4e15a228
SHA1

f6c851e1708d8796019332d3f610599b649562f4
SHA256

266d1af2cb4893a07df7b3e99b9c63dd997cc1e48f6b721878eedf393a392c52
SHA512

055f0a5f0c8f10dde203580be7223c8a087b18413c10994af883dc8de48f91fc233aa221429be1bee91ec0e056089deb73e493c8620da0b6e4dffae33777237a
SSDEEP

1536:WUCccx0dxCKg6PMVP4SfSzyIrH1bC/b2OHcQzcyLVclN:WUTcx0f9g6PMVP4SSH1bCh8QjBY

Score

10^/10

asyncrat default rat

Malware Config

Extracted

Family

asyncrat

Version

Venom RAT + HVNC + Stealer + Grabber v6.0.3

Botnet

Default

127.0.0.1:4449

Mutex

hlvrakbhxgipspjpl

Attributes

delay
1
install
true
install_file
eeeehhhhh.exe
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Asyncrat family
asyncrat

Suspicious use of AdjustPrivilegeToken 41 IoCs

description	pid	Process
Token: SeDebugPrivilege	2468	Test.exe
Token: SeIncreaseQuotaPrivilege	2468	Test.exe
Token: SeSecurityPrivilege	2468	Test.exe
Token: SeTakeOwnershipPrivilege	2468	Test.exe
Token: SeLoadDriverPrivilege	2468	Test.exe
Token: SeSystemProfilePrivilege	2468	Test.exe
Token: SeSystemtimePrivilege	2468	Test.exe
Token: SeProfSingleProcessPrivilege	2468	Test.exe
Token: SeIncBasePriorityPrivilege	2468	Test.exe
Token: SeCreatePagefilePrivilege	2468	Test.exe
Token: SeBackupPrivilege	2468	Test.exe
Token: SeRestorePrivilege	2468	Test.exe
Token: SeShutdownPrivilege	2468	Test.exe
Token: SeDebugPrivilege	2468	Test.exe
Token: SeSystemEnvironmentPrivilege	2468	Test.exe
Token: SeRemoteShutdownPrivilege	2468	Test.exe
Token: SeUndockPrivilege	2468	Test.exe
Token: SeManageVolumePrivilege	2468	Test.exe
Token: 33	2468	Test.exe
Token: 34	2468	Test.exe
Token: 35	2468	Test.exe
Token: SeIncreaseQuotaPrivilege	2468	Test.exe
Token: SeSecurityPrivilege	2468	Test.exe
Token: SeTakeOwnershipPrivilege	2468	Test.exe
Token: SeLoadDriverPrivilege	2468	Test.exe
Token: SeSystemProfilePrivilege	2468	Test.exe
Token: SeSystemtimePrivilege	2468	Test.exe
Token: SeProfSingleProcessPrivilege	2468	Test.exe
Token: SeIncBasePriorityPrivilege	2468	Test.exe
Token: SeCreatePagefilePrivilege	2468	Test.exe
Token: SeBackupPrivilege	2468	Test.exe
Token: SeRestorePrivilege	2468	Test.exe
Token: SeShutdownPrivilege	2468	Test.exe
Token: SeDebugPrivilege	2468	Test.exe
Token: SeSystemEnvironmentPrivilege	2468	Test.exe
Token: SeRemoteShutdownPrivilege	2468	Test.exe
Token: SeUndockPrivilege	2468	Test.exe
Token: SeManageVolumePrivilege	2468	Test.exe
Token: 33	2468	Test.exe
Token: 34	2468	Test.exe
Token: 35	2468	Test.exe

C:\Users\Admin\AppData\Local\Temp\Test.exe
"C:\Users\Admin\AppData\Local\Temp\Test.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2468

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2468-0-0x000007FEF5303000-0x000007FEF5304000-memory.dmp

Filesize
4KB

Download
memory/2468-1-0x00000000003C0000-0x00000000003D8000-memory.dmp

Filesize
96KB

Download
memory/2468-3-0x000007FEF5300000-0x000007FEF5CEC000-memory.dmp

Filesize
9.9MB

Download
memory/2468-4-0x000007FEF5300000-0x000007FEF5CEC000-memory.dmp

Filesize
9.9MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads