asyncrat | 266d1af2cb4893a07df7b3e99b9c63dd997cc1e48f6b721878eedf393a392c52

Analysis

max time kernel
95s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
02/12/2024, 14:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Test.exe
Size

74KB
MD5

d19a6f265293b9a714760f3a4e15a228
SHA1

f6c851e1708d8796019332d3f610599b649562f4
SHA256

266d1af2cb4893a07df7b3e99b9c63dd997cc1e48f6b721878eedf393a392c52
SHA512

055f0a5f0c8f10dde203580be7223c8a087b18413c10994af883dc8de48f91fc233aa221429be1bee91ec0e056089deb73e493c8620da0b6e4dffae33777237a
SSDEEP

1536:WUCccx0dxCKg6PMVP4SfSzyIrH1bC/b2OHcQzcyLVclN:WUTcx0f9g6PMVP4SSH1bCh8QjBY

Score

10^/10

asyncrat default rat

Malware Config

Extracted

Family

asyncrat

Version

Venom RAT + HVNC + Stealer + Grabber v6.0.3

Botnet

Default

127.0.0.1:4449

Mutex

hlvrakbhxgipspjpl

Attributes

delay
1
install
true
install_file
eeeehhhhh.exe
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Asyncrat family
asyncrat

Suspicious use of AdjustPrivilegeToken 43 IoCs

description	pid	Process
Token: SeDebugPrivilege	2308	Test.exe
Token: SeIncreaseQuotaPrivilege	2308	Test.exe
Token: SeSecurityPrivilege	2308	Test.exe
Token: SeTakeOwnershipPrivilege	2308	Test.exe
Token: SeLoadDriverPrivilege	2308	Test.exe
Token: SeSystemProfilePrivilege	2308	Test.exe
Token: SeSystemtimePrivilege	2308	Test.exe
Token: SeProfSingleProcessPrivilege	2308	Test.exe
Token: SeIncBasePriorityPrivilege	2308	Test.exe
Token: SeCreatePagefilePrivilege	2308	Test.exe
Token: SeBackupPrivilege	2308	Test.exe
Token: SeRestorePrivilege	2308	Test.exe
Token: SeShutdownPrivilege	2308	Test.exe
Token: SeDebugPrivilege	2308	Test.exe
Token: SeSystemEnvironmentPrivilege	2308	Test.exe
Token: SeRemoteShutdownPrivilege	2308	Test.exe
Token: SeUndockPrivilege	2308	Test.exe
Token: SeManageVolumePrivilege	2308	Test.exe
Token: 33	2308	Test.exe
Token: 34	2308	Test.exe
Token: 35	2308	Test.exe
Token: 36	2308	Test.exe
Token: SeIncreaseQuotaPrivilege	2308	Test.exe
Token: SeSecurityPrivilege	2308	Test.exe
Token: SeTakeOwnershipPrivilege	2308	Test.exe
Token: SeLoadDriverPrivilege	2308	Test.exe
Token: SeSystemProfilePrivilege	2308	Test.exe
Token: SeSystemtimePrivilege	2308	Test.exe
Token: SeProfSingleProcessPrivilege	2308	Test.exe
Token: SeIncBasePriorityPrivilege	2308	Test.exe
Token: SeCreatePagefilePrivilege	2308	Test.exe
Token: SeBackupPrivilege	2308	Test.exe
Token: SeRestorePrivilege	2308	Test.exe
Token: SeShutdownPrivilege	2308	Test.exe
Token: SeDebugPrivilege	2308	Test.exe
Token: SeSystemEnvironmentPrivilege	2308	Test.exe
Token: SeRemoteShutdownPrivilege	2308	Test.exe
Token: SeUndockPrivilege	2308	Test.exe
Token: SeManageVolumePrivilege	2308	Test.exe
Token: 33	2308	Test.exe
Token: 34	2308	Test.exe
Token: 35	2308	Test.exe
Token: 36	2308	Test.exe

C:\Users\Admin\AppData\Local\Temp\Test.exe
"C:\Users\Admin\AppData\Local\Temp\Test.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2308

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2308-0-0x00007FFC9E883000-0x00007FFC9E885000-memory.dmp

Filesize
8KB

Download
memory/2308-1-0x0000000000A50000-0x0000000000A68000-memory.dmp

Filesize
96KB

Download
memory/2308-3-0x00007FFC9E880000-0x00007FFC9F341000-memory.dmp

Filesize
10.8MB

Download
memory/2308-4-0x00007FFC9E880000-0x00007FFC9F341000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads