asyncrat | dd5c4d0eaa73513523864ff9a264f090153a5d38e425ec4d041173ef9ab1ab76

Analysis

max time kernel
12s
max time network
0s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
26/12/2024, 10:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

adswqadasw.exe
Size

2.9MB
MD5

c88eb41aa02785f785337117bce52dc9
SHA1

ee63f44027e89481fdb281b4e30fc6c8832679a2
SHA256

dd5c4d0eaa73513523864ff9a264f090153a5d38e425ec4d041173ef9ab1ab76
SHA512

67bedd5b7e052469ff29e6c9f6ddfd3c5a855612f769343a1a694baa53fb8c526518d00713720f94f320741d57121687b75b81999ddd065f8c712cc7c116328c
SSDEEP

24576:xQBAe4kTT+2YHQyODScZoml6mm/ri5R1PqA49GAxw4DRgGoGTBytyCCBdxF9Cqz+:xOAe4kX+fDxi5R1C10QgGeyxB7JCB

Score

10^/10

asyncrat default discovery rat

Malware Config

Extracted

Family

asyncrat

Version

Venom RAT + HVNC + Stealer + Grabber v6.0.3

Botnet

Default

Mutex

lfrlrahocljxyqyr

Attributes

delay
1
install
false
install_folder
%AppData%
pastebin_config
https://pastebin.com/raw/xFvrV0SD

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Asyncrat family
asyncrat

Executes dropped EXE 1 IoCs

pid	Process
3036	winlogon.exe

Uses the VBS compiler for execution 1 TTPs

Command and Scripting Interpreter
T1059

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2300 set thread context of 3036	2300	adswqadasw.exe	30

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	adswqadasw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winlogon.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 2300 wrote to memory of 3036	2300	adswqadasw.exe	30
PID 2300 wrote to memory of 3036	2300	adswqadasw.exe	30
PID 2300 wrote to memory of 3036	2300	adswqadasw.exe	30
PID 2300 wrote to memory of 3036	2300	adswqadasw.exe	30
PID 2300 wrote to memory of 3036	2300	adswqadasw.exe	30
PID 2300 wrote to memory of 3036	2300	adswqadasw.exe	30
PID 2300 wrote to memory of 3036	2300	adswqadasw.exe	30
PID 2300 wrote to memory of 3036	2300	adswqadasw.exe	30
PID 2300 wrote to memory of 3036	2300	adswqadasw.exe	30
PID 2300 wrote to memory of 2916	2300	adswqadasw.exe	31
PID 2300 wrote to memory of 2916	2300	adswqadasw.exe	31
PID 2300 wrote to memory of 2916	2300	adswqadasw.exe	31
PID 2300 wrote to memory of 2916	2300	adswqadasw.exe	31

C:\Users\Admin\AppData\Local\Temp\adswqadasw.exe
"C:\Users\Admin\AppData\Local\Temp\adswqadasw.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2300
- C:\winlogon.exe
  C:\winlogon.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3036
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  2⤵
  PID:2916

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\winlogon.exe

Filesize
2KB

MD5
4428c969f83fe0fb6bb2a635fe605bce

SHA1
15efa531bc399c5e92d72cf266f8e18b4ec78bb0

SHA256
458b17876c0ea9ce182b9966f97d7617600ac6cb95c363cc7f33aec420424151

SHA512
4896c3e06391a7caca83ae36fd2a093af81ad6165979ed23232fb35a4d85a7188ecbbc66e720c4cd3d86e4c5546848ce7b02e5d8e28cd02ca0c246b091e9d809

Download Submit
memory/2300-0-0x00000000742A1000-0x00000000742A2000-memory.dmp

Filesize
4KB

Download
memory/2300-1-0x00000000742A0000-0x000000007484B000-memory.dmp

Filesize
5.7MB

Download
memory/2300-2-0x00000000742A0000-0x000000007484B000-memory.dmp

Filesize
5.7MB

Download
memory/2300-26-0x00000000742A0000-0x000000007484B000-memory.dmp

Filesize
5.7MB

Download
memory/3036-24-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/3036-22-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/3036-19-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/3036-17-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/3036-15-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/3036-13-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/3036-11-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/3036-9-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download