asyncrat | 084a5d9e811bceb84ef2537dafdf341452ff75eaa98ecd8dca0ff03cb2fb3b09

Analysis

max time kernel
94s
max time network
119s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
02-01-2025 01:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

084a5d9e811bceb84ef2537dafdf341452ff75eaa98ecd8dca0ff03cb2fb3b09.exe
Size

2.5MB
MD5

5027c2b9f1fdff0a34e3c8f1b3d918b6
SHA1

54fccc9457dd99120a6f9af9e2197556986dd2d1
SHA256

084a5d9e811bceb84ef2537dafdf341452ff75eaa98ecd8dca0ff03cb2fb3b09
SHA512

196bd82126321807d0b87dece3ab57e06a584fa434fd885455e90d663a1d666ed8faf8ba460eb47283bc2391831bc08e85bfef2c74dcb2e7cbf341d668ba2497
SSDEEP

24576:MJl++6A0PHb+DC/KhZZHuG67h9np42UhTwNIa0rkZmFfgIr3K8tmgTNDTql7vzyI:Mq+6A0qWQTwNKJgEbtp6l7vzj8z4

Score

10^/10

asyncrat botnet rat

Malware Config

Extracted

Family

asyncrat

Version

1.0.7

Botnet

botnet

127.0.0.1:8848

213.32.110.214:8848

Mutex

Bw6q7EX6pdIsLygvQDa8AHHMuX7rT6dI

Attributes

delay
1
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Asyncrat family
asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral2/files/0x0007000000023ca0-4.dat	family_asyncrat

Executes dropped EXE 1 IoCs

pid	Process
980	InstallUtil.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	980	InstallUtil.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3484 wrote to memory of 980	3484	084a5d9e811bceb84ef2537dafdf341452ff75eaa98ecd8dca0ff03cb2fb3b09.exe	84
PID 3484 wrote to memory of 980	3484	084a5d9e811bceb84ef2537dafdf341452ff75eaa98ecd8dca0ff03cb2fb3b09.exe	84
PID 3484 wrote to memory of 2364	3484	084a5d9e811bceb84ef2537dafdf341452ff75eaa98ecd8dca0ff03cb2fb3b09.exe	98
PID 3484 wrote to memory of 2364	3484	084a5d9e811bceb84ef2537dafdf341452ff75eaa98ecd8dca0ff03cb2fb3b09.exe	98

C:\Users\Admin\AppData\Local\Temp\084a5d9e811bceb84ef2537dafdf341452ff75eaa98ecd8dca0ff03cb2fb3b09.exe
"C:\Users\Admin\AppData\Local\Temp\084a5d9e811bceb84ef2537dafdf341452ff75eaa98ecd8dca0ff03cb2fb3b09.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3484
- C:\Users\Admin\AppData\Roaming\InstallUtil.exe
  C:\Users\Admin\AppData\Roaming\InstallUtil.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:980
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\fc2c028b26c440a2.bat
  2⤵
  PID:2364

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\fc2c028b26c440a2.bat

Filesize
248B

MD5
4f06cee8736baa6aa258f96f5b8d76e9

SHA1
8788713924aae0a077e31df7e6881308e09a5703

SHA256
be1b00242ffc44c3fd744ab87d09a498896bf34b8df4f9475f5f18001d880f35

SHA512
a8c13dab930b1ee946bd8ec0f8d6498113c77014781d37b1eec03bcab4206b37f79b2cf3eb686c0474778731b6b7e5e3bb86f86c4ad84f5a205223c707944de6

Download Submit
C:\Users\Admin\AppData\Roaming\InstallUtil.exe

Filesize
47KB

MD5
9e297d54593f6796c019ecc82a153deb

SHA1
390ce09cceed3c7d52cfbdbbf8adc5977d0b3efb

SHA256
ec9c835a31bff47554acfb4a4a7bce2b1101a93a2f312459a23227dd6885e062

SHA512
8718fb3f1fc741ca6c2310e473a157898468c88e3a4bdbba404bff05407a627965fdb4248106b5b2a8638f7258f220a4d9150fde94df679a726b18a4121f0fc1

Download Submit
memory/980-6-0x00007FFE54FA3000-0x00007FFE54FA5000-memory.dmp

Filesize
8KB

Download
memory/980-7-0x0000000000DA0000-0x0000000000DB2000-memory.dmp

Filesize
72KB

Download
memory/980-8-0x00007FFE54FA0000-0x00007FFE55A61000-memory.dmp

Filesize
10.8MB

Download
memory/980-9-0x00007FFE54FA3000-0x00007FFE54FA5000-memory.dmp

Filesize
8KB

Download
memory/980-10-0x00007FFE54FA0000-0x00007FFE55A61000-memory.dmp

Filesize
10.8MB

Download
memory/980-13-0x00007FFE54FA0000-0x00007FFE55A61000-memory.dmp

Filesize
10.8MB

Download
memory/980-16-0x00007FFE54FA0000-0x00007FFE55A61000-memory.dmp

Filesize
10.8MB

Download