asyncrat | aead3b29e4eb3a2c5499b67eb81a609bd85944a1d7ec6b9557be527a0c566929

Resubmissions

12/01/2025, 12:56

250112-p6ebfasras10

10/01/2025, 05:18

250110-fzmvkawkdn10

Analysis

max time kernel
895s
max time network
898s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
12/01/2025, 12:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
JaffaCakes118_dbf61f566a642cdd0df3fc1d078debb8.exe
Size 156KB
Sample250112-p6ebfasras
SHA256 aead3b29e4eb3a2c5499b67eb81a609bd85944a1d7ec6b9557be527a0c566929
MD5 dbf61f566a642cdd0df3fc1d078debb8
SHA1 0294ef20386693a5699bc4e57653f966f0eaf028
SHA512 4de09065e244d791d8c909a1c6cd689063f8318af2648498f9cf435be19b666aba096f1b2946a75200cacee5a63d705fb545c42a9d6f7a5dbf49d3cd0865467c
SSDEEP 3072:bqOQcs8pmp5W4J44tDlsAU/UwtRUsUUc2fjRs+DVs+A1+HX5wsOZ4T3EMXckbNGV:bqLl2V7H6sA4bEMXc4VLvTGc
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

asyncrat default discovery rat rezer0

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

Default

winx.xcapdatap.capetown:6204

Mutex

AsyncMutex_6SI8OkPnk

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Asyncrat family
asyncrat

ReZer0 packer 1 IoCs

Detects ReZer0, a packer with multiple versions used in various campaigns.

rezer0

resource	yara_rule
behavioral1/memory/1088-6-0x0000000000B00000-0x0000000000B18000-memory.dmp	rezer0

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1088 set thread context of 2904	1088	JaffaCakes118_dbf61f566a642cdd0df3fc1d078debb8.exe	33

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_dbf61f566a642cdd0df3fc1d078debb8.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_dbf61f566a642cdd0df3fc1d078debb8.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1188	schtasks.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 1088 wrote to memory of 1188	1088	JaffaCakes118_dbf61f566a642cdd0df3fc1d078debb8.exe	31
PID 1088 wrote to memory of 1188	1088	JaffaCakes118_dbf61f566a642cdd0df3fc1d078debb8.exe	31
PID 1088 wrote to memory of 1188	1088	JaffaCakes118_dbf61f566a642cdd0df3fc1d078debb8.exe	31
PID 1088 wrote to memory of 1188	1088	JaffaCakes118_dbf61f566a642cdd0df3fc1d078debb8.exe	31
PID 1088 wrote to memory of 2904	1088	JaffaCakes118_dbf61f566a642cdd0df3fc1d078debb8.exe	33
PID 1088 wrote to memory of 2904	1088	JaffaCakes118_dbf61f566a642cdd0df3fc1d078debb8.exe	33
PID 1088 wrote to memory of 2904	1088	JaffaCakes118_dbf61f566a642cdd0df3fc1d078debb8.exe	33
PID 1088 wrote to memory of 2904	1088	JaffaCakes118_dbf61f566a642cdd0df3fc1d078debb8.exe	33
PID 1088 wrote to memory of 2904	1088	JaffaCakes118_dbf61f566a642cdd0df3fc1d078debb8.exe	33
PID 1088 wrote to memory of 2904	1088	JaffaCakes118_dbf61f566a642cdd0df3fc1d078debb8.exe	33
PID 1088 wrote to memory of 2904	1088	JaffaCakes118_dbf61f566a642cdd0df3fc1d078debb8.exe	33
PID 1088 wrote to memory of 2904	1088	JaffaCakes118_dbf61f566a642cdd0df3fc1d078debb8.exe	33
PID 1088 wrote to memory of 2904	1088	JaffaCakes118_dbf61f566a642cdd0df3fc1d078debb8.exe	33

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_dbf61f566a642cdd0df3fc1d078debb8.exe
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_dbf61f566a642cdd0df3fc1d078debb8.exe cmd /c %SIGILL% "SIGTERM|DELETE|SIGKILL"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1088
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\PqVwJtjSm" /XML "C:\Users\Admin\AppData\Local\Temp\tmp367B.tmp"
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:1188
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_dbf61f566a642cdd0df3fc1d078debb8.exe
  "{path}"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2904

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmp367B.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp367B.tmp
Size 1KB
SHA256 2ab60fbaee73ea4d342cda277cc432be33b73db207cbd89b1d4056f17f93f5e2
MD5 ac08641f7ac8ff08558fc6ba8df7cc30
SHA1 80c2f3e75f1dc72f57472cab7287535d363e4e68
SHA512 87fae00c1e0baa4864359657985a7beae9260d13652323cd4c24a187d0f2a8a67c57f9055021d8ceb0c891840d22bdd87d89cbb85af32743a840797b0786830b
MD5 SHA1 SHA512

Submit Download

memory/1088-27-0x00000000742B0000-0x000000007499E000-memory.dmp

Download

memory/1088-2-0x00000000004D0000-0x00000000004D8000-memory.dmp

Download

memory/1088-3-0x00000000742B0000-0x000000007499E000-memory.dmp

Download

memory/1088-4-0x00000000742BE000-0x00000000742BF000-memory.dmp

Download

memory/1088-5-0x00000000742B0000-0x000000007499E000-memory.dmp

Download

memory/1088-6-0x0000000000B00000-0x0000000000B18000-memory.dmp

Download

memory/1088-1-0x0000000000C80000-0x0000000000CAC000-memory.dmp

Download

memory/1088-0-0x00000000742BE000-0x00000000742BF000-memory.dmp

Download

memory/2904-22-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/2904-14-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/2904-18-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Download

memory/2904-10-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/2904-12-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/2904-20-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/2904-16-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/2904-26-0x00000000742B0000-0x000000007499E000-memory.dmp

Download

memory/2904-25-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/2904-28-0x00000000742B0000-0x000000007499E000-memory.dmp

Download

memory/2904-29-0x00000000742B0000-0x000000007499E000-memory.dmp

Download

memory/2904-30-0x00000000742B0000-0x000000007499E000-memory.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads