asyncrat | 1d59fe36f09a5d09d09d40bad413e797042545c8d9a5fe69fa4c6e746d2de6be

Resubmissions

13-01-2025 00:37

250113-ayzj3sxkay 10

12-01-2025 15:22

250112-ssbj6szqbk 10

Analysis

max time kernel
94s
max time network
118s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
12-01-2025 15:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1d59fe36f09a5d09d09d40bad413e797042545c8d9a5fe69fa4c6e746d2de6be.exe
Size

481KB
MD5

8204dfdfc0cce8c57abd207ca06ef205
SHA1

fd8547191d5e5b9ba10964c168c0a42812d68dd9
SHA256

1d59fe36f09a5d09d09d40bad413e797042545c8d9a5fe69fa4c6e746d2de6be
SHA512

402830676d9a2186cdf278bf7469ab46e3e6bb1dd5d778a4ef7e9a0c459e0d1045ea47f0755355ef489f18dbcf4d3d937a969d6db758c6d5d45d77dd499e7562
SSDEEP

6144:4ygCJK8O9BPkCGvkQENothciEohCzkNiPXF5QD01QZGjPmXIUFx6vf0vQUr6aicI:PbThCsoj+h8kNe15y01ioOLafyQAN2p

Score

10^/10

asyncrat default rat

Malware Config

Extracted

Family

asyncrat

Version

0.0.1

Botnet

Default

45.144.139.127:8000

Mutex

sdkkhfsdhoihwwhfkjshdf12qw

Attributes

delay
1
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Asyncrat family
asyncrat

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2508	1d59fe36f09a5d09d09d40bad413e797042545c8d9a5fe69fa4c6e746d2de6be.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2508 wrote to memory of 3176	2508	1d59fe36f09a5d09d09d40bad413e797042545c8d9a5fe69fa4c6e746d2de6be.exe	82
PID 2508 wrote to memory of 3176	2508	1d59fe36f09a5d09d09d40bad413e797042545c8d9a5fe69fa4c6e746d2de6be.exe	82
PID 3176 wrote to memory of 1224	3176	cmd.exe	84
PID 3176 wrote to memory of 1224	3176	cmd.exe	84

C:\Users\Admin\AppData\Local\Temp\1d59fe36f09a5d09d09d40bad413e797042545c8d9a5fe69fa4c6e746d2de6be.exe
"C:\Users\Admin\AppData\Local\Temp\1d59fe36f09a5d09d09d40bad413e797042545c8d9a5fe69fa4c6e746d2de6be.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2508
- C:\Windows\system32\cmd.exe
  "cmd" /c "curl -s https://myip.ipip.net/"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3176
- - C:\Windows\system32\curl.exe
    curl -s https://myip.ipip.net/
    3⤵
    PID:1224

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2508-1-0x00007FFF96C23000-0x00007FFF96C25000-memory.dmp

Filesize
8KB

Download
memory/2508-2-0x00000216CA280000-0x00000216CA294000-memory.dmp

Filesize
80KB

Download
memory/2508-3-0x00007FFF96C20000-0x00007FFF976E1000-memory.dmp

Filesize
10.8MB

Download
memory/2508-6-0x00007FFF96C23000-0x00007FFF96C25000-memory.dmp

Filesize
8KB

Download
memory/2508-7-0x00007FFF96C20000-0x00007FFF976E1000-memory.dmp

Filesize
10.8MB

Download
memory/2508-8-0x00007FFF96C20000-0x00007FFF976E1000-memory.dmp

Filesize
10.8MB

Download
memory/2508-9-0x00007FFF96C20000-0x00007FFF976E1000-memory.dmp

Filesize
10.8MB

Download