asyncrat | 1d59fe36f09a5d09d09d40bad413e797042545c8d9a5fe69fa4c6e746d2de6be

Resubmissions

13/01/2025, 00:37

250113-ayzj3sxkay 10

12/01/2025, 15:22

250112-ssbj6szqbk 10

Analysis

max time kernel
418s
max time network
894s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
13/01/2025, 00:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1d59fe36f09a5d09d09d40bad413e797042545c8d9a5fe69fa4c6e746d2de6be.exe
Size

481KB
MD5

8204dfdfc0cce8c57abd207ca06ef205
SHA1

fd8547191d5e5b9ba10964c168c0a42812d68dd9
SHA256

1d59fe36f09a5d09d09d40bad413e797042545c8d9a5fe69fa4c6e746d2de6be
SHA512

402830676d9a2186cdf278bf7469ab46e3e6bb1dd5d778a4ef7e9a0c459e0d1045ea47f0755355ef489f18dbcf4d3d937a969d6db758c6d5d45d77dd499e7562
SSDEEP

6144:4ygCJK8O9BPkCGvkQENothciEohCzkNiPXF5QD01QZGjPmXIUFx6vf0vQUr6aicI:PbThCsoj+h8kNe15y01ioOLafyQAN2p

Score

10^/10

asyncrat default rat

Malware Config

Extracted

Family

asyncrat

Version

0.0.1

Botnet

Default

45.144.139.127:8000

Mutex

sdkkhfsdhoihwwhfkjshdf12qw

Attributes

delay
1
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Asyncrat family
asyncrat

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4496	1d59fe36f09a5d09d09d40bad413e797042545c8d9a5fe69fa4c6e746d2de6be.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4496 wrote to memory of 4768	4496	1d59fe36f09a5d09d09d40bad413e797042545c8d9a5fe69fa4c6e746d2de6be.exe	83
PID 4496 wrote to memory of 4768	4496	1d59fe36f09a5d09d09d40bad413e797042545c8d9a5fe69fa4c6e746d2de6be.exe	83
PID 4768 wrote to memory of 2408	4768	cmd.exe	85
PID 4768 wrote to memory of 2408	4768	cmd.exe	85

C:\Users\Admin\AppData\Local\Temp\1d59fe36f09a5d09d09d40bad413e797042545c8d9a5fe69fa4c6e746d2de6be.exe
C:\Users\Admin\AppData\Local\Temp\1d59fe36f09a5d09d09d40bad413e797042545c8d9a5fe69fa4c6e746d2de6be.exe cmd /c %SIGILL% "SIGTERM|DELETE|SIGKILL"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4496
- C:\Windows\system32\cmd.exe
  "cmd" /c "curl -s https://myip.ipip.net/"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4768
- - C:\Windows\system32\curl.exe
    curl -s https://myip.ipip.net/
    3⤵
    PID:2408

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4496-1-0x00007FFD8C983000-0x00007FFD8C985000-memory.dmp

Filesize
8KB

Download
memory/4496-2-0x000002368FAE0000-0x000002368FAF4000-memory.dmp

Filesize
80KB

Download
memory/4496-3-0x00007FFD8C980000-0x00007FFD8D441000-memory.dmp

Filesize
10.8MB

Download
memory/4496-6-0x00007FFD8C983000-0x00007FFD8C985000-memory.dmp

Filesize
8KB

Download
memory/4496-7-0x00007FFD8C980000-0x00007FFD8D441000-memory.dmp

Filesize
10.8MB

Download
memory/4496-8-0x00007FFD8C980000-0x00007FFD8D441000-memory.dmp

Filesize
10.8MB

Download
memory/4496-9-0x00007FFD8C980000-0x00007FFD8D441000-memory.dmp

Filesize
10.8MB

Download