asyncrat | 2f7c4001b496b4bb53c75014f83a55bb7cdf06254806f5cd4591c5af4e146de7

Analysis

max time kernel
118s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
10/03/2025, 14:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

RFQ_PO_783B65/RFQ-PO783B65.bat
Size

45B
MD5

c15f0bc7c754ae5cc5f09d4a646232a5
SHA1

3463cfed84c507ea4839793db9a19b79d9218632
SHA256

1d25f7af62786393a933913bcbd4e0412b7261817ecea3aeb60e2294adaece9d
SHA512

bf5c3da788c3807d8be313765f12671cc67bac797214d7a18ab1570c6fbcbb4a8536ec169633329d51d22b087692ebfed45fd8565277a4c26df656ab6e9e43f0

Score

10^/10

asyncrat stealerium default rat stealer

Malware Config

Extracted

Family

asyncrat

Version

Venom RAT + HVNC + Stealer + Grabber v6.0.3

Botnet

Default

204.10.161.147:4955

Mutex

mzsualcjlq

Attributes

delay
1
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Asyncrat family
asyncrat
Stealerium
An open source info stealer written in C# first seen in May 2022.
stealer stealerium
Stealerium family
stealerium

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 3144 created 3444	3144	RFQ-PO783B65.png	56

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\microsofts.vbs	RFQ-PO783B65.png

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3144 set thread context of 4828	3144	RFQ-PO783B65.png	97

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3144	RFQ-PO783B65.png
3144	RFQ-PO783B65.png
3144	RFQ-PO783B65.png
3144	RFQ-PO783B65.png
4828	RFQ-PO783B65.png
4828	RFQ-PO783B65.png
4828	RFQ-PO783B65.png
4828	RFQ-PO783B65.png

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3144	RFQ-PO783B65.png
Token: SeDebugPrivilege	3144	RFQ-PO783B65.png
Token: SeDebugPrivilege	4828	RFQ-PO783B65.png

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4828	RFQ-PO783B65.png

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1560 wrote to memory of 3144	1560	cmd.exe	89
PID 1560 wrote to memory of 3144	1560	cmd.exe	89
PID 3144 wrote to memory of 4828	3144	RFQ-PO783B65.png	97
PID 3144 wrote to memory of 4828	3144	RFQ-PO783B65.png	97
PID 3144 wrote to memory of 4828	3144	RFQ-PO783B65.png	97
PID 3144 wrote to memory of 4828	3144	RFQ-PO783B65.png	97
PID 3144 wrote to memory of 4828	3144	RFQ-PO783B65.png	97
PID 3144 wrote to memory of 4828	3144	RFQ-PO783B65.png	97

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3444
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\RFQ_PO_783B65\RFQ-PO783B65.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1560
- - C:\Users\Admin\AppData\Local\Temp\RFQ_PO_783B65\RFQ-PO783B65.png
    "RFQ-PO783B65.png"
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Drops startup file
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3144
- C:\Users\Admin\AppData\Local\Temp\RFQ_PO_783B65\RFQ-PO783B65.png
  "C:\Users\Admin\AppData\Local\Temp\RFQ_PO_783B65\RFQ-PO783B65.png"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:4828

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3144-0-0x00007FFDC6493000-0x00007FFDC6495000-memory.dmp

Filesize
8KB

Download
memory/3144-1-0x00000239D5860000-0x00000239D597C000-memory.dmp

Filesize
1.1MB

Download
memory/3144-2-0x00000239EFE10000-0x00000239EFF16000-memory.dmp

Filesize
1.0MB

Download
memory/3144-4-0x00000239EFE10000-0x00000239EFF10000-memory.dmp

Filesize
1024KB

Download
memory/3144-58-0x00000239EFE10000-0x00000239EFF10000-memory.dmp

Filesize
1024KB

Download
memory/3144-56-0x00000239EFE10000-0x00000239EFF10000-memory.dmp

Filesize
1024KB

Download
memory/3144-54-0x00000239EFE10000-0x00000239EFF10000-memory.dmp

Filesize
1024KB

Download
memory/3144-52-0x00000239EFE10000-0x00000239EFF10000-memory.dmp

Filesize
1024KB

Download
memory/3144-51-0x00000239EFE10000-0x00000239EFF10000-memory.dmp

Filesize
1024KB

Download
memory/3144-46-0x00000239EFE10000-0x00000239EFF10000-memory.dmp

Filesize
1024KB

Download
memory/3144-44-0x00000239EFE10000-0x00000239EFF10000-memory.dmp

Filesize
1024KB

Download
memory/3144-43-0x00000239EFE10000-0x00000239EFF10000-memory.dmp

Filesize
1024KB

Download
memory/3144-40-0x00000239EFE10000-0x00000239EFF10000-memory.dmp

Filesize
1024KB

Download
memory/3144-38-0x00000239EFE10000-0x00000239EFF10000-memory.dmp

Filesize
1024KB

Download
memory/3144-34-0x00000239EFE10000-0x00000239EFF10000-memory.dmp

Filesize
1024KB

Download
memory/3144-32-0x00000239EFE10000-0x00000239EFF10000-memory.dmp

Filesize
1024KB

Download
memory/3144-30-0x00000239EFE10000-0x00000239EFF10000-memory.dmp

Filesize
1024KB

Download
memory/3144-28-0x00000239EFE10000-0x00000239EFF10000-memory.dmp

Filesize
1024KB

Download
memory/3144-24-0x00000239EFE10000-0x00000239EFF10000-memory.dmp

Filesize
1024KB

Download
memory/3144-18-0x00000239EFE10000-0x00000239EFF10000-memory.dmp

Filesize
1024KB

Download
memory/3144-14-0x00000239EFE10000-0x00000239EFF10000-memory.dmp

Filesize
1024KB

Download
memory/3144-12-0x00000239EFE10000-0x00000239EFF10000-memory.dmp

Filesize
1024KB

Download
memory/3144-10-0x00000239EFE10000-0x00000239EFF10000-memory.dmp

Filesize
1024KB

Download
memory/3144-8-0x00000239EFE10000-0x00000239EFF10000-memory.dmp

Filesize
1024KB

Download
memory/3144-66-0x00000239EFE10000-0x00000239EFF10000-memory.dmp

Filesize
1024KB

Download
memory/3144-119-0x00007FFDC6490000-0x00007FFDC6F51000-memory.dmp

Filesize
10.8MB

Download
memory/3144-64-0x00000239EFE10000-0x00000239EFF10000-memory.dmp

Filesize
1024KB

Download
memory/3144-62-0x00000239EFE10000-0x00000239EFF10000-memory.dmp

Filesize
1024KB

Download
memory/3144-60-0x00000239EFE10000-0x00000239EFF10000-memory.dmp

Filesize
1024KB

Download
memory/3144-20-0x00000239EFE10000-0x00000239EFF10000-memory.dmp

Filesize
1024KB

Download
memory/3144-6-0x00000239EFE10000-0x00000239EFF10000-memory.dmp

Filesize
1024KB

Download
memory/3144-48-0x00000239EFE10000-0x00000239EFF10000-memory.dmp

Filesize
1024KB

Download
memory/3144-36-0x00000239EFE10000-0x00000239EFF10000-memory.dmp

Filesize
1024KB

Download
memory/3144-26-0x00000239EFE10000-0x00000239EFF10000-memory.dmp

Filesize
1024KB

Download
memory/3144-22-0x00000239EFE10000-0x00000239EFF10000-memory.dmp

Filesize
1024KB

Download
memory/3144-16-0x00000239EFE10000-0x00000239EFF10000-memory.dmp

Filesize
1024KB

Download
memory/3144-3-0x00000239EFE10000-0x00000239EFF10000-memory.dmp

Filesize
1024KB

Download
memory/3144-1326-0x00007FFDC6490000-0x00007FFDC6F51000-memory.dmp

Filesize
10.8MB

Download
memory/3144-1327-0x00000239D5D90000-0x00000239D5DF0000-memory.dmp

Filesize
384KB

Download
memory/3144-1328-0x00000239F0010000-0x00000239F006C000-memory.dmp

Filesize
368KB

Download
memory/3144-1329-0x00000239F0070000-0x00000239F00BC000-memory.dmp

Filesize
304KB

Download
memory/3144-1330-0x00007FFDC6490000-0x00007FFDC6F51000-memory.dmp

Filesize
10.8MB

Download
memory/3144-1331-0x00007FFDC6493000-0x00007FFDC6495000-memory.dmp

Filesize
8KB

Download
memory/3144-1332-0x00007FFDC6490000-0x00007FFDC6F51000-memory.dmp

Filesize
10.8MB

Download
memory/3144-1333-0x00007FFDC6490000-0x00007FFDC6F51000-memory.dmp

Filesize
10.8MB

Download
memory/3144-1334-0x00007FFDC6490000-0x00007FFDC6F51000-memory.dmp

Filesize
10.8MB

Download
memory/3144-1335-0x00000239F09B0000-0x00000239F0A04000-memory.dmp

Filesize
336KB

Download
memory/3144-1341-0x00007FFDC6490000-0x00007FFDC6F51000-memory.dmp

Filesize
10.8MB

Download
memory/3144-1344-0x00007FFDC6490000-0x00007FFDC6F51000-memory.dmp

Filesize
10.8MB

Download
memory/3144-1345-0x00007FFDC6490000-0x00007FFDC6F51000-memory.dmp

Filesize
10.8MB

Download
memory/4828-1346-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/4828-1348-0x00007FFDC6490000-0x00007FFDC6F51000-memory.dmp

Filesize
10.8MB

Download
memory/4828-1349-0x00007FFDC6490000-0x00007FFDC6F51000-memory.dmp

Filesize
10.8MB

Download
memory/4828-1350-0x00007FFDC6490000-0x00007FFDC6F51000-memory.dmp

Filesize
10.8MB

Download
memory/4828-1353-0x00007FFDC6490000-0x00007FFDC6F51000-memory.dmp

Filesize
10.8MB

Download
memory/4828-1354-0x00007FFDC6490000-0x00007FFDC6F51000-memory.dmp

Filesize
10.8MB

Download
memory/4828-1356-0x00007FFDC6490000-0x00007FFDC6F51000-memory.dmp

Filesize
10.8MB

Download
memory/4828-1357-0x00007FFDC6490000-0x00007FFDC6F51000-memory.dmp

Filesize
10.8MB

Download
memory/4828-1358-0x00007FFDC6490000-0x00007FFDC6F51000-memory.dmp

Filesize
10.8MB

Download
memory/4828-1359-0x00007FFDC6490000-0x00007FFDC6F51000-memory.dmp

Filesize
10.8MB

Download
memory/4828-1360-0x00007FFDC6490000-0x00007FFDC6F51000-memory.dmp

Filesize
10.8MB

Download
memory/4828-1361-0x000002462B180000-0x000002462B1F6000-memory.dmp

Filesize
472KB

Download
memory/4828-1362-0x000002462AC40000-0x000002462AC4E000-memory.dmp

Filesize
56KB

Download
memory/4828-1363-0x000002462B100000-0x000002462B11E000-memory.dmp

Filesize
120KB

Download
memory/4828-1364-0x000002462B200000-0x000002462B90A000-memory.dmp

Filesize
7.0MB

Download
memory/4828-1365-0x000002462B160000-0x000002462B16A000-memory.dmp

Filesize
40KB

Download
memory/4828-1366-0x00007FFDC6490000-0x00007FFDC6F51000-memory.dmp

Filesize
10.8MB

Download
memory/4828-1369-0x00007FFDC6490000-0x00007FFDC6F51000-memory.dmp

Filesize
10.8MB

Download