asyncrat | 2f7c4001b496b4bb53c75014f83a55bb7cdf06254806f5cd4591c5af4e146de7

Analysis

max time kernel
131s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
11/03/2025, 02:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

RFQ_PO_783B65/RFQ-PO783B65.exe
Size

1.1MB
MD5

c655f74a0a364d39ca8c4c7f46647a15
SHA1

04fa23d7ff51f5b503c991f7d9ff0d4c919b89b0
SHA256

6ff96de44e65161cfb8afd5e46e30b4940be0187b0c5422ff270f4e5adfb60a7
SHA512

120b10adc8b83feeaf26663f954ecba4e06dd6a3100f1d0405e5c054f62441ea9ad92015a296e9d56f9a295b11dbb54e5bcfddd26958a0dcc1633126c2f9a09e
SSDEEP

24576:mKyowlc5WdDtWmW6/2t1tm5JcL8FPujl3mV0UKAaL:93wlcctTf2t1tm56LG4LFAa

Score

10^/10

asyncrat default discovery rat

Malware Config

Extracted

Family

asyncrat

Version

Venom RAT + HVNC + Stealer + Grabber v6.0.3

Botnet

Default

204.10.161.147:4955

Mutex

mzsualcjlq

Attributes

delay
1
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Asyncrat family
asyncrat

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 4616 created 3500	4616	RFQ-PO783B65.exe	56

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\microsofts.vbs	RFQ-PO783B65.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4616 set thread context of 468	4616	RFQ-PO783B65.exe	95

Suspicious behavior: EnumeratesProcesses 47 IoCs

pid	Process
4616	RFQ-PO783B65.exe
4616	RFQ-PO783B65.exe
4616	RFQ-PO783B65.exe
468	RFQ-PO783B65.exe
468	RFQ-PO783B65.exe
468	RFQ-PO783B65.exe
468	RFQ-PO783B65.exe
468	RFQ-PO783B65.exe
468	RFQ-PO783B65.exe
468	RFQ-PO783B65.exe
468	RFQ-PO783B65.exe
468	RFQ-PO783B65.exe
468	RFQ-PO783B65.exe
468	RFQ-PO783B65.exe
468	RFQ-PO783B65.exe
468	RFQ-PO783B65.exe
468	RFQ-PO783B65.exe
468	RFQ-PO783B65.exe
468	RFQ-PO783B65.exe
468	RFQ-PO783B65.exe
468	RFQ-PO783B65.exe
468	RFQ-PO783B65.exe
468	RFQ-PO783B65.exe
468	RFQ-PO783B65.exe
468	RFQ-PO783B65.exe
468	RFQ-PO783B65.exe
468	RFQ-PO783B65.exe
468	RFQ-PO783B65.exe
468	RFQ-PO783B65.exe
468	RFQ-PO783B65.exe
468	RFQ-PO783B65.exe
468	RFQ-PO783B65.exe
468	RFQ-PO783B65.exe
468	RFQ-PO783B65.exe
468	RFQ-PO783B65.exe
468	RFQ-PO783B65.exe
468	RFQ-PO783B65.exe
468	RFQ-PO783B65.exe
468	RFQ-PO783B65.exe
468	RFQ-PO783B65.exe
468	RFQ-PO783B65.exe
468	RFQ-PO783B65.exe
468	RFQ-PO783B65.exe
468	RFQ-PO783B65.exe
468	RFQ-PO783B65.exe
468	RFQ-PO783B65.exe
468	RFQ-PO783B65.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4616	RFQ-PO783B65.exe
Token: SeDebugPrivilege	4616	RFQ-PO783B65.exe
Token: SeDebugPrivilege	468	RFQ-PO783B65.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
468	RFQ-PO783B65.exe
468	RFQ-PO783B65.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4616 wrote to memory of 468	4616	RFQ-PO783B65.exe	95
PID 4616 wrote to memory of 468	4616	RFQ-PO783B65.exe	95
PID 4616 wrote to memory of 468	4616	RFQ-PO783B65.exe	95
PID 4616 wrote to memory of 468	4616	RFQ-PO783B65.exe	95
PID 4616 wrote to memory of 468	4616	RFQ-PO783B65.exe	95
PID 4616 wrote to memory of 468	4616	RFQ-PO783B65.exe	95
PID 468 wrote to memory of 2076	468	RFQ-PO783B65.exe	98
PID 468 wrote to memory of 2076	468	RFQ-PO783B65.exe	98
PID 468 wrote to memory of 2076	468	RFQ-PO783B65.exe	98
PID 468 wrote to memory of 2076	468	RFQ-PO783B65.exe	98
PID 468 wrote to memory of 3468	468	RFQ-PO783B65.exe	99
PID 468 wrote to memory of 3468	468	RFQ-PO783B65.exe	99
PID 468 wrote to memory of 3468	468	RFQ-PO783B65.exe	99
PID 468 wrote to memory of 3468	468	RFQ-PO783B65.exe	99
PID 468 wrote to memory of 3028	468	RFQ-PO783B65.exe	100
PID 468 wrote to memory of 3028	468	RFQ-PO783B65.exe	100
PID 468 wrote to memory of 3028	468	RFQ-PO783B65.exe	100
PID 468 wrote to memory of 3028	468	RFQ-PO783B65.exe	100
PID 468 wrote to memory of 4880	468	RFQ-PO783B65.exe	101
PID 468 wrote to memory of 4880	468	RFQ-PO783B65.exe	101
PID 468 wrote to memory of 4880	468	RFQ-PO783B65.exe	101
PID 468 wrote to memory of 4880	468	RFQ-PO783B65.exe	101
PID 468 wrote to memory of 4116	468	RFQ-PO783B65.exe	102
PID 468 wrote to memory of 4116	468	RFQ-PO783B65.exe	102
PID 468 wrote to memory of 4116	468	RFQ-PO783B65.exe	102
PID 468 wrote to memory of 4116	468	RFQ-PO783B65.exe	102
PID 468 wrote to memory of 3872	468	RFQ-PO783B65.exe	103
PID 468 wrote to memory of 3872	468	RFQ-PO783B65.exe	103
PID 468 wrote to memory of 3872	468	RFQ-PO783B65.exe	103
PID 468 wrote to memory of 3872	468	RFQ-PO783B65.exe	103
PID 468 wrote to memory of 3564	468	RFQ-PO783B65.exe	104
PID 468 wrote to memory of 3564	468	RFQ-PO783B65.exe	104
PID 468 wrote to memory of 3564	468	RFQ-PO783B65.exe	104
PID 468 wrote to memory of 3564	468	RFQ-PO783B65.exe	104
PID 468 wrote to memory of 5020	468	RFQ-PO783B65.exe	105
PID 468 wrote to memory of 5020	468	RFQ-PO783B65.exe	105
PID 468 wrote to memory of 5020	468	RFQ-PO783B65.exe	105
PID 468 wrote to memory of 5020	468	RFQ-PO783B65.exe	105
PID 468 wrote to memory of 2836	468	RFQ-PO783B65.exe	106
PID 468 wrote to memory of 2836	468	RFQ-PO783B65.exe	106
PID 468 wrote to memory of 2836	468	RFQ-PO783B65.exe	106
PID 468 wrote to memory of 2836	468	RFQ-PO783B65.exe	106
PID 468 wrote to memory of 3084	468	RFQ-PO783B65.exe	107
PID 468 wrote to memory of 3084	468	RFQ-PO783B65.exe	107
PID 468 wrote to memory of 3084	468	RFQ-PO783B65.exe	107
PID 468 wrote to memory of 3084	468	RFQ-PO783B65.exe	107
PID 468 wrote to memory of 996	468	RFQ-PO783B65.exe	108
PID 468 wrote to memory of 996	468	RFQ-PO783B65.exe	108
PID 468 wrote to memory of 996	468	RFQ-PO783B65.exe	108
PID 468 wrote to memory of 996	468	RFQ-PO783B65.exe	108
PID 468 wrote to memory of 1020	468	RFQ-PO783B65.exe	109
PID 468 wrote to memory of 1020	468	RFQ-PO783B65.exe	109
PID 468 wrote to memory of 1020	468	RFQ-PO783B65.exe	109
PID 468 wrote to memory of 1020	468	RFQ-PO783B65.exe	109
PID 468 wrote to memory of 2544	468	RFQ-PO783B65.exe	110
PID 468 wrote to memory of 2544	468	RFQ-PO783B65.exe	110
PID 468 wrote to memory of 2544	468	RFQ-PO783B65.exe	110
PID 468 wrote to memory of 2544	468	RFQ-PO783B65.exe	110
PID 468 wrote to memory of 5100	468	RFQ-PO783B65.exe	111
PID 468 wrote to memory of 5100	468	RFQ-PO783B65.exe	111
PID 468 wrote to memory of 5100	468	RFQ-PO783B65.exe	111
PID 468 wrote to memory of 5100	468	RFQ-PO783B65.exe	111
PID 468 wrote to memory of 3536	468	RFQ-PO783B65.exe	112
PID 468 wrote to memory of 3536	468	RFQ-PO783B65.exe	112

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3500
- C:\Users\Admin\AppData\Local\Temp\RFQ_PO_783B65\RFQ-PO783B65.exe
  "C:\Users\Admin\AppData\Local\Temp\RFQ_PO_783B65\RFQ-PO783B65.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Drops startup file
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4616
- C:\Users\Admin\AppData\Local\Temp\RFQ_PO_783B65\RFQ-PO783B65.exe
  "C:\Users\Admin\AppData\Local\Temp\RFQ_PO_783B65\RFQ-PO783B65.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:468
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:2076
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:3468
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:3028
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:4880
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:4116
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:3872
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:3564
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:5020
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:2836
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:3084
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:996
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:1020
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:2544
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:5100
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:3536
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:1688
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:1548
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:3244
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:3516
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:4856

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/468-1346-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/468-1364-0x00007FFF40B10000-0x00007FFF415D1000-memory.dmp

Filesize
10.8MB

Download
memory/468-1362-0x000001C36B380000-0x000001C36B38A000-memory.dmp

Filesize
40KB

Download
memory/468-1361-0x000001C36BB60000-0x000001C36BB7E000-memory.dmp

Filesize
120KB

Download
memory/468-1360-0x000001C3531C0000-0x000001C3531CE000-memory.dmp

Filesize
56KB

Download
memory/468-1359-0x000001C36BF90000-0x000001C36C006000-memory.dmp

Filesize
472KB

Download
memory/468-1358-0x00007FFF40B10000-0x00007FFF415D1000-memory.dmp

Filesize
10.8MB

Download
memory/468-1357-0x00007FFF40B10000-0x00007FFF415D1000-memory.dmp

Filesize
10.8MB

Download
memory/468-1356-0x00007FFF40B10000-0x00007FFF415D1000-memory.dmp

Filesize
10.8MB

Download
memory/468-1355-0x00007FFF40B10000-0x00007FFF415D1000-memory.dmp

Filesize
10.8MB

Download
memory/468-1354-0x00007FFF40B10000-0x00007FFF415D1000-memory.dmp

Filesize
10.8MB

Download
memory/468-1351-0x00007FFF40B10000-0x00007FFF415D1000-memory.dmp

Filesize
10.8MB

Download
memory/468-1352-0x00007FFF40B10000-0x00007FFF415D1000-memory.dmp

Filesize
10.8MB

Download
memory/468-1350-0x00007FFF40B10000-0x00007FFF415D1000-memory.dmp

Filesize
10.8MB

Download
memory/468-1349-0x00007FFF40B10000-0x00007FFF415D1000-memory.dmp

Filesize
10.8MB

Download
memory/4616-60-0x00000176FD930000-0x00000176FDA30000-memory.dmp

Filesize
1024KB

Download
memory/4616-1329-0x00000176FDB90000-0x00000176FDBDC000-memory.dmp

Filesize
304KB

Download
memory/4616-34-0x00000176FD930000-0x00000176FDA30000-memory.dmp

Filesize
1024KB

Download
memory/4616-32-0x00000176FD930000-0x00000176FDA30000-memory.dmp

Filesize
1024KB

Download
memory/4616-30-0x00000176FD930000-0x00000176FDA30000-memory.dmp

Filesize
1024KB

Download
memory/4616-26-0x00000176FD930000-0x00000176FDA30000-memory.dmp

Filesize
1024KB

Download
memory/4616-24-0x00000176FD930000-0x00000176FDA30000-memory.dmp

Filesize
1024KB

Download
memory/4616-22-0x00000176FD930000-0x00000176FDA30000-memory.dmp

Filesize
1024KB

Download
memory/4616-20-0x00000176FD930000-0x00000176FDA30000-memory.dmp

Filesize
1024KB

Download
memory/4616-18-0x00000176FD930000-0x00000176FDA30000-memory.dmp

Filesize
1024KB

Download
memory/4616-16-0x00000176FD930000-0x00000176FDA30000-memory.dmp

Filesize
1024KB

Download
memory/4616-14-0x00000176FD930000-0x00000176FDA30000-memory.dmp

Filesize
1024KB

Download
memory/4616-12-0x00000176FD930000-0x00000176FDA30000-memory.dmp

Filesize
1024KB

Download
memory/4616-10-0x00000176FD930000-0x00000176FDA30000-memory.dmp

Filesize
1024KB

Download
memory/4616-6-0x00000176FD930000-0x00000176FDA30000-memory.dmp

Filesize
1024KB

Download
memory/4616-4-0x00000176FD930000-0x00000176FDA30000-memory.dmp

Filesize
1024KB

Download
memory/4616-3-0x00000176FD930000-0x00000176FDA30000-memory.dmp

Filesize
1024KB

Download
memory/4616-0-0x00007FFF40B13000-0x00007FFF40B15000-memory.dmp

Filesize
8KB

Download
memory/4616-46-0x00000176FD930000-0x00000176FDA30000-memory.dmp

Filesize
1024KB

Download
memory/4616-28-0x00000176FD930000-0x00000176FDA30000-memory.dmp

Filesize
1024KB

Download
memory/4616-8-0x00000176FD930000-0x00000176FDA30000-memory.dmp

Filesize
1024KB

Download
memory/4616-62-0x00000176FD930000-0x00000176FDA30000-memory.dmp

Filesize
1024KB

Download
memory/4616-1326-0x00007FFF40B10000-0x00007FFF415D1000-memory.dmp

Filesize
10.8MB

Download
memory/4616-1327-0x00000176FD880000-0x00000176FD8E0000-memory.dmp

Filesize
384KB

Download
memory/4616-1328-0x00000176FDB30000-0x00000176FDB8C000-memory.dmp

Filesize
368KB

Download
memory/4616-36-0x00000176FD930000-0x00000176FDA30000-memory.dmp

Filesize
1024KB

Download
memory/4616-1330-0x00007FFF40B10000-0x00007FFF415D1000-memory.dmp

Filesize
10.8MB

Download
memory/4616-1331-0x00007FFF40B13000-0x00007FFF40B15000-memory.dmp

Filesize
8KB

Download
memory/4616-1332-0x00007FFF40B10000-0x00007FFF415D1000-memory.dmp

Filesize
10.8MB

Download
memory/4616-1333-0x00007FFF40B10000-0x00007FFF415D1000-memory.dmp

Filesize
10.8MB

Download
memory/4616-1334-0x00007FFF40B10000-0x00007FFF415D1000-memory.dmp

Filesize
10.8MB

Download
memory/4616-1335-0x00000176FE490000-0x00000176FE4E4000-memory.dmp

Filesize
336KB

Download
memory/4616-1341-0x00007FFF40B10000-0x00007FFF415D1000-memory.dmp

Filesize
10.8MB

Download
memory/4616-1343-0x00007FFF40B10000-0x00007FFF415D1000-memory.dmp

Filesize
10.8MB

Download
memory/4616-38-0x00000176FD930000-0x00000176FDA30000-memory.dmp

Filesize
1024KB

Download
memory/4616-1345-0x00007FFF40B10000-0x00007FFF415D1000-memory.dmp

Filesize
10.8MB

Download
memory/4616-1348-0x00007FFF40B10000-0x00007FFF415D1000-memory.dmp

Filesize
10.8MB

Download
memory/4616-40-0x00000176FD930000-0x00000176FDA30000-memory.dmp

Filesize
1024KB

Download
memory/4616-42-0x00000176FD930000-0x00000176FDA30000-memory.dmp

Filesize
1024KB

Download
memory/4616-44-0x00000176FD930000-0x00000176FDA30000-memory.dmp

Filesize
1024KB

Download
memory/4616-48-0x00000176FD930000-0x00000176FDA30000-memory.dmp

Filesize
1024KB

Download
memory/4616-50-0x00000176FD930000-0x00000176FDA30000-memory.dmp

Filesize
1024KB

Download
memory/4616-52-0x00000176FD930000-0x00000176FDA30000-memory.dmp

Filesize
1024KB

Download
memory/4616-54-0x00000176FD930000-0x00000176FDA30000-memory.dmp

Filesize
1024KB

Download
memory/4616-56-0x00000176FD930000-0x00000176FDA30000-memory.dmp

Filesize
1024KB

Download
memory/4616-58-0x00000176FD930000-0x00000176FDA30000-memory.dmp

Filesize
1024KB

Download
memory/4616-65-0x00000176FD930000-0x00000176FDA30000-memory.dmp

Filesize
1024KB

Download
memory/4616-67-0x00000176FD930000-0x00000176FDA30000-memory.dmp

Filesize
1024KB

Download
memory/4616-63-0x00007FFF40B10000-0x00007FFF415D1000-memory.dmp

Filesize
10.8MB

Download
memory/4616-2-0x00000176FD930000-0x00000176FDA36000-memory.dmp

Filesize
1.0MB

Download
memory/4616-1-0x00000176FB370000-0x00000176FB48C000-memory.dmp

Filesize
1.1MB

Download