asyncrat | 83fd2015a5499a8c2703d91aa047d0f099b85e8aa5ef9f2643a4eda4144a8772

Analysis

max time kernel
76s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
11/03/2025, 07:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

21aaf28e05a6224b2a5b338a738ff9321a56ebc2babe6b194709f9a00fb97af4.exe
Size

74KB
MD5

7eb39790605fb73d938bb1b9df6f092e
SHA1

ad1fe923091467c48114ed09e09f284c470a4d3d
SHA256

21aaf28e05a6224b2a5b338a738ff9321a56ebc2babe6b194709f9a00fb97af4
SHA512

f63105cb5eb14fe84ea650804b33900a11f4a2ba5b5fc879471ca5b236ece8028a6578afa9ed1b21e83b370ed3b6235fdff97ad05589adb3d1542bd401477e6f
SSDEEP

1536:6UKUcxoyR1CriPMVOdyievvI0/1bk/dhdIC6/7QzcWLVclN:6UzcxoyXkiPMVsyzd/1bkPCC6zQvBY

Score

10^/10

asyncrat default rat

Malware Config

Extracted

Family

asyncrat

Version

Venom RAT + HVNC + Stealer + Grabber v6.0.3

Botnet

Default

147.185.221.22:41812

Mutex

dlydidrgiwetibspjno

Attributes

delay
1
install
true
install_file
hjhjhj8.exe
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Asyncrat family
asyncrat

Suspicious use of AdjustPrivilegeToken 43 IoCs

description	pid	Process
Token: SeDebugPrivilege	3536	21aaf28e05a6224b2a5b338a738ff9321a56ebc2babe6b194709f9a00fb97af4.exe
Token: SeIncreaseQuotaPrivilege	3536	21aaf28e05a6224b2a5b338a738ff9321a56ebc2babe6b194709f9a00fb97af4.exe
Token: SeSecurityPrivilege	3536	21aaf28e05a6224b2a5b338a738ff9321a56ebc2babe6b194709f9a00fb97af4.exe
Token: SeTakeOwnershipPrivilege	3536	21aaf28e05a6224b2a5b338a738ff9321a56ebc2babe6b194709f9a00fb97af4.exe
Token: SeLoadDriverPrivilege	3536	21aaf28e05a6224b2a5b338a738ff9321a56ebc2babe6b194709f9a00fb97af4.exe
Token: SeSystemProfilePrivilege	3536	21aaf28e05a6224b2a5b338a738ff9321a56ebc2babe6b194709f9a00fb97af4.exe
Token: SeSystemtimePrivilege	3536	21aaf28e05a6224b2a5b338a738ff9321a56ebc2babe6b194709f9a00fb97af4.exe
Token: SeProfSingleProcessPrivilege	3536	21aaf28e05a6224b2a5b338a738ff9321a56ebc2babe6b194709f9a00fb97af4.exe
Token: SeIncBasePriorityPrivilege	3536	21aaf28e05a6224b2a5b338a738ff9321a56ebc2babe6b194709f9a00fb97af4.exe
Token: SeCreatePagefilePrivilege	3536	21aaf28e05a6224b2a5b338a738ff9321a56ebc2babe6b194709f9a00fb97af4.exe
Token: SeBackupPrivilege	3536	21aaf28e05a6224b2a5b338a738ff9321a56ebc2babe6b194709f9a00fb97af4.exe
Token: SeRestorePrivilege	3536	21aaf28e05a6224b2a5b338a738ff9321a56ebc2babe6b194709f9a00fb97af4.exe
Token: SeShutdownPrivilege	3536	21aaf28e05a6224b2a5b338a738ff9321a56ebc2babe6b194709f9a00fb97af4.exe
Token: SeDebugPrivilege	3536	21aaf28e05a6224b2a5b338a738ff9321a56ebc2babe6b194709f9a00fb97af4.exe
Token: SeSystemEnvironmentPrivilege	3536	21aaf28e05a6224b2a5b338a738ff9321a56ebc2babe6b194709f9a00fb97af4.exe
Token: SeRemoteShutdownPrivilege	3536	21aaf28e05a6224b2a5b338a738ff9321a56ebc2babe6b194709f9a00fb97af4.exe
Token: SeUndockPrivilege	3536	21aaf28e05a6224b2a5b338a738ff9321a56ebc2babe6b194709f9a00fb97af4.exe
Token: SeManageVolumePrivilege	3536	21aaf28e05a6224b2a5b338a738ff9321a56ebc2babe6b194709f9a00fb97af4.exe
Token: 33	3536	21aaf28e05a6224b2a5b338a738ff9321a56ebc2babe6b194709f9a00fb97af4.exe
Token: 34	3536	21aaf28e05a6224b2a5b338a738ff9321a56ebc2babe6b194709f9a00fb97af4.exe
Token: 35	3536	21aaf28e05a6224b2a5b338a738ff9321a56ebc2babe6b194709f9a00fb97af4.exe
Token: 36	3536	21aaf28e05a6224b2a5b338a738ff9321a56ebc2babe6b194709f9a00fb97af4.exe
Token: SeIncreaseQuotaPrivilege	3536	21aaf28e05a6224b2a5b338a738ff9321a56ebc2babe6b194709f9a00fb97af4.exe
Token: SeSecurityPrivilege	3536	21aaf28e05a6224b2a5b338a738ff9321a56ebc2babe6b194709f9a00fb97af4.exe
Token: SeTakeOwnershipPrivilege	3536	21aaf28e05a6224b2a5b338a738ff9321a56ebc2babe6b194709f9a00fb97af4.exe
Token: SeLoadDriverPrivilege	3536	21aaf28e05a6224b2a5b338a738ff9321a56ebc2babe6b194709f9a00fb97af4.exe
Token: SeSystemProfilePrivilege	3536	21aaf28e05a6224b2a5b338a738ff9321a56ebc2babe6b194709f9a00fb97af4.exe
Token: SeSystemtimePrivilege	3536	21aaf28e05a6224b2a5b338a738ff9321a56ebc2babe6b194709f9a00fb97af4.exe
Token: SeProfSingleProcessPrivilege	3536	21aaf28e05a6224b2a5b338a738ff9321a56ebc2babe6b194709f9a00fb97af4.exe
Token: SeIncBasePriorityPrivilege	3536	21aaf28e05a6224b2a5b338a738ff9321a56ebc2babe6b194709f9a00fb97af4.exe
Token: SeCreatePagefilePrivilege	3536	21aaf28e05a6224b2a5b338a738ff9321a56ebc2babe6b194709f9a00fb97af4.exe
Token: SeBackupPrivilege	3536	21aaf28e05a6224b2a5b338a738ff9321a56ebc2babe6b194709f9a00fb97af4.exe
Token: SeRestorePrivilege	3536	21aaf28e05a6224b2a5b338a738ff9321a56ebc2babe6b194709f9a00fb97af4.exe
Token: SeShutdownPrivilege	3536	21aaf28e05a6224b2a5b338a738ff9321a56ebc2babe6b194709f9a00fb97af4.exe
Token: SeDebugPrivilege	3536	21aaf28e05a6224b2a5b338a738ff9321a56ebc2babe6b194709f9a00fb97af4.exe
Token: SeSystemEnvironmentPrivilege	3536	21aaf28e05a6224b2a5b338a738ff9321a56ebc2babe6b194709f9a00fb97af4.exe
Token: SeRemoteShutdownPrivilege	3536	21aaf28e05a6224b2a5b338a738ff9321a56ebc2babe6b194709f9a00fb97af4.exe
Token: SeUndockPrivilege	3536	21aaf28e05a6224b2a5b338a738ff9321a56ebc2babe6b194709f9a00fb97af4.exe
Token: SeManageVolumePrivilege	3536	21aaf28e05a6224b2a5b338a738ff9321a56ebc2babe6b194709f9a00fb97af4.exe
Token: 33	3536	21aaf28e05a6224b2a5b338a738ff9321a56ebc2babe6b194709f9a00fb97af4.exe
Token: 34	3536	21aaf28e05a6224b2a5b338a738ff9321a56ebc2babe6b194709f9a00fb97af4.exe
Token: 35	3536	21aaf28e05a6224b2a5b338a738ff9321a56ebc2babe6b194709f9a00fb97af4.exe
Token: 36	3536	21aaf28e05a6224b2a5b338a738ff9321a56ebc2babe6b194709f9a00fb97af4.exe

C:\Users\Admin\AppData\Local\Temp\21aaf28e05a6224b2a5b338a738ff9321a56ebc2babe6b194709f9a00fb97af4.exe
"C:\Users\Admin\AppData\Local\Temp\21aaf28e05a6224b2a5b338a738ff9321a56ebc2babe6b194709f9a00fb97af4.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3536

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3536-0-0x00007FF817363000-0x00007FF817365000-memory.dmp

Filesize
8KB

Download
memory/3536-1-0x00000000004A0000-0x00000000004B8000-memory.dmp

Filesize
96KB

Download
memory/3536-3-0x00007FF817360000-0x00007FF817E21000-memory.dmp

Filesize
10.8MB

Download
memory/3536-4-0x00007FF817360000-0x00007FF817E21000-memory.dmp

Filesize
10.8MB

Download