asyncrat | 4bcbb8983fe7425976c5a1789deff73fb138e80981f5ebfef1f835bcc6757760

Resubmissions

14/04/2025, 07:51

250414-jp1kfssjz9 10

14/04/2025, 07:46

250414-jl9nyssjt9 10

08/04/2025, 15:58

250408-tevasswl18 10

08/04/2025, 14:19

250408-rm2nqsvqw2 10

Analysis

max time kernel
895s
max time network
897s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
08/04/2025, 15:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f8a3f1d5a1d18a666d9b81a974e212b0.exe
Size

47KB
MD5

f8a3f1d5a1d18a666d9b81a974e212b0
SHA1

035f531e396979a8cde58b592c178d96daa46287
SHA256

a72f747218f7c4c8a3c47d51dc510daae56df59b626c36b32aa64816a7104487
SHA512

d9848e80f2b05385f0148e32c7485107753978e066f56833d602ba98c1f0386f62dcd6b3f830ca17da3a934957ef796c542c87fe3a2f30853b0ceaaa18e6b0d2
SSDEEP

768:Wu/6ZTgoiziWUUM9rmo2qrUgYo2Br/wBPIw7+Vcxti2M0bDQL+m6pqetavz60CNq:Wu/6ZTgle2PgABTpw7+Vcfi4bDPrQL6i

Score

10^/10

asyncrat default discovery rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

Default

mooonskj.ddns.net:5552

Mutex

AsyncMutex_6SI8OkPnk

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Asyncrat family
asyncrat

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f8a3f1d5a1d18a666d9b81a974e212b0.exe

C:\Users\Admin\AppData\Local\Temp\f8a3f1d5a1d18a666d9b81a974e212b0.exe
"C:\Users\Admin\AppData\Local\Temp\f8a3f1d5a1d18a666d9b81a974e212b0.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1980

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1980-0-0x000000007542E000-0x000000007542F000-memory.dmp

Filesize
4KB

Download
memory/1980-1-0x0000000000B30000-0x0000000000B42000-memory.dmp

Filesize
72KB

Download
memory/1980-2-0x0000000075420000-0x0000000075BD0000-memory.dmp

Filesize
7.7MB

Download
memory/1980-3-0x000000007542E000-0x000000007542F000-memory.dmp

Filesize
4KB

Download
memory/1980-4-0x0000000075420000-0x0000000075BD0000-memory.dmp

Filesize
7.7MB

Download