r1uDWJza.exe

General
Target

r1uDWJza.exe

Filesize

47KB

Completed

21-11-2020 16:20

Score
10 /10
MD5

0550342e66698384f232ac39b700dd14

SHA1

ba5e50a39d1502e38196724ec9d844ee4bf8d002

SHA256

f3fcbb0fedb1e3b732185aebbf845ca185c950ca3635026d8a754312220577c9

Malware Config
Signatures 3

Filter: none

  • AsyncRat

    Description

    AsyncRAT is designed to remotely monitor and control other computers.

    Tags

  • Async RAT payload

    Tags

    Reported IOCs

    resourceyara_rule
    behavioral1/memory/1808-3-0x0000000000760000-0x000000000077E000-memory.dmpasyncrat
  • Suspicious use of AdjustPrivilegeToken
    r1uDWJza.exe

    Reported IOCs

    descriptionpidprocess
    Token: SeDebugPrivilege1808r1uDWJza.exe
Processes 1
  • C:\Users\Admin\AppData\Local\Temp\r1uDWJza.exe
    "C:\Users\Admin\AppData\Local\Temp\r1uDWJza.exe"
    Suspicious use of AdjustPrivilegeToken
    PID:1808
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
          Discovery
            Execution
              Exfiltration
                Impact
                  Initial Access
                    Lateral Movement
                      Persistence
                        Privilege Escalation
                          Replay Monitor
                          00:00 00:00
                          Downloads

                          • memory/1808-0-0x0000000073980000-0x000000007406E000-memory.dmp

                            Download

                          • memory/1808-1-0x0000000000110000-0x0000000000111000-memory.dmp

                            Download

                          • memory/1808-3-0x0000000000760000-0x000000000077E000-memory.dmp

                            Download