Analysis
- max time kernel
149s - max time network
148s - platform
windows7_x64 - resource
win7v20201028 - submitted
25/12/2020, 07:57
General
- Target cf3d25b6a7ff0c484fc01eece1d119b2.exe
- Size 150KB
- Sample201225-5ltkxcy992
- SHA256 efcdf30c07197ad6dc12efb326db35a5acc90eb47cedba517f97627e48c1d251
Score
10/10
Malware Config
Extracted
Family
-
asyncrat
Version
-
0.5.7B
C2
-
monodofus.hopto.org:6606
Mutex
-
AsyncMutex_6SI8OkPnk
Attributes
-
aes_key
LDDgTQDISdpb3P4AdWiSDf9IAt79JD6i
-
anti_detection
false
-
autorun
false
-
bdos
false
-
delay
Default
-
host
monodofus.hopto.org
-
hwid
3
- install_file
-
install_folder
%AppData%
-
mutex
AsyncMutex_6SI8OkPnk
-
pastebin_config
null
-
port
6606
-
version
0.5.7B
aes.plain
Signatures
- AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
- Async RAT payload 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\cf3d25b6a7ff0c484fc01eece1d119b2.exe"C:\Users\Admin\AppData\Local\Temp\cf3d25b6a7ff0c484fc01eece1d119b2.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1640-2-0x00000000745C0000-0x0000000074CAE000-memory.dmp
memory/1640-3-0x0000000000390000-0x0000000000391000-memory.dmp
memory/1640-5-0x0000000000570000-0x000000000058C000-memory.dmp
memory/1640-8-0x00000000002F0000-0x00000000002FC000-memory.dmp