Overview

overview

10

Static

static

10

cYA0CfaS.exe

windows7_x64

10

cYA0CfaS.exe

windows10_x64

10

Analysis

  • max time kernel
    41s
  • max time network
    140s
  • platform
    windows7_x64
  • resource
    win7v20210408
  • submitted
    19-04-2021 09:39

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    cYA0CfaS.exe

  • Size

    45KB

  • MD5

    e2fcb5500c8ead72ff54fd89b022bfc5

  • SHA1

    b8dab173dde62ca4634c4d196d7b04c0bd90d27a

  • SHA256

    ca433bcb65c83280e3634dd2fb32bf4c82ac636f85ff157c12c9593628b7fa18

  • SHA512

    4ae863e530bd6aa62b80707009cf7621f9da099417e0c5961da8dc2e6f09d80c956cf1a4a2a717b16e6c91d75b3451bd7e401d21193e24da3c6251afd6d0d8df

Score
10/10
asyncratrat

Malware Config

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers.

    ratasyncrat
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\cYA0CfaS.exe
    "C:\Users\Admin\AppData\Local\Temp\cYA0CfaS.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:1632

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1632-60-0x0000000001380000-0x0000000001381000-memory.dmp
    Filesize

    4KB

    Download
  • memory/1632-62-0x0000000075551000-0x0000000075553000-memory.dmp
    Filesize

    8KB

    Download
  • memory/1632-63-0x0000000000F60000-0x0000000000F61000-memory.dmp
    Filesize

    4KB

    Download