Analysis
-
max time kernel
92s -
max time network
143s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
19-04-2021 09:39
General
-
Target
cYA0CfaS.exe
-
Size
45KB
-
MD5
e2fcb5500c8ead72ff54fd89b022bfc5
-
SHA1
b8dab173dde62ca4634c4d196d7b04c0bd90d27a
-
SHA256
ca433bcb65c83280e3634dd2fb32bf4c82ac636f85ff157c12c9593628b7fa18
-
SHA512
4ae863e530bd6aa62b80707009cf7621f9da099417e0c5961da8dc2e6f09d80c956cf1a4a2a717b16e6c91d75b3451bd7e401d21193e24da3c6251afd6d0d8df
Score
10/10
Malware Config
Signatures
-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\cYA0CfaS.exe"C:\Users\Admin\AppData\Local\Temp\cYA0CfaS.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4048-114-0x0000000000860000-0x0000000000861000-memory.dmpFilesize
4KB
-
memory/4048-116-0x00000000051D0000-0x00000000051D1000-memory.dmpFilesize
4KB
-
memory/4048-117-0x00000000059F0000-0x00000000059F1000-memory.dmpFilesize
4KB
-
memory/4048-118-0x0000000005F90000-0x0000000005F91000-memory.dmpFilesize
4KB
-
memory/4048-119-0x0000000005B00000-0x0000000005B01000-memory.dmpFilesize
4KB