Analysis
-
max time kernel
117s -
max time network
139s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
19-01-2022 19:11
Behavioral task
behavioral1
Sample
74b5155287556031a2eb3e270e845359.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
General
-
Target
74b5155287556031a2eb3e270e845359.exe
-
Size
45KB
-
MD5
74b5155287556031a2eb3e270e845359
-
SHA1
6b78246a263aa25d0fc2560510fde70adcaf99bb
-
SHA256
0c45dfaaa3bbb170ea702f74ed4dcd308f2ef1ceab0d643a38c4a158ab96f0dd
-
SHA512
aeda39378421a203e90e170ea198a9369e5b3c943b0329d58c3fb598e831322977a330cbed3c6884ca5608ce0bc08613711065ccdbacd7953d2b65586de8cd46
Malware Config
Extracted
Family
asyncrat
Version
0.5.7B
Botnet
new
C2
bodmas01.zapto.org:2014
Mutex
AsyncMutex_6SI8OkPnk
Attributes
-
anti_vm
false
-
bsod
false
-
delay
3
-
install
false
-
install_folder
%AppData%
-
pastebin_config
null
aes.plain
Signatures
-
Async RAT payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/1680-55-0x00000000003C0000-0x00000000003D2000-memory.dmp asyncrat -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
74b5155287556031a2eb3e270e845359.exedescription pid process Token: SeDebugPrivilege 1680 74b5155287556031a2eb3e270e845359.exe