Overview

overview

10

Static

static

Inquiry_TR...at.exe

windows7_x64

10

Inquiry_TR...at.exe

windows10_x64

10

Analysis

  • max time kernel
    117s
  • max time network
    151s
  • platform
    windows7_x64
  • resource
    win7-en-20211208
  • submitted
    26-01-2022 14:18

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Inquiry_TRASKO Ltd.bat.exe

  • Size

    675KB

  • MD5

    fac3b8f2d85a7876ffa623a67ca3f6ae

  • SHA1

    6583251903d4c33ce658bff984db0e24e2db0b2a

  • SHA256

    b17340a23a7971818b456182495976b46413f10b7570b3dd78cd189cff3b22f8

  • SHA512

    0a29f75e2c843e033aa0110678d5f56d5c3d50bd74e022660c8893f0bd59303defe48233a5425a357c33f53405f6bd7b3947284f3d4cd84623557c6974d61bc9

Score
10/10
asyncratdefaultrat

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

Default

C2

fforward20.duckdns.org:6606

fforward20.duckdns.org:7707

fforward20.duckdns.org:8808
Mutex

AsyncMutex_6SI8OkPnk

Attributes
  • anti_vm

    false

  • bsod

    false

  • delay

    3

  • install

    false

  • install_folder

    %AppData%

  • pastebin_config

    null

aes.plain

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers.

    ratasyncrat
  • Async RAT payload 5 IoCs
    rat
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Inquiry_TRASKO Ltd.bat.exe
    "C:\Users\Admin\AppData\Local\Temp\Inquiry_TRASKO Ltd.bat.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1588
    • C:\Users\Admin\AppData\Local\Temp\Inquiry_TRASKO Ltd.bat.exe
      "C:\Users\Admin\AppData\Local\Temp\Inquiry_TRASKO Ltd.bat.exe"
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:828

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/828-64-0x0000000000400000-0x0000000000412000-memory.dmp
    Filesize

    72KB

    Download
  • memory/828-60-0x0000000000400000-0x0000000000412000-memory.dmp
    Filesize

    72KB

    Download
  • memory/828-61-0x0000000000400000-0x0000000000412000-memory.dmp
    Filesize

    72KB

    Download
  • memory/828-62-0x0000000000400000-0x0000000000412000-memory.dmp
    Filesize

    72KB

    Download
  • memory/828-63-0x0000000000400000-0x0000000000412000-memory.dmp
    Filesize

    72KB

    Download
  • memory/828-65-0x0000000000400000-0x0000000000412000-memory.dmp
    Filesize

    72KB

    Download
  • memory/828-67-0x0000000004DD0000-0x0000000004DD1000-memory.dmp
    Filesize

    4KB

    Download
  • memory/828-68-0x0000000000900000-0x0000000000922000-memory.dmp
    Filesize

    136KB

    Download
  • memory/1588-56-0x0000000075321000-0x0000000075323000-memory.dmp
    Filesize

    8KB

    Download
  • memory/1588-57-0x0000000005060000-0x0000000005061000-memory.dmp
    Filesize

    4KB

    Download
  • memory/1588-58-0x00000000005B0000-0x00000000005BC000-memory.dmp
    Filesize

    48KB

    Download
  • memory/1588-59-0x0000000004AF0000-0x0000000004B2A000-memory.dmp
    Filesize

    232KB

    Download
  • memory/1588-55-0x0000000000FC0000-0x0000000001070000-memory.dmp
    Filesize

    704KB

    Download