Overview

overview

10

Static

static

Inquiry_TR...at.exe

windows7_x64

10

Inquiry_TR...at.exe

windows10_x64

10

Analysis

  • max time kernel
    121s
  • max time network
    145s
  • platform
    windows10_x64
  • resource
    win10-en-20211208
  • submitted
    26-01-2022 14:18

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Inquiry_TRASKO Ltd.bat.exe

  • Size

    675KB

  • MD5

    fac3b8f2d85a7876ffa623a67ca3f6ae

  • SHA1

    6583251903d4c33ce658bff984db0e24e2db0b2a

  • SHA256

    b17340a23a7971818b456182495976b46413f10b7570b3dd78cd189cff3b22f8

  • SHA512

    0a29f75e2c843e033aa0110678d5f56d5c3d50bd74e022660c8893f0bd59303defe48233a5425a357c33f53405f6bd7b3947284f3d4cd84623557c6974d61bc9

Score
10/10
asyncratdefaultrat

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

Default

C2

fforward20.duckdns.org:6606

fforward20.duckdns.org:7707

fforward20.duckdns.org:8808
Mutex

AsyncMutex_6SI8OkPnk

Attributes
  • anti_vm

    false

  • bsod

    false

  • delay

    3

  • install

    false

  • install_folder

    %AppData%

  • pastebin_config

    null

aes.plain

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers.

    ratasyncrat
  • Async RAT payload 2 IoCs
    rat
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Inquiry_TRASKO Ltd.bat.exe
    "C:\Users\Admin\AppData\Local\Temp\Inquiry_TRASKO Ltd.bat.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3552
    • C:\Users\Admin\AppData\Local\Temp\Inquiry_TRASKO Ltd.bat.exe
      "C:\Users\Admin\AppData\Local\Temp\Inquiry_TRASKO Ltd.bat.exe"
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:616

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Inquiry_TRASKO Ltd.bat.exe.log
    MD5

    0c2899d7c6746f42d5bbe088c777f94c

    SHA1

    622f66c5f7a3c91b28a9f43ce7c6cabadbf514f1

    SHA256

    5b0b99740cadaeff7b9891136644b396941547e20cc7eea646560d0dad5a5458

    SHA512

    ab7a3409ed4b6ca00358330a3aa4ef6de7d81eb21a5e24bb629ef6a7c7c4e2a70ca3accfbc989ed6e495fdb8eb6203a26d6f2a37b2a5809af4276af375b49078

    Download Submit
  • memory/616-123-0x0000000000400000-0x0000000000412000-memory.dmp
    Filesize

    72KB

    Download
  • memory/616-129-0x0000000006DD0000-0x0000000006DEE000-memory.dmp
    Filesize

    120KB

    Download
  • memory/616-128-0x0000000006CD0000-0x0000000006CF2000-memory.dmp
    Filesize

    136KB

    Download
  • memory/616-127-0x0000000006D50000-0x0000000006DC6000-memory.dmp
    Filesize

    472KB

    Download
  • memory/616-126-0x0000000005F10000-0x0000000005F76000-memory.dmp
    Filesize

    408KB

    Download
  • memory/616-125-0x0000000005460000-0x0000000005461000-memory.dmp
    Filesize

    4KB

    Download
  • memory/3552-118-0x0000000004DD0000-0x00000000052CE000-memory.dmp
    Filesize

    5.0MB

    Download
  • memory/3552-122-0x0000000007260000-0x000000000729A000-memory.dmp
    Filesize

    232KB

    Download
  • memory/3552-121-0x0000000007300000-0x000000000739C000-memory.dmp
    Filesize

    624KB

    Download
  • memory/3552-120-0x0000000004F80000-0x0000000004F8C000-memory.dmp
    Filesize

    48KB

    Download
  • memory/3552-119-0x0000000004D90000-0x0000000004D9A000-memory.dmp
    Filesize

    40KB

    Download
  • memory/3552-115-0x0000000000410000-0x00000000004C0000-memory.dmp
    Filesize

    704KB

    Download
  • memory/3552-117-0x0000000004CF0000-0x0000000004D82000-memory.dmp
    Filesize

    584KB

    Download
  • memory/3552-116-0x00000000052D0000-0x00000000057CE000-memory.dmp
    Filesize

    5.0MB

    Download