Analysis

  • max time kernel
    45s
  • max time network
    154s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    03-10-2022 17:07

General

  • Target

    39bd1ac6a67c3f95c0f007265bac7c5d.exe

  • Size

    76KB

  • MD5

    39bd1ac6a67c3f95c0f007265bac7c5d

  • SHA1

    20a557cb54acfe2c64673b44a0cd6f7bfd27047e

  • SHA256

    b5152c3adf4885ee9c9542802d9c6f5dc2cbd8a0f467780ff9622058028e6b50

  • SHA512

    670d12229e86065dac4dad37fff40247aa83b41c8a1d636f7cade1d98d8ccc1ed168e5f5715b2cde2787e0d8b8f3b4db082cc04a54ad2b36bb0708302647d054

  • SSDEEP

    1536:PBkwyaSaVr5yQUdlBG456ihZAGXDBnio9JL:pPya/VrEQMlqihqotJL

Score
10/10

Malware Config

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers.

  • Async RAT payload ⋅ 1 IoCs
  • Suspicious use of AdjustPrivilegeToken ⋅ 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\39bd1ac6a67c3f95c0f007265bac7c5d.exe
    "C:\Users\Admin\AppData\Local\Temp\39bd1ac6a67c3f95c0f007265bac7c5d.exe"
    Suspicious use of AdjustPrivilegeToken
    PID:1292

Network

MITRE ATT&CK Matrix

Collection

    Command and Control

      Credential Access

        Defense Evasion

          Discovery

            Execution

              Exfiltration

                Impact

                  Initial Access

                    Lateral Movement

                      Persistence

                        Privilege Escalation

                          Replay Monitor

                          00:00 00:00

                          Downloads

                          • memory/1292-54-0x0000000000270000-0x000000000028A000-memory.dmp
                          • memory/1292-55-0x00000000003B0000-0x00000000003BA000-memory.dmp