Analysis
-
max time kernel
46s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
07-10-2022 14:53
Static task
static1
Behavioral task
behavioral1
Sample
b3b9ee842419a726e1c9a74e01269ffa26390eb844e55be2f5ce13aae7a8b4c3.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
b3b9ee842419a726e1c9a74e01269ffa26390eb844e55be2f5ce13aae7a8b4c3.exe
Resource
win10v2004-20220812-en
General
-
Target
b3b9ee842419a726e1c9a74e01269ffa26390eb844e55be2f5ce13aae7a8b4c3.exe
-
Size
1.8MB
-
MD5
9625eb1e116761706267fec1f9bf09dd
-
SHA1
71c835d1859fe00b14c0926d071f38740b146b9f
-
SHA256
b3b9ee842419a726e1c9a74e01269ffa26390eb844e55be2f5ce13aae7a8b4c3
-
SHA512
febf4fcf3686dd17b42738385ddb029990448afd0c4fa39676fa2a44a0eac93797e55f30a693e4fdc7db24d5a41a16c585b6088c377b53b532188139acad153f
-
SSDEEP
24576:aVNf352ofv3v2rWhu4A3CG4h8xgFIfVVH1XkID19XdwuXOkEuJ:aVNf30on3vbu4+CUgFItZ10ID19tnJ
Malware Config
Extracted
asyncrat
大灰狼远控
Default
58.221.58.124:8848
DcRatMutex
-
delay
1
-
install
false
-
install_folder
%AppData%
Signatures
-
Async RAT payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/1244-54-0x00000000285C0000-0x00000000285D6000-memory.dmp asyncrat -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
b3b9ee842419a726e1c9a74e01269ffa26390eb844e55be2f5ce13aae7a8b4c3.exedescription pid process Token: SeDebugPrivilege 1244 b3b9ee842419a726e1c9a74e01269ffa26390eb844e55be2f5ce13aae7a8b4c3.exe