Analysis
-
max time kernel
115s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
26-10-2022 18:46
General
-
Target
30bd3a34d381539616ee0f790964a4bf.exe
-
Size
47KB
-
MD5
30bd3a34d381539616ee0f790964a4bf
-
SHA1
bb5ea5d3284b88658f324f4979bf897daca2595b
-
SHA256
efc68526906a8aa71785e96b05c236349c02f089b0f538852e17a0fed368bcd4
-
SHA512
eef72f350d41533ca3e90b80a565184b05b773cfd7ce2ce68499318be8cb1e8f1acc7d40736ca12682bc400877871e5c02a933880f461c235c421f59722af5a3
-
SSDEEP
768:yuScq5TAYGTqWU8j+zmo2qL5sQZPI7WD0b5vjJUXLWF29BDZUx:yuScq5TA5c2D7Wob5bJUXLWITdUx
Score
10/10
Malware Config
Extracted
Family
asyncrat
Version
0.5.7B
Botnet
Default
C2
127.0.0.1:6606
127.0.0.1:7707
127.0.0.1:8808
127.0.0.1:51585
20.212.19.59:6606
20.212.19.59:7707
20.212.19.59:8808
20.212.19.59:51585
Mutex
AsyncMutex_6SI8OkPnk
Attributes
-
delay
3
-
install
false
-
install_folder
%AppData%
aes.plain
Signatures
-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
-
Async RAT payload 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\30bd3a34d381539616ee0f790964a4bf.exe"C:\Users\Admin\AppData\Local\Temp\30bd3a34d381539616ee0f790964a4bf.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
72KB
-
Filesize
624KB
-
Filesize
5.6MB
-
Filesize
408KB