Resubmissions
26-11-2022 09:08
221126-k3wn4afh23 1026-11-2022 09:06
221126-k27d7sag7t 1026-11-2022 08:56
221126-kv1m3sfe42 10Analysis
-
max time kernel
43s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
-
submitted
26-11-2022 08:56
General
-
Target
2dee6cc5f17ee1ec0c242ed80d7915d9.exe
-
Size
51KB
-
MD5
2dee6cc5f17ee1ec0c242ed80d7915d9
-
SHA1
bb1dd0e46e91c777d09bbbb2836a8f4f353776f3
-
SHA256
19fbd654e6dc76fc4a55bbc3c5dccc866d654c1609f8b72a130bd687d11f6198
-
SHA512
3a85dc2828b049aa9a2fe3f81f4e4a328f32fb9f848e7bf146f03ff326cf045fce4a0f72d2c263e3fe4d1dc27dc1389acefde961b092171715f7e6f8388ea9cc
-
SSDEEP
768:rVLY/OU+8FdcmRdH70KbyMka++wo79EbJISuFh177jbfgQKiqNAKMHSaReyx:rVLY/OUfV08YbJIdnboQlqNApFReyx
Score
10/10
Malware Config
Extracted
Family
asyncrat
Version
| Edit 3LOSH RAT
Botnet
New Crypt
C2
aboreda.linkpc.net:6666
Mutex
AsyncMutex_6SI8OkPnk
Attributes
-
delay
3
-
install
false
-
install_file
Webrootupdate.exe
-
install_folder
%AppData%
aes.plain
Signatures
-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
-
Async RAT payload 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2dee6cc5f17ee1ec0c242ed80d7915d9.exe"C:\Users\Admin\AppData\Local\Temp\2dee6cc5f17ee1ec0c242ed80d7915d9.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1208-54-0x0000000000CA0000-0x0000000000CB2000-memory.dmpFilesize
72KB
-
memory/1208-55-0x0000000075D01000-0x0000000075D03000-memory.dmpFilesize
8KB