Analysis
-
max time kernel
236s -
max time network
344s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
-
submitted
30-11-2022 01:09
General
-
Target
bH8p.exe
-
Size
45KB
-
MD5
c78feb68e841eefc532eb5d3993ccf9c
-
SHA1
914616b3da61d38fab47e9213d08bd628175d4c9
-
SHA256
ab9a4d30723683772c778b0433641695624616d7c96e09948e8beb3d58f48818
-
SHA512
98c637cf0b4badb9d8700453ffc0e9587fa73495e27c3e5b2a5f07aaf464247cc958c1828e8f4e72b4a8b41f82876ed7c71178650d3f17d8d5398c5c33ffe4b5
-
SSDEEP
768:vuwCfTg46YbWUn8jjmo2qrDKjGKG6PIyzjbFgX3itIpWnX9BDGm6NDs1BDZSx:vuwCfTgp/2OKYDy3bCXSa2X9BDGm6sdQ
Score
10/10
Malware Config
Extracted
Family
asyncrat
Version
0.5.7B
Botnet
Default
C2
146.190.69.247:6606
146.190.69.247:7707
146.190.69.247:8808
Mutex
AsyncMutex_6SI8OkPnk
Attributes
-
delay
3
-
install
false
-
install_folder
%AppData%
aes.plain
Signatures
-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
-
Async RAT payload 1 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\bH8p.exe"C:\Users\Admin\AppData\Local\Temp\bH8p.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
72KB
-
Filesize
8KB
-
Filesize
504KB
-
Filesize
40KB
-
Filesize
576KB
-
Filesize
384KB