Analysis
-
max time kernel
90s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
-
submitted
21/12/2022, 09:47
General
-
Target
0c24db98ce59b40d2316df1fa13f3616aa2a2712f0c61b4c67206c01d9eba468.exe
-
Size
3.0MB
-
MD5
af164390574ceb5ead7f561ca0564a04
-
SHA1
8da74363b7d22a69ea8d158cac8cd33ed175fff4
-
SHA256
0c24db98ce59b40d2316df1fa13f3616aa2a2712f0c61b4c67206c01d9eba468
-
SHA512
0c88def697949d5dee30e89281678b022d468b77feda19451e347fd0118bca5d7a0cd2c973fab779eeb0c4e936ed9cca411a1878d77e3fd637e2da0c240d2c83
-
SSDEEP
49152:sBWsCR1OJAKyDAh8baB39Wz5LpONbYJfclSj2p5zgRKJT/J8rtQyZp6G4P:rCA/hWlSjmFJT/wZpL
Score
10/10
Malware Config
Extracted
Credentials
Protocol: ftp- Host:
45.151.135.235 - Port:
21 - Username:
123 - Password:
123
Signatures
-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0c24db98ce59b40d2316df1fa13f3616aa2a2712f0c61b4c67206c01d9eba468.exe"C:\Users\Admin\AppData\Local\Temp\0c24db98ce59b40d2316df1fa13f3616aa2a2712f0c61b4c67206c01d9eba468.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\0c24db98ce59b40d2316df1fa13f3616aa2a2712f0c61b4c67206c01d9eba468.exeC:\Users\Admin\AppData\Local\Temp\0c24db98ce59b40d2316df1fa13f3616aa2a2712f0c61b4c67206c01d9eba468.exe1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
472KB
-
Filesize
120KB
-
Filesize
10.8MB