Analysis
-
max time kernel
61s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
-
submitted
06/01/2023, 22:16
General
-
Target
WuyQxFYteA.exe
-
Size
171KB
-
MD5
f0bd3c3d10b20b6078c9d0c99ecb0137
-
SHA1
279c453e9d0144d3338a11f3e1a8efec56ad1044
-
SHA256
4293a76767a4657c973bd39b07054adc0d3d790cbc2b9be6e14c81e1f9545b79
-
SHA512
7b66a99fb9e20cb43d0d4cb624b0153253a492e03da313de3fd9f78e2bc4b1e4008fad4b98d2cd45757c53bd2f9a58c07ebe3140cf12f47646bbb72b86a4290b
-
SSDEEP
3072:cu/iTgle2PQuSzbLbTTlW4GLD6DvtMJCU7DzpyhJWnFd:cu/brPRSzbvTTeODvtMJfDVyhJW/
Score
10/10
Malware Config
Extracted
Family
asyncrat
Version
0.5.7B
Botnet
Default
C2
bevdona.theworkpc.com:5576
Mutex
AsyncMutex_6SI8OkPnk
Attributes
-
delay
3
-
install
false
-
install_folder
%AppData%
aes.plain
Signatures
-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
-
Async RAT payload 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\WuyQxFYteA.exe"C:\Users\Admin\AppData\Local\Temp\WuyQxFYteA.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
192KB
-
Filesize
624KB
-
Filesize
5.6MB
-
Filesize
408KB