Analysis
-
max time kernel
142s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
-
submitted
17-01-2023 10:35
General
-
Target
1060/0763daa2ef0dfb890d90bfd3f21e7a4252fb5c30a51e49904344a36012a79bac.exe
-
Size
244KB
-
MD5
459fc31c4d4e92a68f4e68df00c26d79
-
SHA1
5c4322ea964545c6ecd0bb75c8ec61319e2ef4e6
-
SHA256
0763daa2ef0dfb890d90bfd3f21e7a4252fb5c30a51e49904344a36012a79bac
-
SHA512
52d9a2422d657d13fd0f1efbae69dab14a4248344c858874e4b7f0f26982228dc6ec539d690619208b5fec2592f063fc7c648ac95153ae6cc106cbfa5605e315
-
SSDEEP
6144:fzfkEjF4rgDf908COGKyJfDpyZ8e4IUuZvUqD/wxk:fzfwsD
Score
10/10
Malware Config
Extracted
Family
asyncrat
Version
0.5.7B
Botnet
Default
C2
127.0.0.1:2306
87.4.136.146:2306
Mutex
AsyncMutex_6SI8OkPnk
Attributes
-
delay
3
-
install
false
-
install_folder
%AppData%
aes.plain
Signatures
-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
-
Async RAT payload 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1060\0763daa2ef0dfb890d90bfd3f21e7a4252fb5c30a51e49904344a36012a79bac.exe"C:\Users\Admin\AppData\Local\Temp\1060\0763daa2ef0dfb890d90bfd3f21e7a4252fb5c30a51e49904344a36012a79bac.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1708-54-0x00000000001A0000-0x00000000001E2000-memory.dmpFilesize
264KB
-
memory/1708-55-0x0000000076121000-0x0000000076123000-memory.dmpFilesize
8KB
-
memory/1708-56-0x00000000002B0000-0x00000000002C2000-memory.dmpFilesize
72KB
-
memory/1708-57-0x0000000004E35000-0x0000000004E46000-memory.dmpFilesize
68KB