Analysis
-
max time kernel
39s -
max time network
156s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
03-02-2023 19:33
Behavioral task
behavioral1
Sample
fh5BWZAg.exe
Resource
win7-20220812-en
windows7-x64
3 signatures
150 seconds
General
-
Target
fh5BWZAg.exe
-
Size
63KB
-
MD5
014fe145a9d6a1a94f5e1950dc3580ad
-
SHA1
f05af2022c03559345c1ed3a38021f50600f7c8f
-
SHA256
797934da336f36e3e80b71e2d48a5ed7453d27394868cac609989ba11f00c734
-
SHA512
9f3205681a4f711cc89675141ab48017a21a05be0cdcb135d9a0e47e7e23105edc639c778443d7d806901886fcfc312d1970d5bb17a7fe154c3405c6515e4a41
-
SSDEEP
1536:NhjExLDRwQuNMXbmaeWs1ljNhhYZq9bbHyqKRLbQGZZVclN:NhjExLDRwQuNMXbreFlzhp9bbHARL1zY
Malware Config
Extracted
Family
asyncrat
Version
1.0.7
Botnet
Default
C2
5.78.65.18:8848
Mutex
DcRatMutex_qwqdanchun
Attributes
-
delay
1
-
install
false
-
install_folder
%AppData%
aes.plain
Signatures
-
Async RAT payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/1176-54-0x0000000000210000-0x0000000000226000-memory.dmp asyncrat -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
fh5BWZAg.exedescription pid process Token: SeDebugPrivilege 1176 fh5BWZAg.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1176-54-0x0000000000210000-0x0000000000226000-memory.dmpFilesize
88KB