Analysis
-
max time kernel
97s -
max time network
161s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
03-02-2023 19:33
Behavioral task
behavioral1
Sample
fh5BWZAg.exe
Resource
win7-20220812-en
windows7-x64
3 signatures
150 seconds
General
-
Target
fh5BWZAg.exe
-
Size
63KB
-
MD5
014fe145a9d6a1a94f5e1950dc3580ad
-
SHA1
f05af2022c03559345c1ed3a38021f50600f7c8f
-
SHA256
797934da336f36e3e80b71e2d48a5ed7453d27394868cac609989ba11f00c734
-
SHA512
9f3205681a4f711cc89675141ab48017a21a05be0cdcb135d9a0e47e7e23105edc639c778443d7d806901886fcfc312d1970d5bb17a7fe154c3405c6515e4a41
-
SSDEEP
1536:NhjExLDRwQuNMXbmaeWs1ljNhhYZq9bbHyqKRLbQGZZVclN:NhjExLDRwQuNMXbreFlzhp9bbHARL1zY
Malware Config
Extracted
Family
asyncrat
Version
1.0.7
Botnet
Default
C2
5.78.65.18:8848
Mutex
DcRatMutex_qwqdanchun
Attributes
-
delay
1
-
install
false
-
install_folder
%AppData%
aes.plain
Signatures
-
Async RAT payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/4800-132-0x0000000000A00000-0x0000000000A16000-memory.dmp asyncrat -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
fh5BWZAg.exedescription pid process Token: SeDebugPrivilege 4800 fh5BWZAg.exe