Overview

overview

10

Static

static

10

1.exe

windows7-x64

10

1.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    43s
  • max time network
    151s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    06-02-2023 15:54

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    1.exe

  • Size

    54KB

  • MD5

    3dfd533462cbb79b59941c88dc87c323

  • SHA1

    afceb2a034f500e4a8da241bae3d24cda7222756

  • SHA256

    17ae80f847a2bb53ed0d068bb5e9161a4264d126e4d8503109d0cf6f8f8aaef8

  • SHA512

    3b75eb0ae02597b71d07550d1282aedf3fe29a951c0846699248db0a120484b822dd42757646beb30457a66a719f269e8bdd73a58b8fb8448698f3afc8bad8e9

  • SSDEEP

    1536:UWeD9IroIFWLh+cmH6GuHOzA3298bl+4r7PsSenCK9rx:UWeD9IroIF2h+cmH6G783e8blF7LgZZx

Score
10/10
asyncratdefaultrat

Malware Config

Extracted

Family

asyncrat

Version

| Edit 3LOSH RAT

Botnet

Default

C2

195.178.120.137:6071

Mutex

Asyex_6SI8OkPnk

Attributes
  • delay

    3

  • install

    false

  • install_folder

    %AppData%

aes.plain

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers.

    ratasyncrat
  • Async RAT payload 1 IoCs
    rat
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1.exe
    "C:\Users\Admin\AppData\Local\Temp\1.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:1884

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1884-54-0x00000000001B0000-0x00000000001C4000-memory.dmp
    Filesize

    80KB

    Download
  • memory/1884-55-0x0000000076171000-0x0000000076173000-memory.dmp
    Filesize

    8KB

    Download