Analysis
-
max time kernel
45s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
06-02-2023 18:06
Behavioral task
behavioral1
Sample
dc_1m.exe
Resource
win7-20220901-en
windows7-x64
4 signatures
150 seconds
General
-
Target
dc_1m.exe
-
Size
48KB
-
MD5
0f2a0b4658580acfd215d44dd69196b1
-
SHA1
5764f5cbd38295be5e8ba7fab97b77b28434e1a4
-
SHA256
f033a72acaa9d3891b5b2570bdd29c023b14ec84b35cc1eb99aa575bc0265a56
-
SHA512
67ee49c02b23c58af712c2ecc2e5555dc3e735238290e7ab4ce7ec704374233c2a2d03b815c577975d41f90425efbfcfa883bf52e35d5a7c748742101573f93d
-
SSDEEP
768:ThskEILWCK7+DiX3biWD8YbF3gKmizHmgvEgK/JfZVc6KN:ThsjznHzbuFizHmgnkJfZVclN
Malware Config
Extracted
Family
asyncrat
Version
1.0.7
Botnet
Default
Mutex
?><MKdfdsgdgregrtgrthh<LKOIJUY&^T%RFDEXcfgvhbnjuimowefinuybt
Attributes
-
delay
1
-
install
false
-
install_folder
%AppData%
-
pastebin_config
https://pastebin.com/raw/VM7TRmVa
aes.plain
Signatures
-
Async RAT payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/828-54-0x0000000000390000-0x00000000003A2000-memory.dmp asyncrat -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
dc_1m.exedescription pid process Token: SeDebugPrivilege 828 dc_1m.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/828-54-0x0000000000390000-0x00000000003A2000-memory.dmpFilesize
72KB