Analysis
-
max time kernel
60s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
-
submitted
11/02/2023, 14:33
General
-
Target
tmp.exe
-
Size
6.4MB
-
MD5
36e71813a30b96f64943eb8cea2c52ec
-
SHA1
838f8938ff5f6e2daa8975bbd2af3e785bf4cd8b
-
SHA256
bb1f2c2c9b279790b67eaea6ab0bbce3a4d4432bbe1bd716750f2f9ba3337f7e
-
SHA512
953bc81e1f6c27763f84a1599cd92e3f30aed9217589b4c47bd0ca802df7ceff903e14f87a96f2247cde8e8ed0ebfa3dbd840abb6c243b798cc0a19791296b85
-
SSDEEP
98304:pKbPmDVa3VxobFOPN5xXhAqin130T+SrpC6xJJ33Je2mCrPkwy0hyv:I7aItPN5htinQfBHJDNscEv
Score
10/10
Malware Config
Signatures
-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
-
Async RAT payload 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 10 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SendNotifyMessage 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6.4MB
-
Filesize
2.3MB
-
Filesize
8KB
-
Filesize
124KB
-
Filesize
124KB