Overview

overview

10

Static

static

10

2.exe

windows7-x64

10

2.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    28s
  • max time network
    151s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    22/02/2023, 07:52

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2.exe

  • Size

    62KB

  • MD5

    9877364c52f76487181d5da76adfd121

  • SHA1

    4580eaf814a1a738132438abf62f9c186ec6ab03

  • SHA256

    fe9b163fd9645a16adea5f4655be3d072e5459e753f52c3d292637f5d41062c9

  • SHA512

    8dab60b02fc7f3c6caba24b6425e5377d5fbb6d2963a8dff470a59e12cea81ae31503ec3b40fb41e71d3a1f585429fe3bd310e9028decdd3507503f18b0cba19

  • SSDEEP

    1536:NTnFkQMcYNVT5O8qVpieVLHAb9oLig7824Ykmvrq70x:NTnFkQMcYjT5ONVpieVLHAbyLiG3vrqS

Score
10/10
asyncratnew 3aloshrat

Malware Config

Extracted

Family

asyncrat

Version

| Edit 3LOSH RAT

Botnet

new 3alosh

C2

new2023.ddnsfree.com:555

new2023.ddnsfree.com:5555

new2023.ddnsfree.com:222

new2023.ddnsfree.com:2222
Mutex

AsyncMutex_6SI8OkPnk893

Attributes
  • delay

    3

  • install

    false

  • install_folder

    %AppData%

aes.plain

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers.

    ratasyncrat
  • Async RAT payload 1 IoCs
    rat
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2.exe
    "C:\Users\Admin\AppData\Local\Temp\2.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:1976

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\Cab32A7.tmp
    Filesize

    61KB

    MD5

    fc4666cbca561e864e7fdf883a9e6661

    SHA1

    2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

    SHA256

    10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

    SHA512

    c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

    Download Submit

  • memory/1976-54-0x0000000000120000-0x0000000000136000-memory.dmp

    Filesize

    88KB

    Download

  • memory/1976-55-0x0000000004690000-0x00000000046D0000-memory.dmp

    Filesize

    256KB

    Download

  • memory/1976-72-0x0000000004690000-0x00000000046D0000-memory.dmp

    Filesize

    256KB

    Download