Analysis

  • max time kernel
    26s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    16/03/2023, 11:29

General

  • Target

    air.exe

  • Size

    546.0MB

  • MD5

    96e76869ca559f863971a6fd34a59880

  • SHA1

    25e6a0aec1979ed0211f7a43169f84909768dc59

  • SHA256

    a50226277ea1a7650f631a480215838dd804d8cfb053a1d19953adb016239472

  • SHA512

    b790ec7f0d355300a6720c6335ba2935321ada6ba28a224a74880e3761de0a39931ea07f0ede69c957d89d1a15ea3f188e4a89d80dd5c283b9d2f74b30bd7bdd

  • SSDEEP

    24576:8pLyY1pSPiQuPDGBJOcsYgtb9Nn9KvGocPtdf:8puY1pSKQuPDGBJMYgtBN96nc

Score
10/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

Default

C2

209.145.56.157:6606

209.145.56.157:7707

209.145.56.157:8808

Mutex

MUSIC

Attributes
  • delay

    3

  • install

    false

  • install_folder

    %AppData%

aes.plain

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

  • Async RAT payload 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\air.exe
    "C:\Users\Admin\AppData\Local\Temp\air.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:1732

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/1732-54-0x00000000003D0000-0x00000000003E6000-memory.dmp

          Filesize

          88KB

        • memory/1732-55-0x0000000001EF0000-0x0000000001F02000-memory.dmp

          Filesize

          72KB

        • memory/1732-56-0x00000000414B0000-0x0000000041530000-memory.dmp

          Filesize

          512KB

        • memory/1732-74-0x00000000414B0000-0x0000000041530000-memory.dmp

          Filesize

          512KB