Analysis
-
max time kernel
30s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
21/03/2023, 10:21
Behavioral task
behavioral1
Sample
544-76-0x00000000005F0000-0x0000000000602000-memory.exe
Resource
win7-20230220-en
3 signatures
150 seconds
General
-
Target
544-76-0x00000000005F0000-0x0000000000602000-memory.exe
-
Size
72KB
-
MD5
604969d558bfa4258fc076e67177d0ad
-
SHA1
158f4913a217fdf5fee83f74a411d79eaa537d13
-
SHA256
a9572473a2dce42bc414733207eabb0b49abfe0a01a05e2d2db529651a12a241
-
SHA512
885ff29d4410c941d11fe9756b8b39e6fd1566e539e8fe20280df2f12fb471225bfdd8f4f07677ef5a6ff20f952718fee7f2d3db3472f771650d75a461630795
-
SSDEEP
1536:fuwCfTgpM28LS3a3bpjSgTYaGcjsOdLf+:fuwMTgpM2SS3a3bpVOrOtm
Malware Config
Extracted
Family
asyncrat
Version
0.5.7B
Botnet
Default
C2
192.3.193.136:2023
Mutex
AsyncMutex_6SI8OkPnk
Attributes
-
delay
3
-
install
false
-
install_folder
%AppData%
aes.plain
Signatures
-
Async RAT payload 1 IoCs
resource yara_rule behavioral1/memory/1048-54-0x00000000000C0000-0x00000000000D2000-memory.dmp asyncrat -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1048 544-76-0x00000000005F0000-0x0000000000602000-memory.exe