Analysis
-
max time kernel
78s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
23/03/2023, 11:51
Behavioral task
behavioral1
Sample
8441ddb18dfbc80ddc5e814f2566ab54.exe
Resource
win7-20230220-en
3 signatures
150 seconds
General
-
Target
8441ddb18dfbc80ddc5e814f2566ab54.exe
-
Size
47KB
-
MD5
8441ddb18dfbc80ddc5e814f2566ab54
-
SHA1
e961dae02d49c649389241bb0043b9eb1908dfd1
-
SHA256
b32c3079004939613c101ecc860fa21101596f0c81ea0580882576293c63b31f
-
SHA512
cc0bff6220818bcaee9acdb353eba77867401f35ffe12823777ffed71e010d3f094de3814362c07c4e1d48e76d7cb5ac6e8f86b84ee991e3a5981c3a24653f4c
-
SSDEEP
768:1uwCfTg46YbWUn9jjmo2qrzaEOO2vIhwuKWrBYjlaxZ0bHd99P2VRCV2jFnSagZG:1uwCfTgpM2ogvIh/rBYhqebHdWPSjvdw
Malware Config
Extracted
Family
asyncrat
Version
0.5.7B
Botnet
Default
C2
45.155.158.187:1337
Mutex
AsyncMutex_6SI8OkPnk
Attributes
-
delay
3
-
install
false
-
install_folder
%AppData%
aes.plain
Signatures
-
Async RAT payload 1 IoCs
resource yara_rule behavioral2/memory/2344-133-0x00000000006F0000-0x0000000000702000-memory.dmp asyncrat -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2344 8441ddb18dfbc80ddc5e814f2566ab54.exe