Analysis
-
max time kernel
146s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
-
submitted
25-03-2023 09:17
General
-
Target
cc03a8f9433b57e4ea8a87544dde5470.exe
-
Size
35KB
-
MD5
cc03a8f9433b57e4ea8a87544dde5470
-
SHA1
d44e2e33aa3f7780db64ece0483958b87b063a75
-
SHA256
8688a4bb898f17009992f83072b5c5a3a60e9e552a95002470e1c2f885563fbd
-
SHA512
50ac102923a0eb17f27c24ca1528fd03258eef549448bfe6e4b7d91c57a2e0a2b4c8eb2a7018afca875f547b9d12c2d5e046755edef55301be9dcd6632d5fdce
-
SSDEEP
768:tTRSgQ0ZZeIYVudX6nHs+Y5nXq0AZ7yx6tWLrx7GR4:t1peKT5Xq0s6GWLr9q4
Score
10/10
Malware Config
Extracted
Family
asyncrat
Version
1.0.7
Botnet
Default
C2
120.78.151.171:6658
Mutex
bbbanchun
Attributes
-
delay
10
-
install
false
-
install_file
flash.exe
-
install_folder
%AppData%
aes.plain
Signatures
-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
Async RAT payload 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\cc03a8f9433b57e4ea8a87544dde5470.exe"C:\Users\Admin\AppData\Local\Temp\cc03a8f9433b57e4ea8a87544dde5470.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
512KB
-
Filesize
104KB
-
Filesize
88KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB