Analysis
- max time kernel
77s - max time network
156s - platform
windows7_x64 - resource
win7-20230220-en - resource tags
- submitted
01/05/2023, 11:28
General
- Target Ta.exe
- Size 1024.0MB
- Sample230501-nlewsshb5s
- SHA256 4b34980497ed08e0f3958cc83b63dbf5cd84879333d176e8df5910694ec728ae
Malware Config
Extracted
-
asyncrat
-
0.5.7B
-
Default
-
45.81.243.217:6606
-
45.81.243.217:7707
-
45.81.243.217:8808
-
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
false
-
install_folder
%AppData%
Signatures
- AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
- Async RAT payload 2 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Ta.exe"C:\Users\Admin\AppData\Local\Temp\Ta.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
94308059B57B3142E455B38A6EB92015
Tar462C.tmp
memory/1200-57-0x0000000041790000-0x0000000041810000-memory.dmp
memory/1200-54-0x0000000002040000-0x0000000002055000-memory.dmp
memory/1200-58-0x0000000041790000-0x0000000041810000-memory.dmp
memory/1200-76-0x0000000041790000-0x0000000041810000-memory.dmp
memory/1200-77-0x0000000041790000-0x0000000041810000-memory.dmp
memory/1200-79-0x0000000042810000-0x000000004288E000-memory.dmp
memory/1200-56-0x0000000041790000-0x0000000041810000-memory.dmp
memory/1200-55-0x0000000028370000-0x0000000028382000-memory.dmp
memory/1200-100-0x0000000041770000-0x000000004177A000-memory.dmp
memory/1200-101-0x00000000437F0000-0x0000000043850000-memory.dmp
memory/1200-102-0x0000000043850000-0x00000000438E0000-memory.dmp