Analysis
- max time kernel
145s - max time network
152s - platform
windows7_x64 - resource
win7-20230220-en - resource tags
- submitted
04/05/2023, 02:01
General
- Target c72e8271a4eb3c18cd2f83c50acd4d1b77f162be15b2011aa384eab178a7d51d.exe
- Size 969KB
- Sample230504-cf2mtsbe7w
- SHA256 c72e8271a4eb3c18cd2f83c50acd4d1b77f162be15b2011aa384eab178a7d51d
Score
10/10
Malware Config
Extracted
Family
-
asyncrat
Version
-
0.5.7B
Botnet
-
Default
C2
-
95.214.27.226:6606
-
95.214.27.226:7707
-
95.214.27.226:8808
Mutex
-
AsyncMutex_6SI8OkPnk
Attributes
-
delay
3
-
install
false
-
install_folder
%AppData%
aes.plain
Signatures
- AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
- Async RAT payload 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c72e8271a4eb3c18cd2f83c50acd4d1b77f162be15b2011aa384eab178a7d51d.exe"C:\Users\Admin\AppData\Local\Temp\c72e8271a4eb3c18cd2f83c50acd4d1b77f162be15b2011aa384eab178a7d51d.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
94308059B57B3142E455B38A6EB92015
Tar30D8.tmp
memory/2020-54-0x00000000280C0000-0x00000000280D5000-memory.dmp
memory/2020-55-0x0000000028260000-0x0000000028272000-memory.dmp
memory/2020-56-0x00000000415C0000-0x0000000041640000-memory.dmp
memory/2020-57-0x00000000415C0000-0x0000000041640000-memory.dmp
memory/2020-95-0x00000000415C0000-0x0000000041640000-memory.dmp