Overview

overview

10

Static

static

3

RFQ# 60001...MG.exe

windows7-x64

10

RFQ# 60001...MG.exe

windows10-2004-x64

1

Analysis

  • max time kernel
    55s
  • max time network
    146s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    08-05-2023 16:21

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    RFQ# 6000163267.IMG.exe

  • Size

    969KB

  • MD5

    57e2bc8139286c9c5e8b34efe9f3a762

  • SHA1

    37ee61c9ddc1f81ae024ad465eaa6a745c07dbf3

  • SHA256

    e33ad76851f23305a18b0db3a98c45280c581505da95f701e265a8479713c3ff

  • SHA512

    0a9c79a4091bd52ce1fe137fd48349bd10620b5a68392226ba732af7fa4e7d4ab0b5f2790d1b4cac472c4752be9ad138056b86c9b394bf6720a20d04a2b345f3

  • SSDEEP

    12288:s4mT/RcXtvyJdBQhXVQppDv4alnZqby13caYgd2DHs:s4C/6XtvWBmQppTggcaYgd0

Score
10/10
asyncratdefaultrat

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

Default

C2

209.90.234.22:6606

209.90.234.22:7707

209.90.234.22:8808
Mutex

AsyncMutex_6SI8OkPnk

Attributes
  • delay

    3

  • install

    false

  • install_folder

    %AppData%

aes.plain

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat
  • Async RAT payload 4 IoCs
    rat
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\RFQ# 6000163267.IMG.exe
    "C:\Users\Admin\AppData\Local\Temp\RFQ# 6000163267.IMG.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:1380

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
    Filesize

    62KB

    MD5

    3ac860860707baaf32469fa7cc7c0192

    SHA1

    c33c2acdaba0e6fa41fd2f00f186804722477639

    SHA256

    d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

    SHA512

    d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\TarCBEF.tmp
    Filesize

    164KB

    MD5

    4ff65ad929cd9a367680e0e5b1c08166

    SHA1

    c0af0d4396bd1f15c45f39d3b849ba444233b3a2

    SHA256

    c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6

    SHA512

    f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27

    Download Submit

  • memory/1380-54-0x00000000003E0000-0x00000000003F5000-memory.dmp

    Filesize

    84KB

    Download

  • memory/1380-55-0x0000000028260000-0x0000000028272000-memory.dmp

    Filesize

    72KB

    Download

  • memory/1380-56-0x0000000041660000-0x00000000416E0000-memory.dmp

    Filesize

    512KB

    Download

  • memory/1380-57-0x0000000041660000-0x00000000416E0000-memory.dmp

    Filesize

    512KB

    Download

  • memory/1380-58-0x0000000041660000-0x00000000416E0000-memory.dmp

    Filesize

    512KB

    Download

  • memory/1380-76-0x0000000041660000-0x00000000416E0000-memory.dmp

    Filesize

    512KB

    Download

  • memory/1380-77-0x0000000028480000-0x00000000284A6000-memory.dmp

    Filesize

    152KB

    Download

  • memory/1380-98-0x0000000041660000-0x00000000416E0000-memory.dmp

    Filesize

    512KB

    Download