Analysis

  • max time kernel
    135s
  • max time network
    145s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31-05-2023 05:51

General

  • Target

    x5Z0luEJ3fbsDaW.exe

  • Size

    578KB

  • MD5

    c514ff7ca1abd4e92b17c1249e00569f

  • SHA1

    5ca2b947a3722a75b6b4299e8aa2341fac1da608

  • SHA256

    e7257b2ef7c6b3b168ad3671313943edd71572ac24421d765890a878a67556bb

  • SHA512

    2e4e005a235281fc94a50489dcb2d3410800fd3e595d0350289ea31dd6f1fd60ebd0acd55692a5c913a39b391116c7a892d467fd40488b49beaa93d4ad82ebba

  • SSDEEP

    12288:Q4AMTihh6xhZ6Orm8pet86bqUoEjU7tkJB02EiK:gMUgh8yna86YEjU7tOBxE

Score
10/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

Default

C2

95.214.27.44:6606

95.214.27.44:7707

95.214.27.44:8808

Mutex

AsyncMutex_6SI8OkPnk

Attributes
  • delay

    3

  • install

    false

  • install_folder

    %AppData%

aes.plain
1
VnkWYQArgrWwD46JQXD25k7xzYXhqbfb

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

  • Async RAT payload 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\x5Z0luEJ3fbsDaW.exe
    "C:\Users\Admin\AppData\Local\Temp\x5Z0luEJ3fbsDaW.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:4808
    • C:\Users\Admin\AppData\Local\Temp\x5Z0luEJ3fbsDaW.exe
      "C:\Users\Admin\AppData\Local\Temp\x5Z0luEJ3fbsDaW.exe"
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:5048

Network

  • flag-us
    DNS
    133.211.185.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    133.211.185.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    22.160.190.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    22.160.190.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    95.221.229.192.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    95.221.229.192.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    58.55.71.13.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    58.55.71.13.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    8.3.197.209.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    8.3.197.209.in-addr.arpa
    IN PTR
    Response
    8.3.197.209.in-addr.arpa
    IN PTR
    vip0x008map2sslhwcdnnet
  • flag-us
    DNS
    233.141.123.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    233.141.123.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    44.27.214.95.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    44.27.214.95.in-addr.arpa
    IN PTR
    Response
  • 52.152.110.14:443
    260 B
    5
  • 10.127.0.68:7707
    x5Z0luEJ3fbsDaW.exe
  • 84.53.175.11:80
    322 B
    7
  • 52.152.110.14:443
    260 B
    5
  • 10.127.0.68:7707
    x5Z0luEJ3fbsDaW.exe
  • 95.214.27.44:6606
    tls
    x5Z0luEJ3fbsDaW.exe
    5.4kB
    5.8kB
    49
    49
  • 52.152.110.14:443
    260 B
    5
  • 52.152.110.14:443
    260 B
    5
  • 52.152.110.14:443
    260 B
    5
  • 52.152.110.14:443
    208 B
    4
  • 8.8.8.8:53
    133.211.185.52.in-addr.arpa
    dns
    73 B
    147 B
    1
    1

    DNS Request

    133.211.185.52.in-addr.arpa

  • 8.8.8.8:53
    22.160.190.20.in-addr.arpa
    dns
    72 B
    158 B
    1
    1

    DNS Request

    22.160.190.20.in-addr.arpa

  • 8.8.8.8:53
    95.221.229.192.in-addr.arpa
    dns
    73 B
    144 B
    1
    1

    DNS Request

    95.221.229.192.in-addr.arpa

  • 8.8.8.8:53
    58.55.71.13.in-addr.arpa
    dns
    70 B
    144 B
    1
    1

    DNS Request

    58.55.71.13.in-addr.arpa

  • 8.8.8.8:53
    8.3.197.209.in-addr.arpa
    dns
    70 B
    111 B
    1
    1

    DNS Request

    8.3.197.209.in-addr.arpa

  • 8.8.8.8:53
    233.141.123.20.in-addr.arpa
    dns
    73 B
    159 B
    1
    1

    DNS Request

    233.141.123.20.in-addr.arpa

  • 8.8.8.8:53
    44.27.214.95.in-addr.arpa
    dns
    71 B
    146 B
    1
    1

    DNS Request

    44.27.214.95.in-addr.arpa

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\x5Z0luEJ3fbsDaW.exe.log

    Filesize

    1KB

    MD5

    36049bae97bba745c793444373453cb0

    SHA1

    eb6e9a822944e8e207abba1a5e53f0183a1684f1

    SHA256

    839fa1f9725719938ffa24533587b168bae2768f23ac09dccb3ad4ab8ae6abcd

    SHA512

    a6584b7b435afeffb6becfbed82517087030eb23534fa50deecd02330bf36d633ba22e979e36b9c27e35885f9cc1cc9481dadc53cc265be61391e11a7c2c7cdb

  • memory/4808-133-0x0000000000E50000-0x0000000000EE6000-memory.dmp

    Filesize

    600KB

  • memory/4808-134-0x0000000005A00000-0x0000000005A10000-memory.dmp

    Filesize

    64KB

  • memory/4808-135-0x0000000005FC0000-0x0000000006564000-memory.dmp

    Filesize

    5.6MB

  • memory/4808-136-0x0000000005AB0000-0x0000000005B42000-memory.dmp

    Filesize

    584KB

  • memory/4808-137-0x0000000005A00000-0x0000000005A10000-memory.dmp

    Filesize

    64KB

  • memory/4808-138-0x0000000007430000-0x00000000074CC000-memory.dmp

    Filesize

    624KB

  • memory/5048-139-0x0000000000400000-0x0000000000412000-memory.dmp

    Filesize

    72KB

  • memory/5048-142-0x00000000053C0000-0x00000000053D0000-memory.dmp

    Filesize

    64KB

  • memory/5048-143-0x00000000053C0000-0x00000000053D0000-memory.dmp

    Filesize

    64KB

  • memory/5048-144-0x0000000005920000-0x0000000005986000-memory.dmp

    Filesize

    408KB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.