Overview

overview

10

Static

static

3

2bc78e0d14...2d.exe

windows7-x64

10

2bc78e0d14...2d.exe

windows10-2004-x64

10

4922d2660f...c5.exe

windows7-x64

10

4922d2660f...c5.exe

windows10-2004-x64

1

4e14f58935...61.exe

windows7-x64

10

4e14f58935...61.exe

windows10-2004-x64

1

64b9d76ec0...52.exe

windows7-x64

10

64b9d76ec0...52.exe

windows10-2004-x64

3

79f68c9a2d...ee.exe

windows7-x64

7

79f68c9a2d...ee.exe

windows10-2004-x64

7

c984a9446b...d3.exe

windows7-x64

10

c984a9446b...d3.exe

windows10-2004-x64

3

d69dc8e0a1...67.exe

windows7-x64

10

d69dc8e0a1...67.exe

windows10-2004-x64

10

dff2cf2793...3f.exe

windows7-x64

10

dff2cf2793...3f.exe

windows10-2004-x64

1

e542080348...18.exe

windows7-x64

10

e542080348...18.exe

windows10-2004-x64

10

f96c9a2487...e6.exe

windows7-x64

10

f96c9a2487...e6.exe

windows10-2004-x64

3

fe2da521d1...ff.exe

windows7-x64

10

fe2da521d1...ff.exe

windows10-2004-x64

1

Analysis

  • max time kernel
    145s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    16-06-2023 15:11

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    dff2cf279301edf6166a5f144b93922f245bbfe58030e0633497f4271f6a763f.exe

  • Size

    2.0MB

  • MD5

    9bd3537fdb009ed4049bf505f28c000c

  • SHA1

    a73737a5ac8b16ebe0fc1037bfdcfe22812e724f

  • SHA256

    dff2cf279301edf6166a5f144b93922f245bbfe58030e0633497f4271f6a763f

  • SHA512

    f54959938255df2db61361a4cd552b48dc11710ec91305c74469363c7d6287a736a0162bb7750afa6b4b712b417d0fd19c8e2c4bf9e7674a3f46b46e5c5b9386

  • SSDEEP

    49152:rqg07TdlgvDugLv10D1Xt+sv2m8nFJAh+lParE:ilgIt+sv2mJ0CI

Score
10/10
asyncratdefaultrat

Malware Config

Extracted

Family

asyncrat

Version

1.0.7

Botnet

Default

C2

aa9064aa.e1.luyouxia.net:22391

Mutex

1

Attributes
  • delay

    1

  • install

    false

  • install_file

    1.exe

  • install_folder

    %AppData%

aes.plain

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat
  • Async RAT payload 1 IoCs
    rat
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\dff2cf279301edf6166a5f144b93922f245bbfe58030e0633497f4271f6a763f.exe
    "C:\Users\Admin\AppData\Local\Temp\dff2cf279301edf6166a5f144b93922f245bbfe58030e0633497f4271f6a763f.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:1724

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
    Filesize

    62KB

    MD5

    3ac860860707baaf32469fa7cc7c0192

    SHA1

    c33c2acdaba0e6fa41fd2f00f186804722477639

    SHA256

    d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

    SHA512

    d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\Tar1CD.tmp
    Filesize

    164KB

    MD5

    4ff65ad929cd9a367680e0e5b1c08166

    SHA1

    c0af0d4396bd1f15c45f39d3b849ba444233b3a2

    SHA256

    c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6

    SHA512

    f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27

    Download Submit
  • memory/1724-54-0x00000000286F0000-0x0000000028702000-memory.dmp
    Filesize

    72KB

    Download
  • memory/1724-55-0x00000000284C0000-0x00000000284D6000-memory.dmp
    Filesize

    88KB

    Download
  • memory/1724-56-0x0000000041780000-0x0000000041800000-memory.dmp
    Filesize

    512KB

    Download
  • memory/1724-57-0x0000000041780000-0x0000000041800000-memory.dmp
    Filesize

    512KB

    Download
  • memory/1724-58-0x0000000041780000-0x0000000041800000-memory.dmp
    Filesize

    512KB

    Download
  • memory/1724-59-0x0000000041780000-0x0000000041800000-memory.dmp
    Filesize

    512KB

    Download
  • memory/1724-60-0x0000000041780000-0x0000000041800000-memory.dmp
    Filesize

    512KB

    Download