Analysis
-
max time kernel
84s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230621-en -
resource tags
-
submitted
29/06/2023, 13:07
General
-
Target
decode_902fce6202c040a512c62fc4a5b36683cb78e09f76fb47ba371d2e1cea1429f3.exe
-
Size
47KB
-
MD5
4d8f961dc3396fa19c5e39e4314e84f7
-
SHA1
ae760973e2ddf7e0be1b268301ccbe584bb81678
-
SHA256
715f6f9aeaae1d34865039204dde4be900555a8e6c573d884707f6dc39ffb7c7
-
SHA512
335f5b2fb285bc9ca496e69197faec5c620e6f959899f0301df22a6e8a2b2a8a392925de1a23536a170d46a01bf9c238405909ace2283114fbda3438e22ff824
-
SSDEEP
768:5OEuILWCKi+Diq2FxhLRaqiOqYbJgePHtbMYZevEgK/JTZVc6KN:5OtmqaxXjZbGORBEnkJTZVclN
Score
10/10
Malware Config
Extracted
Family
asyncrat
Version
1.0.7
Botnet
22JUNIO-RODA
C2
20.200.63.2:2525
Mutex
DcRatMutex_qwqdanchun
Attributes
-
delay
1
-
install
false
-
install_folder
%AppData%
aes.plain
Signatures
-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
Async RAT payload 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\decode_902fce6202c040a512c62fc4a5b36683cb78e09f76fb47ba371d2e1cea1429f3.exe"C:\Users\Admin\AppData\Local\Temp\decode_902fce6202c040a512c62fc4a5b36683cb78e09f76fb47ba371d2e1cea1429f3.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
72KB
-
Filesize
64KB
-
Filesize
64KB