Analysis
-
max time kernel
149s -
max time network
30s -
platform
windows7_x64 -
resource
win7-20230621-en -
resource tags
-
submitted
01/07/2023, 07:42
General
-
Target
aliexe.exe
-
Size
62KB
-
MD5
63bf8f12fe0888f2ff1bde122aeca21f
-
SHA1
0aaffbdf45abc2cd919d32d19206bbbd04e56802
-
SHA256
ed7156a259cecc750c121faed21545185d9436de677556ef9e271e519073fb34
-
SHA512
3b75ef81b6911d3126ed2430554143f0801da7cc3e1d1685b3b2b677cacd4113cd9bd27cc98b83b5e78aea789a05c8b9d7fa6fc2b7a713d5db161079d78ef3e9
-
SSDEEP
768:rHrBQOGhV1Xj+IfxXiYo3PbE5HGfAp0IMeIcm7/RrabXFEY88phq73chWkq32WxK:rLKVFQY95mIaP1cyobXda7F2nq7wx
Score
10/10
Malware Config
Extracted
Family
asyncrat
Version
| Edit 3LOSH RAT
Botnet
LEDGER MOHAMED POP
C2
dynsys.is-a-guru.com:6606
dynsys.is-a-guru.com:7707
dynsys.is-a-guru.com:8808
Mutex
AsyncMutex_g
Attributes
-
delay
3
-
install
false
-
install_folder
%AppData%
aes.plain
Signatures
-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
Async RAT payload 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\aliexe.exe"C:\Users\Admin\AppData\Local\Temp\aliexe.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
88KB
-
Filesize
256KB