Analysis
-
max time kernel
78s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20230621-en -
resource tags
-
submitted
01-07-2023 07:54
General
-
Target
e989511efca30f5d0a994e476f88eacd7a7c0c5867e518f252c4c6825c940720.exe
-
Size
47KB
-
MD5
f42855ce84504c19eca9de5257501f2a
-
SHA1
d703ecd9dbd7e1a59d9980b04cbc6bf987150c77
-
SHA256
e989511efca30f5d0a994e476f88eacd7a7c0c5867e518f252c4c6825c940720
-
SHA512
3a0ba87de4df6e09eb4a05761696f4cfcddc44088066207a850d8906109753a2ee2da24256db6eae07d17e100952a9e02e78aaee3ca9c7bffcb8dcfb20dbd61b
-
SSDEEP
768:FOEuILWCKi+DiOwhA5iizYbWgeQARbLXgEkvEgK/JPZVc6KN:FOtmOwhUcbJJWbLXSnkJPZVclN
Score
10/10
Malware Config
Extracted
Family
asyncrat
Version
1.0.7
Botnet
28JUNIO-RODAJS
C2
20.200.63.2:2727
Mutex
DcRatMutex_qwqdanchun
Attributes
-
delay
1
-
install
false
-
install_folder
%AppData%
aes.plain
Signatures
-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
Async RAT payload 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e989511efca30f5d0a994e476f88eacd7a7c0c5867e518f252c4c6825c940720.exe"C:\Users\Admin\AppData\Local\Temp\e989511efca30f5d0a994e476f88eacd7a7c0c5867e518f252c4c6825c940720.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
72KB
-
Filesize
64KB
-
Filesize
64KB