Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
-
submitted
08/07/2023, 21:08
General
-
Target
bOgZ.exe
-
Size
48KB
-
MD5
3c92548017132ee425263bf2f12dda3f
-
SHA1
89070c20afc9182457b0ce3fa6870670a41a8d3d
-
SHA256
6f92b2cdb8b5f68d20dbc7ca23c3a3ec78c4ef1859001940dfa22e38ce459d30
-
SHA512
63dd190d3b21f77b5656a2d668c7001b3dd60f5212fce992bb8a59a3bf85191ec1950df132a9fb557fd9889481af61a7df9547a2b9334d0f38e23153ead92fba
-
SSDEEP
768:gu/zBTxJG1SWUk/GRmo2qbMo+o0D1EqgVPIJVHAge90bID4mWcXuiKLfuumBDZ8e:gu/zBTxg42tTEqgyJVH3bID1WcXtKLFk
Malware Config
Extracted
asyncrat
0.5.7B
deluxe
104.243.47.45:8808
104.243.47.45:5230
104.243.47.45:7707
104.243.47.45:6606
celsperial.hopto.org:8808
celsperial.hopto.org:5230
celsperial.hopto.org:7707
celsperial.hopto.org:6606
AsyncMutex_6SI8OkPnk
-
delay
10
-
install
false
-
install_folder
%AppData%
Signatures
-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
Async RAT payload 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\bOgZ.exe"C:\Users\Admin\AppData\Local\Temp\bOgZ.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
72KB
-
Filesize
64KB
-
Filesize
624KB
-
Filesize
5.6MB
-
Filesize
408KB
-
Filesize
64KB