Analysis
-
max time kernel
141s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
-
submitted
31-07-2023 23:48
General
-
Target
0e4df6585ab07e8e62e0072fcb86f4f6ef0bca491851ab448b0bdcc4ea9e4e0d.exe
-
Size
47KB
-
MD5
472512528a7908cda186e815079dd062
-
SHA1
c473bb386868e1de2d0809cc8d8fa4531a90a06f
-
SHA256
0e4df6585ab07e8e62e0072fcb86f4f6ef0bca491851ab448b0bdcc4ea9e4e0d
-
SHA512
6c6f9faab91fb09a74f5678766100e5cb224bc47a570e486b6c420dd29d427d28778a741e0289ad78f6979389b43d8ce49bb2edd6a1e8eeef739fa081d82607a
-
SSDEEP
768:BOEuILWCKi+DiPtSryQ8AI/Picr8YbAgeioIvEgK/JrZVc6KN:BOtmlS2fAkzbndnkJrZVclN
Score
10/10
Malware Config
Extracted
Family
asyncrat
Version
1.0.7
Botnet
Default
C2
213.238.177.40:8848
Mutex
DcRatMutex_qwqdanchun
Attributes
-
delay
1
-
install
false
-
install_folder
%AppData%
aes.plain
Signatures
-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
Async RAT payload 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0e4df6585ab07e8e62e0072fcb86f4f6ef0bca491851ab448b0bdcc4ea9e4e0d.exe"C:\Users\Admin\AppData\Local\Temp\0e4df6585ab07e8e62e0072fcb86f4f6ef0bca491851ab448b0bdcc4ea9e4e0d.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
72KB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
100KB
-
Filesize
10.8MB
-
Filesize
64KB