Analysis

  • max time kernel
    144s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11-08-2023 01:16

General

  • Target

    d674779e87fc5ee336f74f85a0fab74a06c74cf7e95af033700e6140539df97f.exe

  • Size

    63KB

  • MD5

    3500d4b2b971499632cf0a306f266cfd

  • SHA1

    fccd254666c5f3d45d905b81d466d133753a6477

  • SHA256

    d674779e87fc5ee336f74f85a0fab74a06c74cf7e95af033700e6140539df97f

  • SHA512

    aecc869e89345858936599ca97d87156b1b2ea2f155f029969834ed0b42f645c1cd1e8c25c6948c0da4be6d13b9017b2137a751186a4b8dd62986e6fe2a583d3

  • SSDEEP

    1536:gIe8Lwzw4hQD7rDN8kYDxmheee/a8GbbXwzsbGItpqKmY7:gIe8Lwzw4hQD7r58kYDxmEe2GbbX52z

Score
10/10

Malware Config

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

  • Async RAT payload 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d674779e87fc5ee336f74f85a0fab74a06c74cf7e95af033700e6140539df97f.exe
    "C:\Users\Admin\AppData\Local\Temp\d674779e87fc5ee336f74f85a0fab74a06c74cf7e95af033700e6140539df97f.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:3276

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3276-133-0x0000029108E30000-0x0000029108E46000-memory.dmp

    Filesize

    88KB

  • memory/3276-134-0x00007FF8573F0000-0x00007FF857EB1000-memory.dmp

    Filesize

    10.8MB

  • memory/3276-135-0x000002910AA60000-0x000002910AA70000-memory.dmp

    Filesize

    64KB

  • memory/3276-136-0x00007FF8573F0000-0x00007FF857EB1000-memory.dmp

    Filesize

    10.8MB

  • memory/3276-137-0x000002910AA60000-0x000002910AA70000-memory.dmp

    Filesize

    64KB