Analysis
- max time kernel
146s - max time network
139s - platform
windows7_x64 - resource
win7-20230831-en - resource tags
- submitted
05/09/2023, 03:45
General
- Target markov_small.exe
- Size 193KB
- Sample230905-ea4lcach7t
- SHA256 6813c99d910053cfa4ee065e0541a3230a9592dc6b2374ac2ff6f0ec99a3c364
Malware Config
Extracted
-
asyncrat
-
Default
-
127.0.0.1:3232
-
82.147.85.168:3232
-
HKبqoVMhzרYP斯迪7杰ي勒ק
-
delay
1
-
install
false
-
install_folder
%AppData%
Signatures
- AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
- Async RAT payload 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\markov_small.exeC:\Users\Admin\AppData\Local\Temp\markov_small.exe payload.bin1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2076-0-0x00000000002C0000-0x00000000002DA000-memory.dmp
memory/2076-1-0x0000000000490000-0x00000000004A6000-memory.dmp
memory/2076-2-0x000007FEF5C30000-0x000007FEF661C000-memory.dmp
memory/2076-3-0x000000001B130000-0x000000001B1B0000-memory.dmp
memory/2076-4-0x000000001B130000-0x000000001B1B0000-memory.dmp
memory/2076-5-0x000000001B130000-0x000000001B1B0000-memory.dmp
memory/2076-6-0x00000000778E0000-0x0000000077A89000-memory.dmp
memory/2076-7-0x000007FEF5C30000-0x000007FEF661C000-memory.dmp
memory/2076-8-0x000000001B130000-0x000000001B1B0000-memory.dmp
memory/2076-9-0x00000000778E0000-0x0000000077A89000-memory.dmp