Analysis
-
max time kernel
141s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
-
submitted
01/10/2023, 22:53
General
-
Target
trobs.exe
-
Size
66KB
-
MD5
3b4469af11899c9676e137118e8f0750
-
SHA1
c2f4a5e6ae74fc94b4502b74c8ea9d32546cf1a6
-
SHA256
195fd15af94949ac8e9ea733823fbc8d71bdc08af2f8564c4c0ace271574a906
-
SHA512
58d2d304a2c311b761345f414ebc31dc48ea90725513c8b7896567978cc7037838ecf13797813549df485ec2977bdf84c17d08e89af16a1f6db80c27d609bf86
-
SSDEEP
1536:f2wukvF1ak9gcKu5UYFTwoqxGvJj5bbRlm3OjAeE8xdNrmTGdx:f2dkvF1ak9Ku5UYFTwJURj5bbROOjrrh
Score
10/10
Malware Config
Extracted
Family
asyncrat
Version
| Edit 3LOSH RAT
Botnet
Default
C2
jobsearchtest.com:6606
jobsearchtest.com:7707
jobsearchtest.com:8808
Mutex
AsyncMutex_6SI8OkPnk
Attributes
-
delay
3
-
install
false
-
install_folder
%AppData%
aes.plain
Signatures
-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
Async RAT payload 1 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\trobs.exe"C:\Users\Admin\AppData\Local\Temp\trobs.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
7.7MB
-
Filesize
88KB
-
Filesize
64KB
-
Filesize
5.6MB
-
Filesize
584KB
-
Filesize
40KB
-
Filesize
624KB
-
Filesize
408KB
-
Filesize
7.7MB
-
Filesize
64KB