Analysis
-
max time kernel
148s -
max time network
161s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
-
submitted
07-10-2023 08:33
General
-
Target
6543c547b83be07c11742aebcba0264026667005c7d4b90ca9ee8da62ad06984.exe
-
Size
10.2MB
-
MD5
6cfc8a19911d2a4401c1c362587e83ce
-
SHA1
757f656302382738175a6a73ed7e412bba55011c
-
SHA256
6543c547b83be07c11742aebcba0264026667005c7d4b90ca9ee8da62ad06984
-
SHA512
4da1ae530f9e06cf69ee4d68f5166586096940248f58954e928e16d56faa2cdefcb4ba865588964a254659c14642de8af9fe8e393a168a642e9a5648ef5f29a2
-
SSDEEP
98304:01+qfbaSe1um0WohRcxAqV6EiTEEhG8VdjDEJgkKQ:nGWM0x7VdiAfj
Score
10/10
Malware Config
Extracted
Family
asyncrat
Version
5.0.5
Botnet
Crypt One
C2
194.180.49.190:9254
Mutex
c7737c6a-d18e-4344-9a5b-860541cfb072
Attributes
-
delay
1
-
install
false
-
install_folder
%AppData%
aes.plain
Signatures
-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
Async RAT payload 2 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\6543c547b83be07c11742aebcba0264026667005c7d4b90ca9ee8da62ad06984.exe"C:\Users\Admin\AppData\Local\Temp\6543c547b83be07c11742aebcba0264026667005c7d4b90ca9ee8da62ad06984.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe2⤵
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
88KB
-
Filesize
7.7MB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
7.7MB
-
Filesize
64KB
-
Filesize
10.6MB
-
Filesize
10.6MB
-
Filesize
10.6MB