Analysis
-
max time kernel
157s -
max time network
169s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
-
submitted
11/10/2023, 23:10
General
-
Target
b635d774f728b3307a344310255dc6a7a08cc5f848e2118d57bd70dbb840f327.exe
-
Size
114KB
-
MD5
bdfbfce31f405741b0117398654af64c
-
SHA1
3f4241a546d5d062e571ecfb31aa657c89a90fd0
-
SHA256
b635d774f728b3307a344310255dc6a7a08cc5f848e2118d57bd70dbb840f327
-
SHA512
27108c63a3f6e5f2d323cfecd3146613f1569af397ac26042e86bf71ab5ff218730245c7602a80f9f957e047d2525a1198d1be145483b881a0e170cf98cf52d6
-
SSDEEP
3072:uZ8w8JDKsEyvZivfJWF2Hs4e1r6vvHS2CNSp2V3dsxXeR9P0f:m84sEycvfJWF2Hs4e1OyxUaNIOOf
Malware Config
Extracted
asyncrat
Default
124.248.66.140:4449
hcryvzljbqgbuyprudy
-
delay
1
-
install
false
-
install_folder
%AppData%
Signatures
-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
Async RAT payload 1 IoCs
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b635d774f728b3307a344310255dc6a7a08cc5f848e2118d57bd70dbb840f327.exe"C:\Users\Admin\AppData\Local\Temp\b635d774f728b3307a344310255dc6a7a08cc5f848e2118d57bd70dbb840f327.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
352KB
-
Filesize
352KB
-
Filesize
112KB
-
Filesize
7.7MB
-
Filesize
64KB
-
Filesize
96KB
-
Filesize
7.7MB
-
Filesize
64KB
-
Filesize
5.6MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
584KB
-
Filesize
40KB
-
Filesize
624KB
-
Filesize
408KB
-
Filesize
64KB
-
Filesize
64KB