Analysis

  • max time kernel
    187s
  • max time network
    211s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/10/2023, 10:32

General

  • Target

    AsyncRAT.exe

  • Size

    10.8MB

  • MD5

    81234b22c35ff9001494b2061537b230

  • SHA1

    4bf2b140004f0ecc33bcf0e3459f6546275ff96b

  • SHA256

    f5e940e56280e10065276828324b21876deafc911dcad56fb3bcf8110785745f

  • SHA512

    9c6bb25e5c448c0b829f9afe6ed79d969d336952bf390e678e56a632adf783fe14296f6c186437a8c2d4c92ad667a1e155d160c9ef2849874d93c8a58b965365

  • SSDEEP

    196608:7OWlEEAQq7aI7RfpN5htinUlobhCUW1fBHJDoq7tzEscEWuY:qWfAQkT7BpN5htinQsh21t1oqZz2

Score
10/10

Malware Config

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

  • Async RAT payload 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

Processes

  • C:\Users\Admin\AppData\Local\Temp\AsyncRAT.exe
    "C:\Users\Admin\AppData\Local\Temp\AsyncRAT.exe"
    1⤵
      PID:1936

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • memory/1936-0-0x0000019C79200000-0x0000019C79CC6000-memory.dmp

            Filesize

            10.8MB

          • memory/1936-2-0x00007FFBE4500000-0x00007FFBE4FC1000-memory.dmp

            Filesize

            10.8MB

          • memory/1936-3-0x0000019C7B870000-0x0000019C7B880000-memory.dmp

            Filesize

            64KB

          • memory/1936-4-0x00007FFBE4500000-0x00007FFBE4FC1000-memory.dmp

            Filesize

            10.8MB

          • memory/1936-5-0x00007FFBE4500000-0x00007FFBE4FC1000-memory.dmp

            Filesize

            10.8MB