Analysis
-
max time kernel
148s -
max time network
130s -
platform
windows7_x64 -
resource
win7-20231020-en -
resource tags
-
submitted
21-10-2023 23:03
General
-
Target
download-filearr.exe
-
Size
63KB
-
MD5
fb63ddb5e6b526c7bb1c0559995819ff
-
SHA1
7a142ffb48e65fd4ce71fafee8b75ba2c057f25a
-
SHA256
98155c900f39faac6a42133850329caabc8bf4ebcc90d5037f481aaa86c7240f
-
SHA512
ddb24a9091668be098ac5c4727351bb8d5e502aac4a42590d0cfeaa45991e7699b415d830270624a54e64487c010e4ea3c5d1310863e936f3ea4b4bd51c124a7
-
SSDEEP
1536:KTWI8rSfQ/9Tc1s21vGtoMbbPwb6TjxkscpqKmY7:KTWLrSY/d6thGuMbbPTjx73z
Score
10/10
Malware Config
Extracted
Family
asyncrat
Version
1.0.7
Botnet
Default
Mutex
DcRatMutex_qwqdanchun
Attributes
-
delay
1
-
install
false
-
install_file
svchost.exe
-
install_folder
%AppData%
aes.plain
Signatures
-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
Async RAT payload 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\download-filearr.exe"C:\Users\Admin\AppData\Local\Temp\download-filearr.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
88KB
-
Filesize
9.9MB
-
Filesize
512KB
-
Filesize
1.7MB
-
Filesize
9.9MB
-
Filesize
512KB
-
Filesize
1.7MB