Analysis
-
max time kernel
138s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
-
submitted
21-11-2023 01:55
General
-
Target
payload1.exe
-
Size
45KB
-
MD5
7f11f6d1e63801a069b5242455439045
-
SHA1
ed9176679792aff0b09a45f14dcec0e15973b692
-
SHA256
128ee5116439827966392f77da9527f5f586ff5efa62a8f3f50c7d7a2e56757a
-
SHA512
14785bd6b5673e107c319bfdb1ed6265f1e525e3f0e314d63a291237b127c9fc4574abc1e39a39d3c186944301d9c8bbdbb522a5f2bafede4c633d88fd743b76
-
SSDEEP
768:mu/dRTUo0HQbWUnmjSmo2qMwKjPGaG6PIyzjbFgX3ixKF335WNVYBDZyx:mu/dRTUPE2kKTkDy3bCXScZPdyx
Score
10/10
Malware Config
Extracted
Family
asyncrat
Version
0.5.8
Botnet
YAHOO
C2
iced.ddns.net:6606
Mutex
rHxUsNj7QMwN
Attributes
-
delay
3
-
install
false
-
install_folder
%AppData%
aes.plain
Signatures
-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
Detect ZGRat V1 1 IoCs
-
ZGRat
ZGRat is remote access trojan written in C#.
-
Async RAT payload 1 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\payload1.exe"C:\Users\Admin\AppData\Local\Temp\payload1.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
7.7MB
-
Filesize
72KB
-
Filesize
64KB
-
Filesize
624KB
-
Filesize
5.6MB
-
Filesize
408KB
-
Filesize
472KB
-
Filesize
624KB
-
Filesize
120KB
-
Filesize
256KB
-
Filesize
40KB
-
Filesize
7.7MB
-
Filesize
64KB