Analysis
- max time kernel
142s - max time network
157s - platform
windows10-2004_x64 - resource
win10v2004-20231127-en - resource tags
- submitted
01/12/2023, 16:08
General
- Target bScr.exe
- Size 47KB
- Sample231201-tk7s3sdd9t
- SHA256 81bbf492816fdf74123d81ae5f01d85764f9be418fe4930e7c569fcdff1b3787
Malware Config
Extracted
-
asyncrat
-
1.0.7
-
IVAN-DICI-1
-
varo12l.duckdns.org:8523
-
DcRatMutex_qwqdanchun
-
delay
1
-
install
false
-
install_folder
%AppData%
Signatures
- AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
- Async RAT payload 2 IoCs
- Delays execution with timeout.exe 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\bScr.exe"C:\Users\Admin\AppData\Local\Temp\bScr.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpEBA8.tmp.bat""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
tmpEBA8.tmp.bat
memory/1744-0-0x0000000000170000-0x0000000000182000-memory.dmp
memory/1744-1-0x00007FF84A080000-0x00007FF84AB41000-memory.dmp
memory/1744-2-0x000000001AE30000-0x000000001AE40000-memory.dmp
memory/1744-3-0x00007FF854F70000-0x00007FF854F89000-memory.dmp
memory/1744-4-0x00007FF84A080000-0x00007FF84AB41000-memory.dmp
memory/1744-5-0x000000001AE30000-0x000000001AE40000-memory.dmp
memory/1744-6-0x000000001CCB0000-0x000000001CD26000-memory.dmp
memory/1744-7-0x000000001CC30000-0x000000001CC94000-memory.dmp
memory/1744-8-0x000000001ADE0000-0x000000001ADFE000-memory.dmp
memory/1744-13-0x00007FF84A080000-0x00007FF84AB41000-memory.dmp
memory/1744-14-0x00007FF854F70000-0x00007FF854F89000-memory.dmp