Analysis
-
max time kernel
58s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
30/12/2023, 01:37
General
-
Target
0a513f2465f58e492d40d9fe2777762d.exe
-
Size
1.3MB
-
MD5
0a513f2465f58e492d40d9fe2777762d
-
SHA1
555db956e8a0127a89d203cf694381713bb4d0fd
-
SHA256
f1403d60975bdc80d798c2b3b8f0fd47822fba04da7c254c274b63a09cf0e6c7
-
SHA512
9d0b78fc3fdfc592de9f30752455605fa39b4479f14206f42ef082557299c9a1c95d8091ceb4ae45b11b2d80fcf94038ce8d2453a93815361b1235b4ee929f4b
-
SSDEEP
24576:2HdS/d3RYdkJUTcfAmWnOc6GO5NB+ihuxxUmwRGPoN7vdiTbnFM:SMvo765L+ihO+m/PoiM
Malware Config
Extracted
asyncrat
0.5.7B
30/7/2021.exe
5541.gotdns.ch:5541
30/7/2021
-
delay
3
-
install
false
-
install_file
30/7/2021.scr
-
install_folder
%AppData%
Signatures
-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
Async RAT payload 3 IoCs
-
CustAttr .NET packer 1 IoCs
Detects CustAttr .NET packer in memory.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes
-
C:\Users\Admin\AppData\Local\Temp\0a513f2465f58e492d40d9fe2777762d.exe"C:\Users\Admin\AppData\Local\Temp\0a513f2465f58e492d40d9fe2777762d.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\0a513f2465f58e492d40d9fe2777762d.exe"C:\Users\Admin\AppData\Local\Temp\0a513f2465f58e492d40d9fe2777762d.exe"2⤵
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\wXkVgyFBi" /XML "C:\Users\Admin\AppData\Local\Temp\tmp2A09.tmp"2⤵
- Creates scheduled task(s)
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD517573558c4e714f606f997e5157afaac
SHA113e16e9415ceef429aaf124139671ebeca09ed23
SHA256c18db6aecad2436da4a63ff26af4e3a337cca48f01c21b8db494fe5ccc60e553
SHA512f4edf13f05a0d142e4dd42802098c8c44988ee8869621a62c2b565a77c9a95857f636583ff8d6d9baa366603d98b9bfbf1fc75bc6f9f8f83c80cb1215b2941cc
-
Filesize
1KB
MD5dacc156207f592fed05dd9953b942490
SHA1894ddb6a8c04a669924ac5c9224f0667212ff8a8
SHA2560ca51576ab92e24c74a8d7a94cfa09c6c2438c7c176c88400794628cbe8f6574
SHA5129999366fb19bab03ea88ed0b4545ed10774bc95ee31337c981f5c81210ad21e565ecc2bb29b381d76bb1195ba915d4d89e07c57487ace3a988a56442c7a88ea6
-
Filesize
64KB
-
Filesize
520KB
-
Filesize
5.6MB
-
Filesize
7.7MB
-
Filesize
344KB
-
Filesize
40KB
-
Filesize
72KB
-
Filesize
7.7MB
-
Filesize
72KB
-
Filesize
584KB
-
Filesize
1.3MB
-
Filesize
7.7MB
-
Filesize
624KB
-
Filesize
7.7MB
-
Filesize
72KB
-
Filesize
64KB
-
Filesize
7.7MB
-
Filesize
64KB