Analysis

  • max time kernel
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231222-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08-01-2024 20:49

General

  • Target

    d1cc9c3dfe7a71d641ead1f15911a697b5daa63a6a2ce7030a22d947d9847d91.exe

  • Size

    340KB

  • MD5

    71beab388a6fe442ce8736ca8625dd72

  • SHA1

    c594208ed681009338833ef4baa1b43e4f3ff7cf

  • SHA256

    d1cc9c3dfe7a71d641ead1f15911a697b5daa63a6a2ce7030a22d947d9847d91

  • SHA512

    9f6764899ee48ac3cc23cdfd18ef5289565d351c172e08b2699dc455986f6705f98de4d46a015ece1b0f04c1212642e4a121f4e0cd65fbfef49cd73ac9e569a5

  • SSDEEP

    6144:m7xbOgrqt8NiB/gzKETwEMATGKi5fbAl/yEaqne0Z07a7igtEZ:mat8NiVcTwYiKakk/90btEZ

Score
10/10

Malware Config

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

  • Async RAT payload 1 IoCs
  • VMProtect packed file 1 IoCs

    Detects executables packed with VMProtect commercial packer.

Processes

  • C:\Users\Admin\AppData\Local\Temp\d1cc9c3dfe7a71d641ead1f15911a697b5daa63a6a2ce7030a22d947d9847d91.exe
    "C:\Users\Admin\AppData\Local\Temp\d1cc9c3dfe7a71d641ead1f15911a697b5daa63a6a2ce7030a22d947d9847d91.exe"
    1⤵
      PID:1552

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1552-1-0x0000000074C60000-0x0000000075410000-memory.dmp

      Filesize

      7.7MB

    • memory/1552-0-0x0000000000BC0000-0x0000000000C56000-memory.dmp

      Filesize

      600KB

    • memory/1552-2-0x0000000009AC0000-0x0000000009B52000-memory.dmp

      Filesize

      584KB

    • memory/1552-3-0x0000000009B60000-0x0000000009BC6000-memory.dmp

      Filesize

      408KB

    • memory/1552-5-0x0000000005710000-0x00000000057AC000-memory.dmp

      Filesize

      624KB

    • memory/1552-6-0x0000000005D60000-0x0000000006304000-memory.dmp

      Filesize

      5.6MB

    • memory/1552-9-0x0000000005550000-0x0000000005551000-memory.dmp

      Filesize

      4KB

    • memory/1552-10-0x0000000009C00000-0x0000000009C10000-memory.dmp

      Filesize

      64KB

    • memory/1552-8-0x0000000005550000-0x0000000005551000-memory.dmp

      Filesize

      4KB

    • memory/1552-7-0x0000000005550000-0x0000000005551000-memory.dmp

      Filesize

      4KB

    • memory/1552-4-0x00000000055F0000-0x0000000005666000-memory.dmp

      Filesize

      472KB

    • memory/1552-11-0x0000000074C60000-0x0000000075410000-memory.dmp

      Filesize

      7.7MB

    • memory/1552-12-0x0000000005550000-0x0000000005551000-memory.dmp

      Filesize

      4KB

    • memory/1552-13-0x0000000009C00000-0x0000000009C10000-memory.dmp

      Filesize

      64KB