Analysis
-
max time kernel
121s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
24-01-2024 12:50
Behavioral task
behavioral1
Sample
AsyncClient.exe
Resource
win7-20231215-en
General
-
Target
AsyncClient.exe
-
Size
66KB
-
MD5
c3e2e729e929b8c7f7d5f3d44ea06d64
-
SHA1
159f9bcfb6a6a52578ad71b0fa4b529f6d788527
-
SHA256
d0b450b6f9127442b116bbc870a643335dbb5ec0eb861b579bd8db96bd995cc8
-
SHA512
7cf46135a5bc2ab4ec5962fd7da851e0f6d6471608141cf9b86408dc20e5778bfc20cbc2520a5a4aa671a802b4127e0673d18539a33b4ccae8dc493768e9c5d8
-
SSDEEP
1536:C2wukvF1ak9gcKu5UYF6FhtOtCifbSN/8tgZvoWdYq3rPlTGNx:C2dkvF1ak9Ku5UYFKv6CAbSutgZvrd3y
Malware Config
Extracted
asyncrat
| Edit 3LOSH RAT
2024
w3llstore.mywire.org:6606
w3llstore.mywire.org:7707
w3llstore.mywire.org:8808
Dashboard_60101kCSS
-
delay
3
-
install
false
-
install_folder
%AppData%
Signatures
-
Async RAT payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/2528-0-0x0000000000E60000-0x0000000000E76000-memory.dmp asyncrat -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
AsyncClient.exepid process 2528 AsyncClient.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
AsyncClient.exedescription pid process Token: SeDebugPrivilege 2528 AsyncClient.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
AsyncClient.exepid process 2528 AsyncClient.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Cab4F3B.tmpFilesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
memory/2528-0-0x0000000000E60000-0x0000000000E76000-memory.dmpFilesize
88KB
-
memory/2528-1-0x0000000074260000-0x000000007494E000-memory.dmpFilesize
6.9MB
-
memory/2528-2-0x0000000000BB0000-0x0000000000BF0000-memory.dmpFilesize
256KB
-
memory/2528-19-0x0000000074260000-0x000000007494E000-memory.dmpFilesize
6.9MB
-
memory/2528-20-0x0000000000BB0000-0x0000000000BF0000-memory.dmpFilesize
256KB