Analysis
-
max time kernel
92s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
24-01-2024 12:50
Behavioral task
behavioral1
Sample
AsyncClient.exe
Resource
win7-20231215-en
General
-
Target
AsyncClient.exe
-
Size
66KB
-
MD5
c3e2e729e929b8c7f7d5f3d44ea06d64
-
SHA1
159f9bcfb6a6a52578ad71b0fa4b529f6d788527
-
SHA256
d0b450b6f9127442b116bbc870a643335dbb5ec0eb861b579bd8db96bd995cc8
-
SHA512
7cf46135a5bc2ab4ec5962fd7da851e0f6d6471608141cf9b86408dc20e5778bfc20cbc2520a5a4aa671a802b4127e0673d18539a33b4ccae8dc493768e9c5d8
-
SSDEEP
1536:C2wukvF1ak9gcKu5UYF6FhtOtCifbSN/8tgZvoWdYq3rPlTGNx:C2dkvF1ak9Ku5UYFKv6CAbSutgZvrd3y
Malware Config
Extracted
asyncrat
| Edit 3LOSH RAT
2024
w3llstore.mywire.org:6606
w3llstore.mywire.org:7707
w3llstore.mywire.org:8808
Dashboard_60101kCSS
-
delay
3
-
install
false
-
install_folder
%AppData%
Signatures
-
Async RAT payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/3924-0-0x0000000000AD0000-0x0000000000AE6000-memory.dmp asyncrat -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
AsyncClient.exepid process 3924 AsyncClient.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
AsyncClient.exedescription pid process Token: SeDebugPrivilege 3924 AsyncClient.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
AsyncClient.exepid process 3924 AsyncClient.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3924-0-0x0000000000AD0000-0x0000000000AE6000-memory.dmpFilesize
88KB
-
memory/3924-1-0x0000000074AB0000-0x0000000075260000-memory.dmpFilesize
7.7MB
-
memory/3924-2-0x0000000005500000-0x0000000005510000-memory.dmpFilesize
64KB
-
memory/3924-3-0x0000000005CC0000-0x0000000006264000-memory.dmpFilesize
5.6MB
-
memory/3924-4-0x00000000058B0000-0x0000000005942000-memory.dmpFilesize
584KB
-
memory/3924-5-0x0000000005890000-0x000000000589A000-memory.dmpFilesize
40KB
-
memory/3924-8-0x0000000006AB0000-0x0000000006B4C000-memory.dmpFilesize
624KB
-
memory/3924-9-0x00000000065E0000-0x0000000006646000-memory.dmpFilesize
408KB
-
memory/3924-10-0x0000000074AB0000-0x0000000075260000-memory.dmpFilesize
7.7MB
-
memory/3924-11-0x0000000005500000-0x0000000005510000-memory.dmpFilesize
64KB