Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
25-01-2024 05:17
Behavioral task
behavioral1
Sample
AsyncClient.exe
Resource
win7-20231215-en
5 signatures
150 seconds
General
-
Target
AsyncClient.exe
-
Size
66KB
-
MD5
c3e2e729e929b8c7f7d5f3d44ea06d64
-
SHA1
159f9bcfb6a6a52578ad71b0fa4b529f6d788527
-
SHA256
d0b450b6f9127442b116bbc870a643335dbb5ec0eb861b579bd8db96bd995cc8
-
SHA512
7cf46135a5bc2ab4ec5962fd7da851e0f6d6471608141cf9b86408dc20e5778bfc20cbc2520a5a4aa671a802b4127e0673d18539a33b4ccae8dc493768e9c5d8
-
SSDEEP
1536:C2wukvF1ak9gcKu5UYF6FhtOtCifbSN/8tgZvoWdYq3rPlTGNx:C2dkvF1ak9Ku5UYFKv6CAbSutgZvrd3y
Malware Config
Extracted
Family
asyncrat
Version
| Edit 3LOSH RAT
Botnet
2024
C2
w3llstore.mywire.org:6606
w3llstore.mywire.org:7707
w3llstore.mywire.org:8808
Mutex
Dashboard_60101kCSS
Attributes
-
delay
3
-
install
false
-
install_folder
%AppData%
aes.plain
Signatures
-
Async RAT payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/4752-0-0x0000000000170000-0x0000000000186000-memory.dmp asyncrat behavioral2/memory/4752-2-0x0000000004C70000-0x0000000004C80000-memory.dmp asyncrat -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
AsyncClient.exepid process 4752 AsyncClient.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
AsyncClient.exedescription pid process Token: SeDebugPrivilege 4752 AsyncClient.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
AsyncClient.exepid process 4752 AsyncClient.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4752-0-0x0000000000170000-0x0000000000186000-memory.dmpFilesize
88KB
-
memory/4752-1-0x00000000749E0000-0x0000000075190000-memory.dmpFilesize
7.7MB
-
memory/4752-2-0x0000000004C70000-0x0000000004C80000-memory.dmpFilesize
64KB
-
memory/4752-3-0x0000000005330000-0x00000000058D4000-memory.dmpFilesize
5.6MB
-
memory/4752-4-0x0000000004F30000-0x0000000004FC2000-memory.dmpFilesize
584KB
-
memory/4752-5-0x0000000004FD0000-0x0000000004FDA000-memory.dmpFilesize
40KB
-
memory/4752-6-0x00000000749E0000-0x0000000075190000-memory.dmpFilesize
7.7MB
-
memory/4752-7-0x0000000004C70000-0x0000000004C80000-memory.dmpFilesize
64KB