Analysis

  • max time kernel
    145s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231222-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/01/2024, 19:30

General

  • Target

    75549a6b0135dba4f2d22b678b8983bd.exe

  • Size

    6KB

  • MD5

    75549a6b0135dba4f2d22b678b8983bd

  • SHA1

    b204b9b6eecf109c3a46c26663d389e4f5447463

  • SHA256

    6c784615d12dfc3af5716ed64194380a301becb7d7f99e08479ce6affd8c5b32

  • SHA512

    8859d5ec3ef5324a178e1e7dbe470a9f58242a209c7e2ff9f3f71f97e46d33b30c57d388fcba6a6038e6c4c27f9cd00e990110212c2c7d1bdbe879baf201f8b3

  • SSDEEP

    48:6RGL9Y1/ixat7I3J+HKX5LFqNMSgjMA9JTHgSl+HgKbkjcd4im54tdtdlrTaA6Gq:Qix53ke5LOgjwSlxjjcd4A19ozNtx

Score
10/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

Default

Mutex

AsyncMutex_6SI8OkPnk

Attributes
  • delay

    3

  • install

    false

  • install_file

    RuntimeBroker.exe

  • install_folder

    %AppData%

  • pastebin_config

    https://pastebin.com/raw/RFkwggEd

aes.plain

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

  • Async RAT payload 1 IoCs
  • Downloads MZ/PE file
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\75549a6b0135dba4f2d22b678b8983bd.exe
    "C:\Users\Admin\AppData\Local\Temp\75549a6b0135dba4f2d22b678b8983bd.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:4840

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/4840-0-0x0000000000620000-0x0000000000628000-memory.dmp

          Filesize

          32KB

        • memory/4840-1-0x00007FFB4DB40000-0x00007FFB4E601000-memory.dmp

          Filesize

          10.8MB

        • memory/4840-2-0x000000001B3C0000-0x000000001B3D0000-memory.dmp

          Filesize

          64KB

        • memory/4840-6-0x0000000002720000-0x0000000002732000-memory.dmp

          Filesize

          72KB

        • memory/4840-9-0x00007FFB4DB40000-0x00007FFB4E601000-memory.dmp

          Filesize

          10.8MB

        • memory/4840-10-0x000000001B3C0000-0x000000001B3D0000-memory.dmp

          Filesize

          64KB