Analysis
-
max time kernel
145s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
25/01/2024, 19:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
75549a6b0135dba4f2d22b678b8983bd.exe
Resource
win7-20231215-en
1 signatures
150 seconds
General
-
Target
75549a6b0135dba4f2d22b678b8983bd.exe
-
Size
6KB
-
MD5
75549a6b0135dba4f2d22b678b8983bd
-
SHA1
b204b9b6eecf109c3a46c26663d389e4f5447463
-
SHA256
6c784615d12dfc3af5716ed64194380a301becb7d7f99e08479ce6affd8c5b32
-
SHA512
8859d5ec3ef5324a178e1e7dbe470a9f58242a209c7e2ff9f3f71f97e46d33b30c57d388fcba6a6038e6c4c27f9cd00e990110212c2c7d1bdbe879baf201f8b3
-
SSDEEP
48:6RGL9Y1/ixat7I3J+HKX5LFqNMSgjMA9JTHgSl+HgKbkjcd4im54tdtdlrTaA6Gq:Qix53ke5LOgjwSlxjjcd4A19ozNtx
Malware Config
Extracted
Family
asyncrat
Version
0.5.7B
Botnet
Default
Mutex
AsyncMutex_6SI8OkPnk
Attributes
-
delay
3
-
install
false
-
install_file
RuntimeBroker.exe
-
install_folder
%AppData%
-
pastebin_config
https://pastebin.com/raw/RFkwggEd
aes.plain
Signatures
-
Async RAT payload 1 IoCs
resource yara_rule behavioral2/memory/4840-6-0x0000000002720000-0x0000000002732000-memory.dmp asyncrat -
Downloads MZ/PE file
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs
flow ioc 17 pastebin.com 18 pastebin.com 19 6.tcp.ngrok.io 46 6.tcp.ngrok.io 64 6.tcp.ngrok.io -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4840 75549a6b0135dba4f2d22b678b8983bd.exe