Analysis
-
max time kernel
145s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
-
submitted
12/02/2024, 04:17
General
-
Target
50a16971e1979b9fedd35969fb3e0658480d2d18139a935d065f76c002c8a961.exe
-
Size
45KB
-
MD5
a46741ec2864a2c9c7cfe6afa5f38873
-
SHA1
58019aaf83bb12c84e5df67b01bfb3295006c3ae
-
SHA256
50a16971e1979b9fedd35969fb3e0658480d2d18139a935d065f76c002c8a961
-
SHA512
1c291721f2b7b7fd0292521829502c4263bd4358800f1b4279f8f4cdf6c0b02d964ed71035ad2ca3f53ff71ca530601b7eedb3bba48778a3f9daa5ab2cc3bc60
-
SSDEEP
768:IeI6b/GoWoGX8ye91Vstjb0gxh5tdd3EvMCPEJAAuYDDG62tYcFmVc6K:IwGsYlbbxryvnAtDG6KmVcl
Score
10/10
Malware Config
Extracted
Family
asyncrat
Version
0.5.6B
C2
koradon.giize.com:6606
Mutex
vomsklihddikoeyxag
Attributes
-
delay
5
-
install
false
-
install_folder
%AppData%
aes.plain
Signatures
-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
Detects file containing reversed ASEP Autorun registry keys 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\50a16971e1979b9fedd35969fb3e0658480d2d18139a935d065f76c002c8a961.exe"C:\Users\Admin\AppData\Local\Temp\50a16971e1979b9fedd35969fb3e0658480d2d18139a935d065f76c002c8a961.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
72KB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
10.8MB