Analysis
-
max time kernel
149s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
14/02/2024, 05:34
General
-
Target
8545fedaeb113fdb4000b3f6a8d0f0f4694f9198203086a7d1230385a5180f78.exe
-
Size
790KB
-
MD5
c8b4fb2984a495c19cc5d4dcc1922914
-
SHA1
bbc25258b543805926d034564015a2e4d40b0647
-
SHA256
8545fedaeb113fdb4000b3f6a8d0f0f4694f9198203086a7d1230385a5180f78
-
SHA512
d084a9565d9cd7137969bc0cfb2dad3e2370451715dccf89906eafbb2ecbdf20bc8e654ff4aaa8facf5bd8931861f8e3df4cf5f1079431debadeff93b37c2205
-
SSDEEP
12288:T6tHgfBPsucbAapcfyTAKQrj86Hil5QaHRnxiWUotpA5Xturz1J+mZWwVVVVVVVX:T6tHwxEAapcaXBxRwWFtpAzs1IWb/T
Malware Config
Extracted
asyncrat
0.5.7B
TORREMENOR
danielballesterosdominper.con-ip.com:4040
Cookies
-
delay
3
-
install
false
-
install_folder
%AppData%
Signatures
-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
Detect ZGRat V1 34 IoCs
-
ZGRat
ZGRat is remote access trojan written in C#.
-
Detects file containing reversed ASEP Autorun registry keys 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8545fedaeb113fdb4000b3f6a8d0f0f4694f9198203086a7d1230385a5180f78.exe"C:\Users\Admin\AppData\Local\Temp\8545fedaeb113fdb4000b3f6a8d0f0f4694f9198203086a7d1230385a5180f78.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe2⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
596KB
-
Filesize
64KB
-
Filesize
624KB
-
Filesize
596KB
-
Filesize
596KB
-
Filesize
596KB
-
Filesize
596KB
-
Filesize
596KB
-
Filesize
596KB
-
Filesize
596KB
-
Filesize
596KB
-
Filesize
596KB
-
Filesize
596KB
-
Filesize
596KB
-
Filesize
596KB
-
Filesize
596KB
-
Filesize
596KB
-
Filesize
596KB
-
Filesize
596KB
-
Filesize
596KB
-
Filesize
596KB
-
Filesize
596KB
-
Filesize
596KB
-
Filesize
596KB
-
Filesize
7.7MB
-
Filesize
596KB
-
Filesize
800KB
-
Filesize
596KB
-
Filesize
596KB
-
Filesize
596KB
-
Filesize
596KB
-
Filesize
596KB
-
Filesize
596KB
-
Filesize
596KB
-
Filesize
596KB
-
Filesize
596KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
200KB
-
Filesize
304KB
-
Filesize
7.7MB
-
Filesize
596KB
-
Filesize
5.6MB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
72KB
-
Filesize
64KB
-
Filesize
7.7MB
-
Filesize
64KB