Analysis
- max time kernel
147s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
09/03/2024, 15:09
General
- Target bUav.exe
- Size 45KB
- Sample240309-sjsr4aaf76
- SHA256 29f3c5f06270cc2b6edd54a49d485edf762a82054ea84f643c57a86e176d3799
Malware Config
Extracted
-
asyncrat
-
0.5.8
-
Default
-
reverseproxy.con-ip.com:2200
-
6kyiH6ZW0Ev9
-
delay
3
-
install
false
-
install_folder
%AppData%
Signatures
- AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\bUav.exe"C:\Users\Admin\AppData\Local\Temp\bUav.exe"1⤵
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k UnistackSvcGroup1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2960-43-0x000002527D880000-0x000002527D881000-memory.dmp
memory/2960-69-0x000002527D5E0000-0x000002527D5E1000-memory.dmp
memory/2960-73-0x000002527D700000-0x000002527D701000-memory.dmp
memory/2960-72-0x000002527D5F0000-0x000002527D5F1000-memory.dmp
memory/2960-71-0x000002527D5F0000-0x000002527D5F1000-memory.dmp
memory/2960-21-0x0000025275270000-0x0000025275280000-memory.dmp
memory/2960-37-0x000002527D860000-0x000002527D861000-memory.dmp
memory/2960-38-0x000002527D880000-0x000002527D881000-memory.dmp
memory/2960-39-0x000002527D880000-0x000002527D881000-memory.dmp
memory/2960-40-0x000002527D880000-0x000002527D881000-memory.dmp
memory/2960-41-0x000002527D880000-0x000002527D881000-memory.dmp
memory/2960-42-0x000002527D880000-0x000002527D881000-memory.dmp
memory/2960-44-0x000002527D880000-0x000002527D881000-memory.dmp
memory/2960-54-0x000002527D4A0000-0x000002527D4A1000-memory.dmp
memory/2960-49-0x000002527D4A0000-0x000002527D4A1000-memory.dmp
memory/2960-46-0x000002527D880000-0x000002527D881000-memory.dmp
memory/2960-47-0x000002527D880000-0x000002527D881000-memory.dmp
memory/2960-48-0x000002527D4B0000-0x000002527D4B1000-memory.dmp
memory/2960-45-0x000002527D880000-0x000002527D881000-memory.dmp
memory/2960-51-0x000002527D4B0000-0x000002527D4B1000-memory.dmp
memory/2960-57-0x000002527D3E0000-0x000002527D3E1000-memory.dmp
memory/4912-0-0x0000000000850000-0x0000000000862000-memory.dmp
memory/4912-1-0x00000000753E0000-0x0000000075B90000-memory.dmp
memory/4912-4-0x00000000051F0000-0x0000000005200000-memory.dmp
memory/4912-3-0x00000000753E0000-0x0000000075B90000-memory.dmp
memory/4912-2-0x00000000051F0000-0x0000000005200000-memory.dmp