Resubmissions
19/03/2024, 12:48
240319-p11bqacd641019/03/2024, 12:40
240319-pwnr5acc4919/03/2024, 12:38
240319-pvd7ascc2510Analysis
- max time kernel
81s - max time network
92s - platform
windows11-21h2_x64 - resource
win11-20240221-en - resource tags
- submitted
19/03/2024, 12:38
General
- Target dynamic.exe
- Size 385KB
- Sample240319-pvd7ascc25
- SHA256 20a745aca83120fe6b9d1eae4be8efd778ece32c48c11ad23520981262bfa3aa
Score
10/10
Malware Config
Extracted
Family
-
asyncrat
Version
-
ss9
Botnet
-
Default
C2
-
pereira99-24486.portmap.host:24486
Mutex
-
ss9-mutex-elliot
Attributes
-
delay
1
-
install
false
-
install_folder
%AppData%
aes.plain
Signatures
- AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
- Async RAT payload 1 IoCs
- Suspicious use of AdjustPrivilegeToken 21 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\dynamic.exe"C:\Users\Admin\AppData\Local\Temp\dynamic.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2924-0-0x00007FF71CB60000-0x00007FF71CBBD000-memory.dmp
memory/2924-2-0x00000231798C0000-0x00000231798D9000-memory.dmp
memory/2924-3-0x000002317B180000-0x000002317B194000-memory.dmp
memory/2924-4-0x00007FFED9390000-0x00007FFED9E52000-memory.dmp
memory/2924-6-0x000002317B170000-0x000002317B180000-memory.dmp
memory/2924-5-0x000002317B170000-0x000002317B180000-memory.dmp
memory/2924-7-0x00007FF71CB60000-0x00007FF71CBBD000-memory.dmp
memory/2924-9-0x00007FFED9390000-0x00007FFED9E52000-memory.dmp