Analysis
- max time kernel
124s - max time network
143s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
09/04/2024, 08:08
General
- Target 9841e8711363c5a686f102aecc62198646753a9ba2bb7cbf8f2a9bf6c1c969d6.exe
- Size 1.1MB
- Sample240409-j1jfbade7t
- SHA256 9841e8711363c5a686f102aecc62198646753a9ba2bb7cbf8f2a9bf6c1c969d6
Score
10/10
Malware Config
Extracted
Family
-
asyncrat
C2
-
127.0.0.1:3389
-
127.0.0.1:8848
-
127.0.0.1:24329
-
127.0.0.1:56405
-
3389.iis7.net:3389
-
3389.iis7.net:8848
-
3389.iis7.net:24329
-
3389.iis7.net:56405
-
152.70.113.69:3389
-
152.70.113.69:8848
-
152.70.113.69:24329
-
152.70.113.69:56405
Mutex
-
火绒远程管理
Attributes
-
delay
1
-
install
false
-
install_file
ttry.exe
-
install_folder
%AppData%
aes.plain
Signatures
- AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\9841e8711363c5a686f102aecc62198646753a9ba2bb7cbf8f2a9bf6c1c969d6.exe"C:\Users\Admin\AppData\Local\Temp\9841e8711363c5a686f102aecc62198646753a9ba2bb7cbf8f2a9bf6c1c969d6.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/588-0-0x0000000000440000-0x000000000055E000-memory.dmp
memory/588-1-0x0000000074900000-0x00000000750B0000-memory.dmp
memory/588-2-0x0000000002830000-0x0000000002840000-memory.dmp
memory/588-3-0x0000000077401000-0x0000000077402000-memory.dmp
memory/588-4-0x0000000074900000-0x00000000750B0000-memory.dmp
memory/588-5-0x0000000002830000-0x0000000002840000-memory.dmp