Analysis
- max time kernel
91s - max time network
146s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
10/04/2024, 01:01
General
- Target 0242b16d15e0d3e087be37fb4d1a4f0f08f1c737774488dc943c6599d0307278.exe
- Size 1.3MB
- Sample240410-bdkqvsbc38
- SHA256 0242b16d15e0d3e087be37fb4d1a4f0f08f1c737774488dc943c6599d0307278
Malware Config
Extracted
-
asyncrat
-
1.0.7
-
Default
-
154.23.178.70:8848
-
DcRatMutex
-
delay
1
-
install
false
-
install_folder
%AppData%
Signatures
- AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
- Async RAT payload 2 IoCs
- Detects executables attemping to enumerate video devices using WMI 2 IoCs
- Detects executables containing the string DcRatBy 2 IoCs
- Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc. 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0242b16d15e0d3e087be37fb4d1a4f0f08f1c737774488dc943c6599d0307278.exe"C:\Users\Admin\AppData\Local\Temp\0242b16d15e0d3e087be37fb4d1a4f0f08f1c737774488dc943c6599d0307278.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4224-0-0x0000027F3D2C0000-0x0000027F3D2D6000-memory.dmp
memory/4224-1-0x0000027F3ECC0000-0x0000027F3ECD2000-memory.dmp
memory/4224-2-0x00007FFBA2D40000-0x00007FFBA3801000-memory.dmp
memory/4224-3-0x0000027F3ECD0000-0x0000027F3ECE0000-memory.dmp
memory/4224-4-0x0000027F3ECD0000-0x0000027F3ECE0000-memory.dmp
memory/4224-5-0x0000027F3ECD0000-0x0000027F3ECE0000-memory.dmp
memory/4224-8-0x00007FFBB2310000-0x00007FFBB2329000-memory.dmp
memory/4224-9-0x00007FFBA2D40000-0x00007FFBA3801000-memory.dmp
memory/4224-10-0x0000027F3ECD0000-0x0000027F3ECE0000-memory.dmp
memory/4224-11-0x0000027F3ECD0000-0x0000027F3ECE0000-memory.dmp