Analysis
- max time kernel
144s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
11/04/2024, 23:46
General
- Target 9841e8711363c5a686f102aecc62198646753a9ba2bb7cbf8f2a9bf6c1c969d6.exe
- Size 1.1MB
- Sample240411-3shzcscc4y
- SHA256 9841e8711363c5a686f102aecc62198646753a9ba2bb7cbf8f2a9bf6c1c969d6
Score
10/10
Malware Config
Extracted
Family
-
asyncrat
C2
-
127.0.0.1:3389
-
127.0.0.1:8848
-
127.0.0.1:24329
-
127.0.0.1:56405
-
3389.iis7.net:3389
-
3389.iis7.net:8848
-
3389.iis7.net:24329
-
3389.iis7.net:56405
-
152.70.113.69:3389
-
152.70.113.69:8848
-
152.70.113.69:24329
-
152.70.113.69:56405
Mutex
-
火绒远程管理
Attributes
-
delay
1
-
install
false
-
install_file
ttry.exe
-
install_folder
%AppData%
aes.plain
Signatures
- AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
- Detects executables attemping to enumerate video devices using WMI 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\9841e8711363c5a686f102aecc62198646753a9ba2bb7cbf8f2a9bf6c1c969d6.exe"C:\Users\Admin\AppData\Local\Temp\9841e8711363c5a686f102aecc62198646753a9ba2bb7cbf8f2a9bf6c1c969d6.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3552 --field-trial-handle=2268,i,8796662530135712346,11409037572378858775,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/928-1-0x0000000000DC0000-0x0000000000EDE000-memory.dmp
memory/928-0-0x00000000751E0000-0x0000000075990000-memory.dmp
memory/928-2-0x0000000005890000-0x00000000058A0000-memory.dmp
memory/928-3-0x0000000077CE1000-0x0000000077CE2000-memory.dmp
memory/928-4-0x00000000751E0000-0x0000000075990000-memory.dmp
memory/928-5-0x0000000005890000-0x00000000058A0000-memory.dmp