Analysis
- max time kernel
150s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20240412-en - resource tags
- submitted
15/04/2024, 05:16
General
- Target Monolith.wtf.exe
- Size 47KB
- Sample240415-fx73qaaa41
- SHA256 84e17e010bab7dc3987bd0b9b9d7f33e74a08e05a388ac04646c6ee7b1022b5a
Score
10/10
Malware Config
Extracted
Family
-
asyncrat
Version
-
1.0.7
Botnet
-
Default
C2
-
127.0.0.1:8848
-
127.0.0.1:1234
-
127.0.0.1:11452
-
2.tcp.us-cal-1.ngrok.io:8848
-
2.tcp.us-cal-1.ngrok.io:1234
-
2.tcp.us-cal-1.ngrok.io:11452
Mutex
-
DcRatMutex_qwqdanchun
Attributes
-
delay
1
-
install
false
-
install_folder
%AppData%
aes.plain
Signatures
- AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Monolith.wtf.exe"C:\Users\Admin\AppData\Local\Temp\Monolith.wtf.exe"1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4164-0-0x0000000000150000-0x0000000000162000-memory.dmp
memory/4164-1-0x00007FF94FFF0000-0x00007FF950AB1000-memory.dmp
memory/4164-2-0x00000000022B0000-0x00000000022C0000-memory.dmp
memory/4164-3-0x00007FF94FFF0000-0x00007FF950AB1000-memory.dmp