Analysis
- max time kernel
119s - max time network
154s - platform
windows7_x64 - resource
win7-20240221-en - resource tags
- submitted
17/04/2024, 01:59
General
- Target Infected - Copy.exe
- Size 63KB
- Sample240417-cevg5acb5x
- SHA256 a2f0e4af244f31133cf9a0d50e643e5989792a5b77af1284b94f91f68d318ea7
Malware Config
Extracted
-
asyncrat
-
Default
-
127.0.0.1:23638
-
147.185.221.19:23638
-
teen-modes.gl.at.ply.gg:23638
-
delay
1
-
install
false
-
install_folder
%AppData%
Signatures
- AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Infected - Copy.exe"C:\Users\Admin\AppData\Local\Temp\Infected - Copy.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2504 -s 136762⤵
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
94308059B57B3142E455B38A6EB92015
TarE90F.tmp
memory/2504-0-0x00000000010D0000-0x00000000010E6000-memory.dmp
memory/2504-1-0x000007FEF50C0000-0x000007FEF5AAC000-memory.dmp
memory/2504-2-0x000000001AE90000-0x000000001AF10000-memory.dmp
memory/2504-3-0x0000000076D00000-0x0000000076EA9000-memory.dmp
memory/2504-21-0x00000000010A0000-0x00000000010D4000-memory.dmp
memory/2504-42-0x000007FEF50C0000-0x000007FEF5AAC000-memory.dmp
memory/2504-43-0x000000001AE90000-0x000000001AF10000-memory.dmp
memory/2504-44-0x0000000076D00000-0x0000000076EA9000-memory.dmp
memory/2504-46-0x000000001B610000-0x000000001B642000-memory.dmp