Analysis
-
max time kernel
1796s -
max time network
1175s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
20-05-2024 17:28
General
-
Target
AsyncClient.exe
-
Size
95KB
-
MD5
e9a8dcf1e40e72bd321f46a8c1f190d0
-
SHA1
6645f11121d51dd1991019da9753dc10d42d486c
-
SHA256
e071e4241e79f2029e48c8fca210200bf0d1e5098e2fe5077b2c53c7395d2cf7
-
SHA512
9bb5e7936cd083f6187df3259c9b05adff0f22479b29b560ae6b1d4a6605ebcffca95c3b9ec62c8afce4f2842bf0ad3027fdddaf79181f204af811894f02212a
-
SSDEEP
1536:vu/dRTUPE2DAoLijmTbzUofuScBsD+tF8Ydk3x:vu/DTUPE2DAoLHTbzPiBsIxu3x
Score
10/10
Malware Config
Extracted
Family
asyncrat
Version
0.5.8
Botnet
Default
C2
127.0.0.1:6606
127.0.0.1:7707
127.0.0.1:8808
Mutex
KTDnVMhtk8KL
Attributes
-
delay
3
-
install
false
-
install_folder
%AppData%
aes.plain
Signatures
-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\AsyncClient.exe"C:\Users\Admin\AppData\Local\Temp\AsyncClient.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
120KB
-
Filesize
7.7MB
-
Filesize
408KB
-
Filesize
624KB
-
Filesize
4KB
-
Filesize
7.7MB