Analysis
-
max time kernel
20s -
max time network
22s -
platform
windows11-21h2_x64 -
resource
win11-20240508-en -
resource tags
-
submitted
22-05-2024 21:36
General
-
Target
PEGASUS FULL VERSION.exe
-
Size
6.8MB
-
MD5
327ba7af9427fdb450a0628a27ae26de
-
SHA1
26fab46989dc26bc9b152ccb983c80ed09863ab8
-
SHA256
9bc6e27c34e3b2cd3fef3fe683f34246c2e6049b4e7c0a046f2babf3a7412bba
-
SHA512
a13f3095f643428a4713a7c6c5792c8c83c0ac2c02600761b9479caf2fe3def763248be32c3da7ea76ad07463165fda0e4f8baaa33ea24930eac59a1c62ba7bf
-
SSDEEP
49152:fRjkwtZPgeWCKxgt/HPEp7osQ3ANHAwnZN0lDuABhTf90fNfRPZxrJJlA26TKF8P:Bkw8A
Score
10/10
Malware Config
Signatures
-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
-
Program crash 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\PEGASUS FULL VERSION.exe"C:\Users\Admin\AppData\Local\Temp\PEGASUS FULL VERSION.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3020 -s 20322⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 192 -p 3020 -ip 30201⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Users\Admin\AppData\Local\Temp\PEGASUS FULL VERSION.exe"C:\Users\Admin\AppData\Local\Temp\PEGASUS FULL VERSION.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2440 -s 19842⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 372 -p 2440 -ip 24401⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
684KB
-
Filesize
684KB
-
Filesize
4KB
-
Filesize
6.8MB
-
Filesize
5.6MB
-
Filesize
584KB
-
Filesize
7.7MB
-
Filesize
7.7MB