Analysis
- max time kernel
149s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
23/05/2024, 01:45
General
- Target ac36dbf1479ca89c6cc3571ba9e22bcae360efbe29f49cadb67a7b6e5f619467.exe
- Size 2.4MB
- Sample240523-b6sl6shd35
- SHA256 ac36dbf1479ca89c6cc3571ba9e22bcae360efbe29f49cadb67a7b6e5f619467
Malware Config
Extracted
-
asyncrat
-
114.130.36.120:6666
-
delay
1
-
install
false
-
install_folder
%AppData%
Signatures
- AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
- Detects executables attemping to enumerate video devices using WMI 17 IoCs
- Detects executables containing the string DcRatBy 17 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 16 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ac36dbf1479ca89c6cc3571ba9e22bcae360efbe29f49cadb67a7b6e5f619467.exe"C:\Users\Admin\AppData\Local\Temp\ac36dbf1479ca89c6cc3571ba9e22bcae360efbe29f49cadb67a7b6e5f619467.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2588-0-0x00000000007D0000-0x000000000119E000-memory.dmp
memory/2588-1-0x000000007FA20000-0x000000007FDF1000-memory.dmp
memory/2588-2-0x0000000077972000-0x0000000077973000-memory.dmp
memory/2588-3-0x00000000746BE000-0x00000000746BF000-memory.dmp
memory/2588-4-0x00000000007D0000-0x000000000119E000-memory.dmp
memory/2588-5-0x00000000007D0000-0x000000000119E000-memory.dmp
memory/2588-6-0x00000000746B0000-0x0000000074E60000-memory.dmp
memory/2588-7-0x00000000746B0000-0x0000000074E60000-memory.dmp
memory/2588-8-0x00000000007D0000-0x000000000119E000-memory.dmp
memory/2588-9-0x00000000007D0000-0x000000000119E000-memory.dmp
memory/2588-10-0x000000007FA20000-0x000000007FDF1000-memory.dmp
memory/2588-11-0x00000000007D0000-0x000000000119E000-memory.dmp
memory/2588-12-0x00000000746B0000-0x0000000074E60000-memory.dmp
memory/2588-13-0x00000000007D0000-0x000000000119E000-memory.dmp
memory/2588-14-0x00000000007D0000-0x000000000119E000-memory.dmp
memory/2588-15-0x00000000007D0000-0x000000000119E000-memory.dmp
memory/2588-16-0x00000000007D0000-0x000000000119E000-memory.dmp
memory/2588-17-0x00000000007D0000-0x000000000119E000-memory.dmp
memory/2588-18-0x00000000007D0000-0x000000000119E000-memory.dmp
memory/2588-19-0x00000000007D0000-0x000000000119E000-memory.dmp
memory/2588-20-0x00000000007D0000-0x000000000119E000-memory.dmp
memory/2588-21-0x00000000007D0000-0x000000000119E000-memory.dmp
memory/2588-22-0x00000000007D0000-0x000000000119E000-memory.dmp
memory/2588-23-0x00000000007D0000-0x000000000119E000-memory.dmp
memory/2588-24-0x00000000007D0000-0x000000000119E000-memory.dmp