Analysis
-
max time kernel
149s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
24-05-2024 04:45
General
-
Target
aa94c1aadc9deac22bb53a302dacbb087d18ac73c5896cfce70b54b78a49b174.exe
-
Size
45KB
-
MD5
1f26580b09823700ac6d52ff6555edc0
-
SHA1
af39adb900f6a73fb280ee79b1f8246adf23c5f9
-
SHA256
aa94c1aadc9deac22bb53a302dacbb087d18ac73c5896cfce70b54b78a49b174
-
SHA512
49a82180d3dc9d8b8499abb0f2dfe94a6fce0df70892d407f49f1048da40e56f20d6fe2fda5ec1d7632779fa6d6cc79cea4198f0790171f345206faca9a2567c
-
SSDEEP
768:lu6XdTvER+SWUk6P4mo2qbEKjPGaG6PIyzjbFgX3iwI90j30BDZWx:lu6XdTv2S2RKTkDy3bCXSndWx
Score
10/10
Malware Config
Extracted
Family
asyncrat
Version
0.5.8
Botnet
Default
C2
127.0.0.1:6606
127.0.0.1:7707
127.0.0.1:8808
Mutex
Tt0Bl0xVkDS2
Attributes
-
delay
3
-
install
false
-
install_file
word.exe
-
install_folder
%AppData%
aes.plain
Signatures
-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\aa94c1aadc9deac22bb53a302dacbb087d18ac73c5896cfce70b54b78a49b174.exe"C:\Users\Admin\AppData\Local\Temp\aa94c1aadc9deac22bb53a302dacbb087d18ac73c5896cfce70b54b78a49b174.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2168-0-0x00000000743FE000-0x00000000743FF000-memory.dmpFilesize
4KB
-
memory/2168-1-0x0000000000D40000-0x0000000000D52000-memory.dmpFilesize
72KB
-
memory/2168-2-0x00000000743F0000-0x0000000074ADE000-memory.dmpFilesize
6.9MB
-
memory/2168-3-0x00000000743FE000-0x00000000743FF000-memory.dmpFilesize
4KB
-
memory/2168-4-0x00000000743F0000-0x0000000074ADE000-memory.dmpFilesize
6.9MB