Analysis
-
max time kernel
138s -
max time network
137s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
27-05-2024 15:21
General
-
Target
ohpndsemtf.exe
-
Size
47KB
-
MD5
7a51aa3884526620751838e6c9714f25
-
SHA1
9f0210f25aaa9d2598a02132cf8faa5541d6ff3a
-
SHA256
15c37fc34c843c04dd97fdb40a9c767c0964a02ee7c0d9b22fd67a85fcf39a8a
-
SHA512
7460684b61e37eb842463abd8203eecfbb635767168be8d6bc79a6da5282dcee8ed9034adaecd315419117eb9f7851b20e14a9221e5b0c38dcb85127f5aa14d7
-
SSDEEP
768:5CT3ILNCKi+Di5hFxhLR5qiH6Ybrge8ZIar7XvEgK/JTZVc6KN:5CYm5jxXDpbUVeY7XnkJTZVclN
Malware Config
Extracted
asyncrat
1.0.7
MAYO27
flugrekorder.duckdns.org:7786
"$%#&63T%y/34rdy@
-
delay
1
-
install
false
-
install_folder
%AppData%
Signatures
-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
Delays execution with timeout.exe 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ohpndsemtf.exe"C:\Users\Admin\AppData\Local\Temp\ohpndsemtf.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp521E.tmp.bat""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
162B
MD506dfd37e9ab31ef877611a007d41ebec
SHA168590977ef7e65fd47cb5d13c87925a09d790097
SHA256e349485f31bd8426882ff17d5fb16edc4f5fca2d11df6cf2ac48bdbb0b9cf79b
SHA5127dc9c43bfcce5431d000062e8a12d209b0fe97e6301d6e2f7915c9a2d57860f216bb502c9904a072941f464e1e9ed9159a70b1f092433ff2c1daf7e44a54d867
-
Filesize
8KB
-
Filesize
72KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
8KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
472KB
-
Filesize
400KB
-
Filesize
120KB
-
Filesize
10.8MB