Analysis
-
max time kernel
141s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
-
submitted
03/07/2024, 15:30
General
-
Target
worldofprocure.exe
-
Size
20.4MB
-
MD5
1ada2c6796a3486b79c5eb47fce9b19c
-
SHA1
5d78a1cabf376716fbf429e2f6f8c4ea1295ca43
-
SHA256
b8f1fe93386003e82a148e0efd52759bc3be7bc7088537f6d031faec54870fb3
-
SHA512
16413bb86289d46408e479cd67f71821d788fa000adce091c0bd6812b79525a236e117732416880688b2c139f0021f97270900e68a8a840c0b60bcbe5511d390
-
SSDEEP
393216:MZrAUv/DWT9lrqm59DJjhe+NRDWUFnAUv/DWT9lrqm5ordQll/LY/:iml3NR3wl3Vlc
Score
10/10
Malware Config
Extracted
Family
asyncrat
Version
RIMAWI 1.0.2.9
Botnet
(_!_D@YS2_!_)
C2
stevenhead.ddns.net:36365
booosisnhead.ddns.net:36365
Mutex
dfoipoduifdpodupifduodud9d78yd9078df098dp90yu9py7d9
Attributes
-
delay
3
-
install
false
-
install_folder
%AppData%
aes.plain
Signatures
-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\worldofprocure.exe"C:\Users\Admin\AppData\Local\Temp\worldofprocure.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
20.4MB
-
Filesize
6.9MB
-
Filesize
6.9MB