Analysis
-
max time kernel
143s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
-
submitted
06/07/2024, 03:10
General
-
Target
d32c06207a7c595b90e495fc569d6093d303a394cbd946250f7fe75e52d04005.exe
-
Size
47KB
-
MD5
f69a70338268bc0123d6a0e3d431b424
-
SHA1
8f0cec429ddfda7332d510479bb079808492e36f
-
SHA256
d32c06207a7c595b90e495fc569d6093d303a394cbd946250f7fe75e52d04005
-
SHA512
1c1e6713a2ceb20c82dc18f983b2f584818932ccccc5c9041659751eb2a665ad124b4826adfc8765d51240ea6ee652ae30aa97ff3f3b1abef6523735761bbe87
-
SSDEEP
768:z96mxUTILWCaS+DiMtelDSN+iV08YbygeEI9UNUULIEgK/JltpqKYhY7:z96AKWMtKDs4zb1S9KL6kJltpqKmY7
Score
10/10
Malware Config
Extracted
Family
asyncrat
Version
1.0.7
Botnet
Default
Mutex
DcRatMutex_qwqdanchun
Attributes
-
delay
1
-
install
false
-
install_folder
%AppData%
-
pastebin_config
https://pastebin.com/raw/ZiJetUM7
aes.plain
Signatures
-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d32c06207a7c595b90e495fc569d6093d303a394cbd946250f7fe75e52d04005.exe"C:\Users\Admin\AppData\Local\Temp\d32c06207a7c595b90e495fc569d6093d303a394cbd946250f7fe75e52d04005.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
72KB
-
Filesize
9.9MB
-
Filesize
4KB
-
Filesize
9.9MB