4c2c034fdbb93dbb5902b3863cd5328b99d91377150683de8e61e63297ef0d24

Analysis

max time kernel
1200s
max time network
1206s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
08-07-2024 07:26

Target

New folder/AsyncRAT/AsyncRAT.exe
Size

6.4MB
MD5

97a429c4b6a2cb95ece0ddb24c3c2152
SHA1

6fcc26793dd474c0c7113b3360ff29240d9a9020
SHA256

06899071233d61009a64c726a4523aa13d81c2517a0486cc99ac5931837008e5
SHA512

524a63f39e472bd052a258a313ff4f2005041b31f11da4774d3d97f72773f3edb40df316fa9cc2a0f51ea5d8ac404cfdd486bab6718bae60f0d860e98e533f89
SSDEEP

98304:+bPmDVa3VxobFwUN5xXhAqin1MNuSZTKA0t9FFPEG6xJJ33Je2PsBpCz6Ry:+7aIXUN5htin2bk9fcPHJDE7Cz60

Score

1^/10

Suspicious behavior: EnumeratesProcesses 27 IoCs

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1580	AsyncRAT.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
1580	AsyncRAT.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4104,i,15168044379859864039,3380316340477469860,262144 --variations-seed-version --mojo-platform-channel-handle=3844 /prefetch:8
1⤵
PID:636

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:808

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4152,i,15168044379859864039,3380316340477469860,262144 --variations-seed-version --mojo-platform-channel-handle=4552 /prefetch:8
1⤵
PID:2728

memory/1580-0-0x00007FFCD1A53000-0x00007FFCD1A55000-memory.dmp

Filesize
8KB

Download
memory/1580-1-0x000001C152FD0000-0x000001C15363A000-memory.dmp

Filesize
6.4MB

Download
memory/1580-2-0x000001C16DC80000-0x000001C16DED2000-memory.dmp

Filesize
2.3MB

Download
memory/1580-3-0x00007FFCD1A50000-0x00007FFCD2511000-memory.dmp

Filesize
10.8MB

Download
memory/1580-4-0x00007FFCD1A50000-0x00007FFCD2511000-memory.dmp

Filesize
10.8MB

Download
memory/1580-7-0x000001C16E1F0000-0x000001C16E399000-memory.dmp

Filesize
1.7MB

Download
memory/1580-9-0x00007FFCD1A53000-0x00007FFCD1A55000-memory.dmp

Filesize
8KB

Download
memory/1580-10-0x00007FFCD1A50000-0x00007FFCD2511000-memory.dmp

Filesize
10.8MB

Download
memory/1580-12-0x00007FFCD1A50000-0x00007FFCD2511000-memory.dmp

Filesize
10.8MB

Download
memory/1580-41-0x000001C16E1F0000-0x000001C16E399000-memory.dmp

Filesize
1.7MB

Download
memory/1580-71-0x000001C16E1F0000-0x000001C16E399000-memory.dmp

Filesize
1.7MB

Download