Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
138s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
10/07/2024, 22:22
General
-
Target
SolaraBootstrapper.exe
-
Size
47KB
-
MD5
2a8d89b157bcdffdf06b95882d4d298e
-
SHA1
b4344174249e9a2fdd8e63b85368f9073aeec486
-
SHA256
df4b444a4fab834d252b0deeb6cf5cf7cdda2f123842a8ee755917e3c00e614b
-
SHA512
a1923c9adaba57dd7f0dc99cc7b63ba9797870f5cdcc05a07785bb8cf8efeec50d0cea6ecfe322606e12337ba50f4fcc535cf051e6c1f75ea1f74b6dda00d225
-
SSDEEP
768:cuaEVToSklboWU2LCimo2qB7CKvQpLIHiPIFXxapE0Q0bO8D2vnBll1jS1Vj71Bj:cuaEVT3KN2ZWHrFXApE6bO8Kvn/vS1Vv
Score
10/10
Malware Config
Extracted
Family
asyncrat
Version
0.5.8
Botnet
Default
C2
127.0.0.1:6606
127.0.0.1:7707
127.0.0.1:8808
192.168.0.23:6606
192.168.0.23:7707
192.168.0.23:8808
Mutex
Anh14EOLKPzm
Attributes
-
delay
3
-
install
true
-
install_file
SolaraBootstrapper.exe
-
install_folder
%Temp%
aes.plain
Signatures
-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe"C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
72KB
-
Filesize
6.9MB
-
Filesize
4KB
-
Filesize
6.9MB