Analysis
- max time kernel
146s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240709-en - resource tags
- submitted
11/07/2024, 02:57
General
- Target c9866af2cb943cbe5f4d971518d30ec93e686e8d8e31345fe0e923c0ec121603.exe
- Size 2.6MB
- Sample240711-dftsnaxfmg
- SHA256 c9866af2cb943cbe5f4d971518d30ec93e686e8d8e31345fe0e923c0ec121603
Malware Config
Extracted
-
asyncrat
-
0.5.7B
-
ZZZ6
-
andresarbosa2003.con-ip.com:4040
-
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
false
-
install_folder
%AppData%
Signatures
- AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c9866af2cb943cbe5f4d971518d30ec93e686e8d8e31345fe0e923c0ec121603.exe"C:\Users\Admin\AppData\Local\Temp\c9866af2cb943cbe5f4d971518d30ec93e686e8d8e31345fe0e923c0ec121603.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\c9866af2cb943cbe5f4d971518d30ec93e686e8d8e31345fe0e923c0ec121603.exe"C:\Users\Admin\AppData\Local\Temp\c9866af2cb943cbe5f4d971518d30ec93e686e8d8e31345fe0e923c0ec121603.exe"2⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
c9866af2cb943cbe5f4d971518d30ec93e686e8d8e31345fe0e923c0ec121603.exe.log
memory/184-0-0x00000000752AE000-0x00000000752AF000-memory.dmp
memory/184-1-0x0000000000B30000-0x0000000000DD4000-memory.dmp
memory/184-2-0x00000000058D0000-0x0000000005AF2000-memory.dmp
memory/184-3-0x00000000752A0000-0x0000000075A50000-memory.dmp
memory/184-4-0x00000000060A0000-0x0000000006644000-memory.dmp
memory/184-5-0x0000000005BF0000-0x0000000005C82000-memory.dmp
memory/184-6-0x00000000058D0000-0x0000000005AEC000-memory.dmp
memory/184-7-0x00000000058D0000-0x0000000005AEC000-memory.dmp
memory/184-33-0x00000000058D0000-0x0000000005AEC000-memory.dmp
memory/184-31-0x00000000058D0000-0x0000000005AEC000-memory.dmp
memory/184-29-0x00000000058D0000-0x0000000005AEC000-memory.dmp
memory/184-27-0x00000000058D0000-0x0000000005AEC000-memory.dmp
memory/184-25-0x00000000058D0000-0x0000000005AEC000-memory.dmp
memory/184-23-0x00000000058D0000-0x0000000005AEC000-memory.dmp
memory/184-21-0x00000000058D0000-0x0000000005AEC000-memory.dmp
memory/184-19-0x00000000058D0000-0x0000000005AEC000-memory.dmp
memory/184-17-0x00000000058D0000-0x0000000005AEC000-memory.dmp
memory/184-15-0x00000000058D0000-0x0000000005AEC000-memory.dmp
memory/184-13-0x00000000058D0000-0x0000000005AEC000-memory.dmp
memory/184-11-0x00000000058D0000-0x0000000005AEC000-memory.dmp
memory/184-9-0x00000000058D0000-0x0000000005AEC000-memory.dmp
memory/184-65-0x00000000058D0000-0x0000000005AEC000-memory.dmp
memory/184-69-0x00000000058D0000-0x0000000005AEC000-memory.dmp
memory/184-67-0x00000000058D0000-0x0000000005AEC000-memory.dmp
memory/184-63-0x00000000058D0000-0x0000000005AEC000-memory.dmp
memory/184-61-0x00000000058D0000-0x0000000005AEC000-memory.dmp
memory/184-59-0x00000000058D0000-0x0000000005AEC000-memory.dmp
memory/184-57-0x00000000058D0000-0x0000000005AEC000-memory.dmp
memory/184-55-0x00000000058D0000-0x0000000005AEC000-memory.dmp
memory/184-53-0x00000000058D0000-0x0000000005AEC000-memory.dmp
memory/184-51-0x00000000058D0000-0x0000000005AEC000-memory.dmp
memory/184-49-0x00000000058D0000-0x0000000005AEC000-memory.dmp
memory/184-48-0x00000000058D0000-0x0000000005AEC000-memory.dmp
memory/184-45-0x00000000058D0000-0x0000000005AEC000-memory.dmp
memory/184-43-0x00000000058D0000-0x0000000005AEC000-memory.dmp
memory/184-41-0x00000000058D0000-0x0000000005AEC000-memory.dmp
memory/184-39-0x00000000058D0000-0x0000000005AEC000-memory.dmp
memory/184-37-0x00000000058D0000-0x0000000005AEC000-memory.dmp
memory/184-35-0x00000000058D0000-0x0000000005AEC000-memory.dmp
memory/184-4892-0x00000000752A0000-0x0000000075A50000-memory.dmp
memory/184-4894-0x0000000005DB0000-0x0000000005DFC000-memory.dmp
memory/184-4893-0x0000000005D50000-0x0000000005DAC000-memory.dmp
memory/184-4895-0x00000000752AE000-0x00000000752AF000-memory.dmp
memory/184-4896-0x00000000752A0000-0x0000000075A50000-memory.dmp
memory/184-4897-0x00000000011D0000-0x0000000001224000-memory.dmp
memory/184-4903-0x00000000752A0000-0x0000000075A50000-memory.dmp
memory/4912-4904-0x00000000752A0000-0x0000000075A50000-memory.dmp
memory/4912-4902-0x0000000000400000-0x0000000000412000-memory.dmp
memory/4912-4905-0x00000000752A0000-0x0000000075A50000-memory.dmp
memory/4912-4906-0x00000000752A0000-0x0000000075A50000-memory.dmp