Analysis
-
max time kernel
132s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
-
submitted
13-07-2024 14:47
General
-
Target
25cb6a93394ba5bda060d06e0a3e7b578ed1d7d9893d78a6a8a04f441ca56fff.exe
-
Size
63KB
-
MD5
4b1e909c6dc0c8ca86572aa2fab4c9c2
-
SHA1
965b9dbd24b0f12034b370cd276a3ffc15ae626b
-
SHA256
25cb6a93394ba5bda060d06e0a3e7b578ed1d7d9893d78a6a8a04f441ca56fff
-
SHA512
4b575f5e8bd05b4571ac147b3c6b1d42b3053ff9ba2d3d95887af81dd5a847d7de650633520fe4cb6016436fa2a6fe5ab375bf5cdb487697424b80b18a3f147f
-
SSDEEP
1536:xhAhLzkQU/QD83nxyl1eeiMl8GbbXwCk0GXtpqKmY7:xhAhLzkQU/QwnxylIeFmGbbXRY2z
Score
10/10
Malware Config
Extracted
Family
asyncrat
Version
RedTeam OpS
Botnet
Default
C2
193.42.11.31:1604
Mutex
OrionMutex_hunter
Attributes
-
delay
1
-
install
false
-
install_folder
%AppData%
aes.plain
Signatures
-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\25cb6a93394ba5bda060d06e0a3e7b578ed1d7d9893d78a6a8a04f441ca56fff.exe"C:\Users\Admin\AppData\Local\Temp\25cb6a93394ba5bda060d06e0a3e7b578ed1d7d9893d78a6a8a04f441ca56fff.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
88KB
-
Filesize
9.9MB
-
Filesize
9.9MB
-
Filesize
4KB
-
Filesize
9.9MB