Analysis
-
max time kernel
143s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
-
submitted
14-07-2024 19:11
General
-
Target
AsyncClient.exe
-
Size
47KB
-
MD5
305565f477f37de109333ccd3462cbd9
-
SHA1
2d284a889e3e9b205210611d18b30002bad03741
-
SHA256
b0f6c6800ac04efd9d64be26677676b25e1638e8e140c1129c704380d4deac8b
-
SHA512
436f720464ea21b6584789b9d3d48efc6a476f79ce16ea9168c8e53df2a722c82409eb4a7e2d8eafdac9dd0c614864f2d6c23bafcf04b0a4b381c1aa04eb65b6
-
SSDEEP
768:Iu2z1T1tMfdWUdLO3mo2qz1zVkWUzbPI1E9HpA0bX0EAjE8qOqjuoRIGsGSZBDZa:Iu2z1T1y22ykWUzk1MHhbXddXhjuo0Gt
Malware Config
Extracted
asyncrat
0.5.8
Default
127.0.0.1:6606
127.0.0.1:7707
127.0.0.1:8808
192.168.1.89:6606
192.168.1.89:7707
192.168.1.89:8808
192.168.1.1:6606
192.168.1.1:7707
192.168.1.1:8808
71.93.221.109:6606
71.93.221.109:7707
71.93.221.109:8808
K9wQVBDAbpUd
-
delay
3
-
install
false
-
install_file
Tempp.exe
-
install_folder
%AppData%
Signatures
-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
Drops desktop.ini file(s) 1 IoCs
-
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies Control Panel 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 19 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\AsyncClient.exe"C:\Users\Admin\AppData\Local\Temp\AsyncClient.exe"1⤵
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
115KB
MD597d9f03587c43ec39e5bc459df23cc77
SHA1324e52459b201958abd0f9533658790d678ec4bc
SHA2567fcd35c3b975f57676e6301290d6b83533f393289af0795c53ad5af122b13606
SHA512cce090f29a93be0c2bf1e897f7f51079faee735be060014d721b58314823f1d660f7406fb97327c484dea87e6e079df177bf7b428ba39310dbe08999527062cb
-
Filesize
120KB
-
Filesize
624KB
-
Filesize
584KB
-
Filesize
584KB
-
Filesize
72KB
-
Filesize
5.6MB
-
Filesize
408KB
-
Filesize
472KB
-
Filesize
400KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
400KB
-
Filesize
456KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
136KB
-
Filesize
40KB
-
Filesize
416KB
