Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
-
submitted
14-07-2024 19:14
General
-
Target
b0f6c6800ac04efd9d64be26677676b25e1638e8e140c1129c704380d4deac8b.exe
-
Size
47KB
-
MD5
305565f477f37de109333ccd3462cbd9
-
SHA1
2d284a889e3e9b205210611d18b30002bad03741
-
SHA256
b0f6c6800ac04efd9d64be26677676b25e1638e8e140c1129c704380d4deac8b
-
SHA512
436f720464ea21b6584789b9d3d48efc6a476f79ce16ea9168c8e53df2a722c82409eb4a7e2d8eafdac9dd0c614864f2d6c23bafcf04b0a4b381c1aa04eb65b6
-
SSDEEP
768:Iu2z1T1tMfdWUdLO3mo2qz1zVkWUzbPI1E9HpA0bX0EAjE8qOqjuoRIGsGSZBDZa:Iu2z1T1y22ykWUzk1MHhbXddXhjuo0Gt
Malware Config
Extracted
asyncrat
0.5.8
Default
127.0.0.1:6606
127.0.0.1:7707
127.0.0.1:8808
192.168.1.89:6606
192.168.1.89:7707
192.168.1.89:8808
192.168.1.1:6606
192.168.1.1:7707
192.168.1.1:8808
71.93.221.109:6606
71.93.221.109:7707
71.93.221.109:8808
K9wQVBDAbpUd
-
delay
3
-
install
false
-
install_file
Tempp.exe
-
install_folder
%AppData%
Signatures
-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b0f6c6800ac04efd9d64be26677676b25e1638e8e140c1129c704380d4deac8b.exe"C:\Users\Admin\AppData\Local\Temp\b0f6c6800ac04efd9d64be26677676b25e1638e8e140c1129c704380d4deac8b.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
72KB
-
Filesize
7.7MB
-
Filesize
624KB
-
Filesize
5.6MB
-
Filesize
408KB
-
Filesize
472KB
-
Filesize
400KB
-
Filesize
120KB
-
Filesize
7.7MB