Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
-
submitted
17-07-2024 16:16
General
-
Target
AdminGiver.exe
-
Size
45KB
-
MD5
34c61fda1daa4df0cf5ffd5207e7fb13
-
SHA1
a2f357dcfe528e5ccad1139955131dacff050b75
-
SHA256
d26ab8207e808755ed3305a1ac8a0d9e1787750194638c72c52b71dfa563a683
-
SHA512
dfe7517fb39687542fa591170c21124ef484b5ec10cf4432d15d04440c7b910a0fd76f62d7186cf832bcffad745ea474bc3c88c212d86cdb90bc1928ce1b1628
-
SSDEEP
768:NuKjYdTHYf7pWUB9+Tmo2qLHSg0w6swiOPIFzjbggXjiwA8OoS9mjmtchrLBDZjx:NuKjYdTH0k2IRcy3F3bHX+1GSsfddjx
Score
10/10
Malware Config
Extracted
Family
asyncrat
Version
0.5.8
Botnet
Default
C2
127.0.0.1:9388
127.0.0.1:5353
tax-sri.gl.at.ply.gg:9388
tax-sri.gl.at.ply.gg:5353
147.185.221.21:9388
147.185.221.21:5353
Mutex
aPR7bsx71z7b
Attributes
-
delay
3
-
install
false
-
install_file
Sez
-
install_folder
%AppData%
aes.plain
Signatures
-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\AdminGiver.exe"C:\Users\Admin\AppData\Local\Temp\AdminGiver.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
72KB
-
Filesize
7.7MB
-
Filesize
624KB
-
Filesize
5.6MB
-
Filesize
408KB
-
Filesize
4KB
-
Filesize
472KB
-
Filesize
416KB
-
Filesize
120KB
-
Filesize
7.7MB