Analysis
-
max time kernel
133s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
-
submitted
20-07-2024 08:46
General
-
Target
52adfe5797b14ea67d9d9a78eca85a5ef016cc121f439fbfe8f7219dfefd1303.exe
-
Size
63KB
-
MD5
c842ccf5599a37e82191fc67fb5e9123
-
SHA1
59a204a05b7e6ba6164105614092d8e3eaf141be
-
SHA256
52adfe5797b14ea67d9d9a78eca85a5ef016cc121f439fbfe8f7219dfefd1303
-
SHA512
efb92b33a593f2649d91b0c1533f07277a066256b12bdd5e993a6c8c56946eea214fa9732801e3dfe0eeda5ee6636b97dd956e0fcc272ac27d076e488f05a8ac
-
SSDEEP
768:QvsM2sk/978SQC8A+XjlazcBRL5JTk1+T4KSBGHmDbD/ph0oXnuP5zApJhUVYSu6:j1/M/dSJYUbdh9nuP5zeGJu0dpqKmY7
Score
10/10
Malware Config
Extracted
Family
asyncrat
Botnet
Default
C2
bulletingmarrano-45523.portmap.host:45523
Attributes
-
delay
1
-
install
false
-
install_folder
%AppData%
aes.plain
Signatures
-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\52adfe5797b14ea67d9d9a78eca85a5ef016cc121f439fbfe8f7219dfefd1303.exe"C:\Users\Admin\AppData\Local\Temp\52adfe5797b14ea67d9d9a78eca85a5ef016cc121f439fbfe8f7219dfefd1303.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
88KB
-
Filesize
8KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB