Analysis
-
max time kernel
145s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
-
submitted
26-07-2024 20:17
General
-
Target
idk.exe
-
Size
47KB
-
MD5
90024e24cd2d9802a11db72ed44af7db
-
SHA1
ae7f19111ab5d7150688816c01ebc07027bace24
-
SHA256
2308fb26ad2f82a33c838bc6f84b37b213dbbf8e106532410698f317cbf4ed5f
-
SHA512
cfb02a7233b832d029ba561498a5af4a3387a2796c1840b1035c2fa178c798a2490e4e67ad3feb5418496dae3404a929452905aaa5216c1686f4a8742e73efbb
-
SSDEEP
768:xGq+s3pUtDILNCCa+Di96vn8AUpi4p8Ybrg0gAZJBN18dPHvVvEgK/JLZVc6KN:8q+AGtQO96UAWzbU748PVnkJLZVclN
Score
10/10
Malware Config
Extracted
Family
asyncrat
Version
1.0.7
Botnet
Default
C2
127.0.0.1:8848
127.0.0.1:37029
147.185.221.21:8848
147.185.221.21:37029
Mutex
DcRatMutex_qwqdanchun
Attributes
-
delay
1
-
install
false
-
install_folder
%AppData%
aes.plain
Signatures
-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\idk.exe"C:\Users\Admin\AppData\Local\Temp\idk.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
72KB
-
Filesize
9.9MB
-
Filesize
4KB
-
Filesize
9.9MB