Analysis
- max time kernel
150s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20240709-en - resource tags
- submitted
27/07/2024, 10:18
General
- Target n.exe
- Size 58KB
- Sample240727-mb16lstenl
- SHA256 21110b3fea3acb08b2473cd1ab0cc419ca0abfb1a9d49e380eb2d78bc80b020f
Malware Config
Extracted
-
asyncrat
-
SuperBoo Rat v1.1
-
Default
-
127.0.0.1:1337
-
127.0.0.1:5552
-
127.0.0.1:6703
-
le-pencil.gl.at.ply.gg:1337
-
le-pencil.gl.at.ply.gg:5552
-
le-pencil.gl.at.ply.gg:6703
-
SuperBoo_mtex_920393
-
delay
3
-
install
false
-
install_folder
%AppData%
Signatures
- AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\n.exe"C:\Users\Admin\AppData\Local\Temp\n.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2124-0-0x0000000074B2E000-0x0000000074B2F000-memory.dmp
memory/2124-1-0x0000000000070000-0x0000000000084000-memory.dmp
memory/2124-2-0x0000000074B20000-0x00000000752D0000-memory.dmp
memory/2124-5-0x0000000005650000-0x00000000056EC000-memory.dmp
memory/2124-6-0x0000000006010000-0x00000000065B4000-memory.dmp
memory/2124-7-0x0000000005AD0000-0x0000000005B36000-memory.dmp
memory/2124-8-0x0000000074B2E000-0x0000000074B2F000-memory.dmp
memory/2124-9-0x0000000074B20000-0x00000000752D0000-memory.dmp
memory/2124-10-0x0000000006B20000-0x0000000006B96000-memory.dmp
memory/2124-11-0x0000000005A90000-0x0000000005A9E000-memory.dmp
memory/2124-12-0x0000000006AF0000-0x0000000006B0E000-memory.dmp
memory/2124-13-0x0000000006D20000-0x0000000006DB2000-memory.dmp
memory/2124-14-0x00000000005E0000-0x00000000005FE000-memory.dmp
memory/2124-15-0x0000000000600000-0x000000000060E000-memory.dmp
memory/2124-16-0x0000000074B20000-0x00000000752D0000-memory.dmp
memory/2124-17-0x0000000074B20000-0x00000000752D0000-memory.dmp
memory/2124-18-0x0000000074B20000-0x00000000752D0000-memory.dmp
memory/2124-19-0x0000000074B20000-0x00000000752D0000-memory.dmp
memory/2124-20-0x0000000074B20000-0x00000000752D0000-memory.dmp
memory/2124-21-0x0000000074B20000-0x00000000752D0000-memory.dmp