Analysis
- max time kernel
147s - max time network
158s - platform
windows10-2004_x64 - resource
win10v2004-20240709-en - resource tags
- submitted
29/07/2024, 13:59
General
- Target file.exe
- Size 45KB
- Sample240729-raqeya1flr
- SHA256 5dc26c504cc3b9c5bf1150e0b6a577ee75ca878f24a47269f72c933697049635
Score
10/10
Malware Config
Extracted
Family
-
asyncrat
Version
-
0.5.8
Botnet
-
Default
C2
-
144.91.79.54:32769
Mutex
-
E9IiT5JzUivo
Attributes
-
delay
3
-
install
false
-
install_file
TestFile.exe
-
install_folder
%AppData%
aes.plain
Signatures
- AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2208-0-0x000000007468E000-0x000000007468F000-memory.dmp
memory/2208-1-0x0000000000900000-0x0000000000912000-memory.dmp
memory/2208-2-0x0000000074680000-0x0000000074E30000-memory.dmp
memory/2208-3-0x000000007468E000-0x000000007468F000-memory.dmp
memory/2208-4-0x0000000074680000-0x0000000074E30000-memory.dmp