Analysis
-
max time kernel
6s -
max time network
9s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
03-08-2024 07:01
General
-
Target
Polymorphic.exe
-
Size
510KB
-
MD5
3ee5089e842ba0d2bb5890d578355439
-
SHA1
80ccf874182eba3aaf19b8d1b57ecb98e37f97f2
-
SHA256
463b26fcdcf9b305884da14532e522016cfff8ee2efe6f787912cefb97a1b69f
-
SHA512
a5f1d7a8296fe5e78bc311a5f1550ad5e5c4ca292bb338805938831d96b54008d4eef4383a5834e0bca74da4dd02f15b574cc0394c17d5f985d5327ecab07011
-
SSDEEP
12288:6bX2MBU8Kvac2L9Go0Bsvs7CMuA6EeIUv1KXACT:10nz0CvsmhPI
Score
10/10
Malware Config
Extracted
Family
asyncrat
Version
1.0.7
Botnet
Default
C2
127.0.0.1:8848
Mutex
DcRatMutex_qwqdanchun
Attributes
-
delay
1
-
install
false
-
install_folder
%AppData%
aes.plain
Signatures
-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
Async RAT payload 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Polymorphic.exe"C:\Users\Admin\AppData\Local\Temp\Polymorphic.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
104KB
-
Filesize
524KB
-
Filesize
4KB
-
Filesize
524KB
-
Filesize
524KB
-
Filesize
88KB