Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
135s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
04/08/2024, 18:44
General
-
Target
a8fcd268b48c903e21500439d6754500d59d12d7d5d4e2c7ea737661fa8fe230.exe
-
Size
47KB
-
MD5
fedb1274930bfa08a83480134a3f1412
-
SHA1
d47be6340ecd780274b98dad463749eb2d9d49fd
-
SHA256
a8fcd268b48c903e21500439d6754500d59d12d7d5d4e2c7ea737661fa8fe230
-
SHA512
ba1d2a9745b837c1f984577a5d96bff1b2c126d86fd75c7e763b085ea8440360899d383be10a7a6f31bbd87c215c3dfed82c03c15880e8f4ef336c411cb448b4
-
SSDEEP
768:4q+s3pUtDILNCCa+DiptelDSN+iV08YbygeiH3XvEgK/JvZVc6KN:4q+AGtQOptKDs4zb1PnkJvZVclN
Score
10/10
Malware Config
Extracted
Family
asyncrat
Version
1.0.7
Botnet
Default
C2
127.0.0.1:1024
20.199.84.103:1024
Mutex
DcRatMutex_qwqdanchun
Attributes
-
delay
1
-
install
false
-
install_folder
%AppData%
aes.plain
Signatures
-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a8fcd268b48c903e21500439d6754500d59d12d7d5d4e2c7ea737661fa8fe230.exe"C:\Users\Admin\AppData\Local\Temp\a8fcd268b48c903e21500439d6754500d59d12d7d5d4e2c7ea737661fa8fe230.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
72KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
8KB
-
Filesize
10.8MB
-
Filesize
10.8MB