Resubmissions
11/12/2024, 15:32
241211-sy44nssrdm1009/08/2024, 21:57
240809-1t1vfs1cpm1006/08/2024, 13:03
240806-qas1dszdqm06/08/2024, 13:01
240806-p9f97szdlm1006/08/2024, 12:52
240806-p3672stdkg1006/08/2024, 12:29
240806-ppa8fsygqr1006/08/2024, 12:29
240806-pn9pmaygqq06/08/2024, 12:26
240806-pmc92ashlh10Analysis
- max time kernel
56s - max time network
63s - platform
windows11-21h2_x64 - resource
win11-20240802-en - resource tags
- submitted
06/08/2024, 12:52
General
- Target 1/7021c9cba6c224272f01d04450c6c31c93857a21feacfa4295a878a4d7b04378.exe
- Size 45KB
- Sample240806-p3672stdkg
- SHA256 7021c9cba6c224272f01d04450c6c31c93857a21feacfa4295a878a4d7b04378
Score
10/10
Malware Config
Extracted
Family
-
asyncrat
Version
-
0.5.7B
Botnet
-
Default
C2
-
82.65.19.134:4443
Mutex
-
AsyncMutex_6SI8OkPnk
Attributes
-
delay
3
-
install
false
-
install_folder
%AppData%
aes.plain
Signatures
- AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes
-
C:\Users\Admin\AppData\Local\Temp\1\7021c9cba6c224272f01d04450c6c31c93857a21feacfa4295a878a4d7b04378.exe"C:\Users\Admin\AppData\Local\Temp\1\7021c9cba6c224272f01d04450c6c31c93857a21feacfa4295a878a4d7b04378.exe"1⤵
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3668-0-0x0000000074A8E000-0x0000000074A8F000-memory.dmp
memory/3668-1-0x0000000000C10000-0x0000000000C22000-memory.dmp
memory/3668-2-0x0000000074A80000-0x0000000075231000-memory.dmp
memory/3668-3-0x0000000074A8E000-0x0000000074A8F000-memory.dmp
memory/3668-4-0x0000000074A80000-0x0000000075231000-memory.dmp