Analysis
-
max time kernel
147s -
max time network
151s -
platform
windows11-21h2_x64 -
resource
win11-20240802-en -
resource tags
-
submitted
08-08-2024 01:28
General
-
Target
Polymorphic.exe
-
Size
282KB
-
MD5
e180466ad25d8ca0881d3e78389f8785
-
SHA1
2274e69d2d0cbbec63886ae25d745c18ab9dfaa2
-
SHA256
4d6a80c4a2a952f2b3c58e8dda41712806b20fdb729950954ec34ac23bd5e336
-
SHA512
686f950bda5500c5fb7825b12fcdfaac1dd57b96432d49842aa797c65bdd8d7afadf7118f7aa65f7331e19dd9fe69b4dbc9ee7bb24b41ceadbad0e57526163b3
-
SSDEEP
6144:1oTqOB5Lwpdw8/kPOAGtTRA6TQhoIU3/IN/3gKXAs/lh08J:rmmdR/uFa9A6EeIUv1KXACT0m
Score
10/10
Malware Config
Extracted
Family
asyncrat
Version
1.0.7
Botnet
Default
C2
127.0.0.1:8848
Mutex
DcRatMutex_qwqdanchun
Attributes
-
delay
1
-
install
false
-
install_folder
%AppData%
aes.plain
Signatures
-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
Async RAT payload 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Polymorphic.exe"C:\Users\Admin\AppData\Local\Temp\Polymorphic.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
296KB
-
Filesize
4KB
-
Filesize
104KB
-
Filesize
296KB
-
Filesize
296KB
-
Filesize
88KB