Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
13-08-2024 01:44
General
-
Target
e5c438b7601cdb2c43f04b582530f838a3cabe580552fe5d9b2bc839ea3be351.exe
-
Size
63KB
-
MD5
46292aefe5a072ef4f95822de51e7208
-
SHA1
0aefeb397e7315b523bc08cb105a2362fbfe5309
-
SHA256
e5c438b7601cdb2c43f04b582530f838a3cabe580552fe5d9b2bc839ea3be351
-
SHA512
17364b2785c19eb65bc2a95b9f20683f7a6813eb51597ae0901211c94819b46242143d0f82576f2773f48c88ac404e1ea89ca50946fc81fb86d06787be710b1d
-
SSDEEP
1536:shjExLDRwQuNMXbmaeWs1lp+bj47Ljbb5wUn/4svnGpZVclN:shjExLDRwQuNMXbreFlpaj4Hjbb59Axs
Score
10/10
Malware Config
Extracted
Family
asyncrat
Version
1.0.7
Botnet
Default
C2
127.0.0.1:8848
Mutex
DcRatMutex_qwqdanchun
Attributes
-
delay
1
-
install
false
-
install_folder
%AppData%
aes.plain
Signatures
-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
Suspicious use of AdjustPrivilegeToken 21 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e5c438b7601cdb2c43f04b582530f838a3cabe580552fe5d9b2bc839ea3be351.exe"C:\Users\Admin\AppData\Local\Temp\e5c438b7601cdb2c43f04b582530f838a3cabe580552fe5d9b2bc839ea3be351.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
88KB
-
Filesize
8KB
-
Filesize
10.8MB
-
Filesize
10.8MB