Analysis
-
max time kernel
146s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
18-08-2024 18:46
General
-
Target
5fe70d03f7e09b37bbc1df3a7dfe051472ecefd0f4d3a353050bf34f09cc8590.exe
-
Size
74KB
-
MD5
5477db85d8176f46b0e7f060580ef1f6
-
SHA1
f4449f79c4ab7bfd9626ba6bb3e4cfcfcad4f1e8
-
SHA256
5fe70d03f7e09b37bbc1df3a7dfe051472ecefd0f4d3a353050bf34f09cc8590
-
SHA512
e67089fe1cb20f99bdd6be339fdac45b3ea76ca28f9524c04ea0a946e0d083ec36c1fb85688a53923c739befa1d66cabea4eec315433c6b56fa9bb399484534f
-
SSDEEP
1536:LAUUkcxNW18Qb4KT0al0XSjYa0cLJSPMwFdhMlaN7d6fH1bfbVsVw4wzURLVclN:LAUBcxNW18QEKT0al0XSjYa0c9SPMw9I
Score
10/10
Malware Config
Extracted
Family
asyncrat
Version
Ninja - X Remote Administration Tool v9.0.2
Botnet
Default
C2
157.20.182.102:4449
Mutex
pmozufzydayusfgpzfl
Attributes
-
delay
1
-
install
false
-
install_folder
%AppData%
aes.plain
Signatures
-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
VenomRAT 1 IoCs
Detects VenomRAT.
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\5fe70d03f7e09b37bbc1df3a7dfe051472ecefd0f4d3a353050bf34f09cc8590.exe"C:\Users\Admin\AppData\Local\Temp\5fe70d03f7e09b37bbc1df3a7dfe051472ecefd0f4d3a353050bf34f09cc8590.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
96KB
-
Filesize
10.8MB
-
Filesize
8KB
-
Filesize
10.8MB