Analysis
-
max time kernel
134s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
20-08-2024 19:14
General
-
Target
b20888404c5656c4e63ac382a85d673f.exe
-
Size
45KB
-
MD5
b20888404c5656c4e63ac382a85d673f
-
SHA1
0b9c972399959f45efae01669ef94d4da395499a
-
SHA256
66d815d755886b1ee38e68d899503249768b8dcf9008d35c8fa89fa35e44141d
-
SHA512
741234851f71d09e00bb99270a2ee63c2a75010f08a4ef4138807f6adb997796a6d79cabe0b1556c55b0c608affc4fc8045f66d47ce7086c766a6692c5eb295c
-
SSDEEP
768:muMmi+TXEFlvWUjVSNmo2qzohumQ6dnQcIPIoVzjbVgX3i44PrRvHbD3Eo+2oBD3:muMmi+TXGk2B+6tltoV3byXSXhQosdfx
Malware Config
Extracted
asyncrat
0.5.8
Putty
krecgh.4cloud.click:6943
OjZL4DoWlVCn
-
delay
3
-
install
false
-
install_file
Automatic Settings.exe
-
install_folder
%AppData%
Signatures
-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b20888404c5656c4e63ac382a85d673f.exe"C:\Users\Admin\AppData\Local\Temp\b20888404c5656c4e63ac382a85d673f.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
72KB
-
Filesize
7.7MB
-
Filesize
624KB
-
Filesize
5.6MB
-
Filesize
408KB
-
Filesize
4KB
-
Filesize
7.7MB