Analysis
-
max time kernel
148s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
16-09-2024 13:49
General
-
Target
bazaar.2020.02/HEUR-Backdoor.MSIL.Crysan.exe
-
Size
46KB
-
MD5
34dd1859e3b572cb15c85c7255d1a2dd
-
SHA1
76f166cef6f5a11d45e5d0cbc53c40b8e89ccb73
-
SHA256
0eeb561ea16bf80e301847add0363445976f5ab518d23e499cbf1f7ce9e6fc59
-
SHA512
2373268b5da51e3f8ca0eb6f8fefa5e801c7c4494944296cf1ab4df7c9f5c274cb6a6ae3ef972ddb065d078d0954324a3651ade4f7725ff71e474958e2932b90
-
SSDEEP
768:o+qb/VbXngXB6XqkOicvHk3eHlWMPbPgF0qk86nFVS3pALZtYI6OCq2tYcFmVc6K:o+joaXvZH0ub4FrktFVS3pid6O/KmVcl
Score
10/10
Malware Config
Extracted
Family
asyncrat
Version
0.5.6A
Botnet
null
C2
jhonjhon4842.ddns.net:6606
jhonjhon4842.ddns.net:3389
Mutex
jicaltapntot
Attributes
-
delay
5
-
install
false
-
install_file
explorer.exe
-
install_folder
%AppData%
aes.plain
Signatures
-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\bazaar.2020.02\HEUR-Backdoor.MSIL.Crysan.exe"C:\Users\Admin\AppData\Local\Temp\bazaar.2020.02\HEUR-Backdoor.MSIL.Crysan.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=3908,i,8231329449558834090,4540802069600791165,262144 --variations-seed-version --mojo-platform-channel-handle=1308 /prefetch:81⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
72KB
-
Filesize
8KB
-
Filesize
10.8MB
-
Filesize
10.8MB