Analysis
-
max time kernel
115s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
19-09-2024 06:11
General
-
Target
5572d0cc59fec30b96b2fba2b76b117732e111f2392d1d4a5bc92ef200cf7d4dN.exe
-
Size
45KB
-
MD5
fe551ac439d42e780bade64d84afe480
-
SHA1
f30c1b8c9c355cc4c1661076edfbc443cc2958af
-
SHA256
5572d0cc59fec30b96b2fba2b76b117732e111f2392d1d4a5bc92ef200cf7d4d
-
SHA512
e56e9316ce91b0e84bf96742121029813aea4aaf3fb5f3442835de9d0be9fdc8e4b752f31e51ee726467fa4fba7a81f5cadb7a4c1f64639ff8500315482310ca
-
SSDEEP
768:mu/dRTUo0HQbWUnmjSmo2qMwKjPGaG6PIyzjbFgX3iqkUbbM4ELm+PdXBDZyx:mu/dRTUPE2kKTkDy3bCXSqkUboZK+FRy
Malware Config
Extracted
asyncrat
0.5.8
Default
127.0.0.1:6606
127.0.0.1:7707
127.0.0.1:8808
0akvlxm4oQD6
-
delay
3
-
install
false
-
install_folder
%AppData%
Signatures
-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\5572d0cc59fec30b96b2fba2b76b117732e111f2392d1d4a5bc92ef200cf7d4dN.exe"C:\Users\Admin\AppData\Local\Temp\5572d0cc59fec30b96b2fba2b76b117732e111f2392d1d4a5bc92ef200cf7d4dN.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
72KB
-
Filesize
6.9MB
-
Filesize
4KB
-
Filesize
6.9MB