Analysis
-
max time kernel
146s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
09-10-2024 21:39
General
-
Target
sce.exe
-
Size
63KB
-
MD5
12c955565a6a0fcc6003158b046f3a27
-
SHA1
a73e764f90bd531a3efd3fe7b921f8d55885878f
-
SHA256
b2408be432206f62d7d9b715aab914da3647afec606d496654219bb0c13598cc
-
SHA512
cd787c1b1d821853aa96d85d883b9bab1d7b526924b998817393bbd00706fa070543608a6d2ebf3ad9d688600d7b8180ae0bc5de1e4e3535e891f953951551fa
-
SSDEEP
768:Cm0vnfEXf78awC8A+XU8FWiud3iN/YN1+T46SBGEmDbD6ph0oXAKknDZ7SusdpqM:qEXiejBit+xnUbsh9AlnNeusdpqKmY7
Score
10/10
Malware Config
Extracted
Family
asyncrat
Botnet
Default
C2
127.0.0.1:6000
147.185.221.23:6000
Attributes
-
delay
1
-
install
false
-
install_folder
%AppData%
aes.plain
Signatures
-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\sce.exe"C:\Users\Admin\AppData\Local\Temp\sce.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
88KB
-
Filesize
9.9MB
-
Filesize
9.9MB
-
Filesize
4KB
-
Filesize
9.9MB