Analysis
-
max time kernel
147s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
09-10-2024 20:09
General
-
Target
39ca98028b80a00d43f49d7867e04e3a225e9220326197b5d03d516db0c5c46a.exe
-
Size
62KB
-
MD5
e6bc7edc9ba0595a7085a22381311575
-
SHA1
1633f81e6b6f4b9c219eb47965deab968abeb9c5
-
SHA256
39ca98028b80a00d43f49d7867e04e3a225e9220326197b5d03d516db0c5c46a
-
SHA512
5e19c12ae94f0cd0e0e3b2a74933cb095381b38bac8410c01945458a8d18247766e0e807847dbfabc1efa285cce736c258aa6a5a51c0d11df7e2d428a1e3950f
-
SSDEEP
768:rYGTOR/UBS3gy9Bty/PYX5oZGXyM1+QY9G7mqbo3pIn1o+glnq1+LP0zVc6KN:r8UiU/PDZGXhkkbb4IrgE1IP0zVclN
Score
10/10
Malware Config
Extracted
Family
asyncrat
Version
1.0.7
Botnet
2022_03
C2
blackid-42037.portmap.host:8848
Mutex
kkjkdjskfjhksfhdjfgkhfejgfueuifh
Attributes
-
delay
1
-
install
false
-
install_folder
%AppData%
aes.plain
Signatures
-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\39ca98028b80a00d43f49d7867e04e3a225e9220326197b5d03d516db0c5c46a.exe"C:\Users\Admin\AppData\Local\Temp\39ca98028b80a00d43f49d7867e04e3a225e9220326197b5d03d516db0c5c46a.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
88KB
-
Filesize
9.9MB
-
Filesize
9.9MB
-
Filesize
4KB
-
Filesize
9.9MB