Analysis
-
max time kernel
134s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
10-10-2024 14:59
General
-
Target
AsyncClient.exe
-
Size
45KB
-
MD5
608c690f9f2eb09d832dc26b007694b5
-
SHA1
894dc8eadbc184a2b327ae771850cc726ebf26a0
-
SHA256
d145af0585628070c716f9ee1ce63e4da0b239d72e3dbf41683abb9db2f7a5af
-
SHA512
b2bde1f1679056c65123d09bb50236909843e05cf7e0e714cb3a7ab4a510088070e2f0f797153b65a0955b94113a5b437e91854d194c2a1631ec9779d427c346
-
SSDEEP
768:luny5TgoqzqWU8d9rmo2qrgKjPGaG6PIyzjbFgX3ir3ITlDzwIjr8HTOyBDZrx:luny5TgNR25KTkDy3bCXSr3k/wIjIHi8
Malware Config
Extracted
asyncrat
0.5.8
Default
192.168.244.72:6606
192.168.244.72:7707
192.168.244.72:8808
192.168.244.72:3000
192.168.244.1:6606
192.168.244.1:7707
192.168.244.1:8808
192.168.244.1:3000
KRVJ4XZBrwB4
-
delay
3
-
install
false
-
install_folder
%AppData%
Signatures
-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 20 IoCs
-
Suspicious use of AdjustPrivilegeToken 5 IoCs
-
Suspicious use of FindShellTrayWindow 47 IoCs
-
Suspicious use of SendNotifyMessage 46 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\AsyncClient.exe"C:\Users\Admin\AppData\Local\Temp\AsyncClient.exe"1⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /01⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
72KB
-
Filesize
7.7MB
-
Filesize
4KB
-
Filesize
7.7MB