Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
12-10-2024 18:17
General
-
Target
75ca4ba8ba6ca2398c1f6eea11fa850d030293b4aa64f9d7604680b5025b7a76.exe
-
Size
822KB
-
MD5
d363aa68a86d6226eb75b24984b85b99
-
SHA1
f7d901c7a51d230fa4c2280e65a984069067e75f
-
SHA256
75ca4ba8ba6ca2398c1f6eea11fa850d030293b4aa64f9d7604680b5025b7a76
-
SHA512
65d8b0aa4352635d1e1dd292f02fc983fec1f567164029f778fe8749a4bad4ff2ee9535000f416690678fd9b07206deb5fc8bb9758542744edb0d8aa77654e42
-
SSDEEP
24576:gagdID2GEbXxJMR8uNF9L3QDImjlu74UM31IUn:08eZ
Score
10/10
Malware Config
Extracted
Family
asyncrat
Version
0.0.1
Botnet
Default
C2
192.168.248.130:8848
Mutex
DcRatMutex_qwqdanchun
Attributes
-
delay
1
-
install
false
-
install_folder
%AppData%
aes.plain
Signatures
-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\75ca4ba8ba6ca2398c1f6eea11fa850d030293b4aa64f9d7604680b5025b7a76.exe"C:\Users\Admin\AppData\Local\Temp\75ca4ba8ba6ca2398c1f6eea11fa850d030293b4aa64f9d7604680b5025b7a76.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
104KB
-
Filesize
8KB
-
Filesize
80KB
-
Filesize
10.8MB
-
Filesize
8KB
-
Filesize
10.8MB