Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
13-10-2024 17:26
General
-
Target
27CQR_Client.exe
-
Size
114KB
-
MD5
9e2c955385324658ae41adbf8a5fab17
-
SHA1
18ac2454fcea4dcb8ccabd5ede656fc305e95dab
-
SHA256
83d732af45ea57a68a4f7d0296e24d44786b4d527880fe61626f28d9eeba43ba
-
SHA512
fff81864935c0fa3b27e89db89d9016737011e89bc01bcc670e1b9c895e58e57e99c6566363891989a05b9b4d62f8511192a1d561636cbebb638f84a27c68bd4
-
SSDEEP
1536:daPNWtKDs4zb1VgnkJy4cBlKJj5tvmzaal4iZVclN:QPNWtQrzb1VU3tBlKJvmzaK4izY
Score
10/10
Malware Config
Extracted
Family
asyncrat
Version
1.0.7
Botnet
Default
C2
192.168.2.44:8848
Mutex
DcRatMutex_qwqdanchun
Attributes
-
delay
1
-
install
false
-
install_folder
%AppData%
aes.plain
Signatures
-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\27CQR_Client.exe"C:\Users\Admin\AppData\Local\Temp\27CQR_Client.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
136KB
-
Filesize
10.8MB
-
Filesize
8KB
-
Filesize
10.8MB