Analysis
-
max time kernel
115s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
18-10-2024 23:40
General
-
Target
289d2752c1c8d90131a3360e36e1b8f40457faa1c5af6bfc9c0d913e4f6b75e9N.exe
-
Size
59KB
-
MD5
2dc467a23da990e4bda00eb6051994f0
-
SHA1
359469eeb24a5e3cd08bd0e4277d81d3783185d7
-
SHA256
289d2752c1c8d90131a3360e36e1b8f40457faa1c5af6bfc9c0d913e4f6b75e9
-
SHA512
16ef9e6299227c72f0f62de7dfe3731d7b7460ddb3a97f7f86c7a7592419fb60f7a44929362ea33694a842308774ee7d05014469a8fd067249358e2f0702167b
-
SSDEEP
1536:YS408DpQeKsqir5SgXgzbFp20PxFtpqKmY7:YXZD1plSgXgzbFp2Wr2z
Score
10/10
Malware Config
Extracted
Family
asyncrat
Version
v5.7
Botnet
Default
Mutex
DcRatMutex_qwqdanchun
Attributes
-
c2_url_file
https://raw.githubusercontent.com/dEWqlDpf0NzeQPrkLvmasX02293xq/Q1pSQVQtTWFsd2FyZS1YV29ybQ-/refs/heads/main/Sever
-
delay
1
-
install
false
-
install_folder
%AppData%
aes.plain
Signatures
-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 24 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\289d2752c1c8d90131a3360e36e1b8f40457faa1c5af6bfc9c0d913e4f6b75e9N.exe"C:\Users\Admin\AppData\Local\Temp\289d2752c1c8d90131a3360e36e1b8f40457faa1c5af6bfc9c0d913e4f6b75e9N.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
80KB
-
Filesize
9.9MB
-
Filesize
9.9MB
-
Filesize
4KB
-
Filesize
9.9MB