Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
19-10-2024 23:21
General
-
Target
85e7ab9768e26c2b287a3092dd7e9f3839a911c2d2679f2c8e2646c4274c6ef7.exe
-
Size
47KB
-
MD5
0af191e517071bb767031b750aa57c98
-
SHA1
f6bdba1c37c828303833ef1fec97d020fb544f45
-
SHA256
85e7ab9768e26c2b287a3092dd7e9f3839a911c2d2679f2c8e2646c4274c6ef7
-
SHA512
b5ecfdadb6fc326861b4b4eb40a89859fd1725e4ad1bdd4b78b32b0f1300a1303b4480a15694f351741e6cbb2d383351dbdacc395a31e60828d2c892bfd52388
-
SSDEEP
768:EuPfZTg4pYiWUU9jjmo2qr5YI0UHR1DPIGGEC00rhLB0bvVoFJG1Xu1KPiV8bCPZ:EuPfZTgKa2IYfUHR1MGGEYrYbdeeXu1J
Malware Config
Extracted
asyncrat
0.5.8
Default
127.0.0.1:6606
127.0.0.1:7707
127.0.0.1:8808
10.140.0.147:6606
10.140.0.147:7707
10.140.0.147:8808
AQoMisEZvm3k
-
delay
3
-
install
false
-
install_folder
%AppData%
Signatures
-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes
-
C:\Users\Admin\AppData\Local\Temp\85e7ab9768e26c2b287a3092dd7e9f3839a911c2d2679f2c8e2646c4274c6ef7.exe"C:\Users\Admin\AppData\Local\Temp\85e7ab9768e26c2b287a3092dd7e9f3839a911c2d2679f2c8e2646c4274c6ef7.exe"1⤵
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
72KB
-
Filesize
7.7MB
-
Filesize
4KB
-
Filesize
7.7MB