Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
27-10-2024 00:31
General
-
Target
2172-2-0x00000000001D0000-0x00000000001E6000-memory.exe
-
Size
88KB
-
MD5
1d5cd2f9edb2db9864aa8240604a56e0
-
SHA1
82a74961cfc8840505a4ddfc392a9904d0043949
-
SHA256
32d74c2c0660c8b9173d76122ddd05434bc2407355b60523286da0ef1f489f43
-
SHA512
fe9361e3d68754d548d337c3e5ee39812a10642194ff2b6afe6d30e8435dd39c6463f7d1b87848202e701abb20d0c843108ceb3db152305b4309fa67274e0557
-
SSDEEP
768:Yv0M2UM/978aQC8A+Xji7NirX8RvKq1+T4fSBGHmDbDgph0oXRaOSfA3PX0SuMdP:D1/ku7c8IqQYUbeh9IgDuMdpqKmY7
Score
10/10
Malware Config
Extracted
Family
asyncrat
Botnet
Default
C2
dcxwq1.duckdns.org:3232
Attributes
-
delay
1
-
install
false
-
install_folder
%AppData%
aes.plain
Signatures
-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
Asyncrat family
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2172-2-0x00000000001D0000-0x00000000001E6000-memory.exe"C:\Users\Admin\AppData\Local\Temp\2172-2-0x00000000001D0000-0x00000000001E6000-memory.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
88KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB