Analysis
-
max time kernel
136s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
01-11-2024 05:03
General
-
Target
afc5569ce12610d3cc9f592c8e5d2386e6a74962e72c9d6cb7f8c0ebbde29fbb.exe
-
Size
47KB
-
MD5
d08ff2a0b729060a9dc19b9aa00c02ec
-
SHA1
3fd5712f2715f73af268e69f3b91e6a7ec53cfc1
-
SHA256
afc5569ce12610d3cc9f592c8e5d2386e6a74962e72c9d6cb7f8c0ebbde29fbb
-
SHA512
30e0b1e7489447b2da3f2a3f13da378f74366320f0bf812ef7f2dde8a83b440d601b30dbbaf213971874f6a2bfb89b09005eb1bf40397e3b43a2c8e11348ec85
-
SSDEEP
768:rg3d9ILWN6y+8iU5FE83PrimaYbZgeG5qqg15vEgK/JDZVc6KN:834NUrxVJb2I55nkJDZVclN
Score
10/10
Malware Config
Extracted
Family
asyncrat
Version
1.0.7
Botnet
CEZER
C2
148.113.165.11:3236
Mutex
eqwe2131ewqeqwe
Attributes
-
delay
1
-
install
false
-
install_folder
%AppData%
aes.plain
Signatures
-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
Asyncrat family
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\afc5569ce12610d3cc9f592c8e5d2386e6a74962e72c9d6cb7f8c0ebbde29fbb.exe"C:\Users\Admin\AppData\Local\Temp\afc5569ce12610d3cc9f592c8e5d2386e6a74962e72c9d6cb7f8c0ebbde29fbb.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
72KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
8KB
-
Filesize
10.8MB
-
Filesize
10.8MB