Resubmissions
03/11/2024, 01:07
241103-bg5v7szhlf1002/11/2024, 22:50
241102-2sl6ca1kam1002/11/2024, 22:45
241102-2pvy3sxgpr10Analysis
- max time kernel
149s - max time network
119s - platform
windows7_x64 - resource
win7-20240903-en - resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system - submitted
02/11/2024, 22:50
Behavioral task
behavioral1
Sample
Client.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
Client.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
42 signatures
150 seconds
General
- Target Client.exe
- Size 47KB
- Sample241102-2sl6ca1kam
- SHA256 30940e4217fbad30a8664b3210b7005e1865a065a3888a29ee2fd9e616aca250
- MD5 ff01c5cf3e9e3220cc6aca2f16eda6e6
- SHA1 0a455918fc537afc8967195b291cfc517c2ebdf8
- SHA512 1a1d24065c70d5cde9ed87b2df16f496bba5222eb936730841ce74b8b8d009d1b59f211b677d3d341a0e98cb059a63b5f93673f421fee144b3ffab41e2598ab0
- SSDEEP 768:p9umxLiIL1CaS+DiMtelDSN+iV08Ybyge9P13ZoxyWvEgK/JnZVc6KN:p9uAPWMtKDs4zb1S13ZoxRnkJnZVclN
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
asyncrat
Version
-
1.0.7
Botnet
-
Default
C2
-
127.0.0.1:8848
-
127.0.0.1:5555
-
127.0.0.1:4816
-
sb7fmp5.localto.net:4816:8848
-
sb7fmp5.localto.net:4816:5555
-
sb7fmp5.localto.net:4816:4816
Mutex
-
DcRatMutex_qwqdanchun
Attributes
-
delay
1
-
install
false
-
install_folder
%AppData%
aes.plain
Signatures
- Asyncrat family
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2680 taskmgr.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2680 taskmgr.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe 2680 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Client.exe"C:\Users\Admin\AppData\Local\Temp\Client.exe"1⤵PID:2720
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2680