Analysis
-
max time kernel
147s -
max time network
143s -
platform
windows10-ltsc 2021_x64 -
resource
win10ltsc2021-20241023-en -
resource tags
-
submitted
03-11-2024 20:22
General
-
Target
wqfwegd.exe
-
Size
45KB
-
MD5
6be9cc6e6ece7c29e9532e4d7032ab36
-
SHA1
a3d9f67b6f9578ca974ac87662c53b20d753dd2b
-
SHA256
e6e97b5614119634048a7614ae40932321e94c32a37b54e5e06406dd44b09684
-
SHA512
f06d20ee4ad6359f14a2ce0b2df7631c116cf94e8304ec6aa5770800df8dfc3e3e479edf8c95d3cdcaa580d9bb0ff08529a93a33f3f0c7e38f8274ffd1884f29
-
SSDEEP
768:uu/dRTUo0HQbWUnmjSmo2qMeQzPivMPIFDGjbNFgX3iIIIZNaIEGUA2BDZax:uu/dRTUPE2zzMF2bEXSHIZNjEGUAYdax
Score
10/10
Malware Config
Extracted
Family
asyncrat
Version
0.5.8
Botnet
Default
C2
127.0.0.1:6606
127.0.0.1:7707
127.0.0.1:8808
Mutex
E2qgtjRHaRSi
Attributes
-
delay
3
-
install
false
-
install_folder
%AppData%
aes.plain
Signatures
-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
Asyncrat family
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes
-
C:\Users\Admin\AppData\Local\Temp\wqfwegd.exe"C:\Users\Admin\AppData\Local\Temp\wqfwegd.exe"1⤵
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
72KB
-
Filesize
7.7MB
-
Filesize
4KB
-
Filesize
7.7MB