asyncrat | 286d5aa90a40df230da677f9d6cf8864b2c068a7bd47a0aed7193f547804ff6b

Analysis

max time kernel
134s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
07-11-2024 14:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

286d5aa90a40df230da677f9d6cf8864b2c068a7bd47a0aed7193f547804ff6b.exe
Size

47KB
MD5

ea2b59e88875af294be84fc8008a198d
SHA1

1ef0fe5b1d6cf01ec27959e3bcacb455cafde4a8
SHA256

286d5aa90a40df230da677f9d6cf8864b2c068a7bd47a0aed7193f547804ff6b
SHA512

514d15e900189c106ab33e284f3e014ae70922571af70d6ab2d603d441c1252c7bb4065cef86bd83072f6747f0ea1de6ac956319d3f101fc80ab4c1c6a7be55a
SSDEEP

768:Zu/dRTUo0HQbWUnmjSmo2qMpYb/2b/KcPIw4ep0bPKr8pdX6w8Em9TH+/BDZkx:Zu/dRTUPE2G/2yw4hbPA25U7eJdkx

Score

10^/10

asyncrat default discovery rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

172.26.13.19:8787

Mutex

Yy6l75CdqRZE

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Asyncrat family
asyncrat

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

286d5aa90a40df230da677f9d6cf8864b2c068a7bd47a0aed7193f547804ff6b.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	286d5aa90a40df230da677f9d6cf8864b2c068a7bd47a0aed7193f547804ff6b.exe

C:\Users\Admin\AppData\Local\Temp\286d5aa90a40df230da677f9d6cf8864b2c068a7bd47a0aed7193f547804ff6b.exe
"C:\Users\Admin\AppData\Local\Temp\286d5aa90a40df230da677f9d6cf8864b2c068a7bd47a0aed7193f547804ff6b.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3520

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3520-0-0x000000007526E000-0x000000007526F000-memory.dmp

Filesize
4KB

Download
memory/3520-1-0x0000000000A90000-0x0000000000AA2000-memory.dmp

Filesize
72KB

Download
memory/3520-2-0x0000000075260000-0x0000000075A10000-memory.dmp

Filesize
7.7MB

Download
memory/3520-3-0x000000007526E000-0x000000007526F000-memory.dmp

Filesize
4KB

Download
memory/3520-4-0x0000000075260000-0x0000000075A10000-memory.dmp

Filesize
7.7MB

Download