Analysis
-
max time kernel
44s -
max time network
36s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
09-11-2024 22:41
General
-
Target
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA.exe
-
Size
45KB
-
MD5
f24e8071e5c5b6ded0d452e75f6f6797
-
SHA1
736a27efff17bb7580e3020d053545330c6b1b43
-
SHA256
ea983a62b3c192fb2909bec28f9663e2256bf724ce641ec5fd7b4ce333c09e02
-
SHA512
99ee17019afcaf497839b37436c552b8d0b71ee652427be4498918447a436b70ccd6f6152f67a1b7243a5b517ed4173033f578d5f5c561ae562eb67977e21e78
-
SSDEEP
768:1uny5TgoqzqWU8d9rmo2qr+NWyMlsOdPINEjb9gX3i8EHBF2YqHGLeojlBDZ/x:1uny5TgNR2NWDlLaNEbqXStHKYyGjvdp
Malware Config
Extracted
asyncrat
0.5.8
Default
127.0.0.1:6606
127.0.0.1:7707
127.0.0.1:8808
127.0.0.1:1604
fervic341.duckdns.org:6606
fervic341.duckdns.org:7707
fervic341.duckdns.org:8808
fervic341.duckdns.org:1604
iBc9i2o33voI
-
delay
3
-
install
false
-
install_folder
%AppData%
Signatures
-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
Asyncrat family
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes
-
C:\Users\Admin\AppData\Local\Temp\AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA.exe"C:\Users\Admin\AppData\Local\Temp\AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA.exe"1⤵
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
72KB
-
Filesize
7.7MB
-
Filesize
4KB
-
Filesize
7.7MB