Analysis
-
max time kernel
148s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
15-11-2024 16:47
General
-
Target
a189b890b4bbfd4a2666fb4dbfc2542b41853c53e5f964d20337d391c010ff17.exe
-
Size
47KB
-
MD5
fc848883e9b9c4af98f5d1d6273e4cd1
-
SHA1
60cf8ac0f18e6e6a919aeab33df11636f1de236e
-
SHA256
a189b890b4bbfd4a2666fb4dbfc2542b41853c53e5f964d20337d391c010ff17
-
SHA512
32e1cb3db3b57c9191b6df324910dd29ad8024164a40958c00d0d17a9a441cbed17ac77abcb56bfe387c8e4d5a65c9a54c00d1724f76fbadc741b602899fda74
-
SSDEEP
768:xGq+s3pUtDILNCCa+Di+0j1rgLqRp8Aofiw8Yblge5s69OhtvEgK/JLZVc6KNz:8q+AGtQO+OOPAmzbiws69ynkJLZVclNz
Score
10/10
Malware Config
Extracted
Family
asyncrat
Version
1.0.7
Botnet
Server
C2
dckazts.duckdns.org:35650
Mutex
DcRatMutex_qwqdanchun
Attributes
-
delay
1
-
install
false
-
install_folder
%AppData%
aes.plain
Signatures
-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
Asyncrat family
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a189b890b4bbfd4a2666fb4dbfc2542b41853c53e5f964d20337d391c010ff17.exe"C:\Users\Admin\AppData\Local\Temp\a189b890b4bbfd4a2666fb4dbfc2542b41853c53e5f964d20337d391c010ff17.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
72KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
8KB
-
Filesize
10.8MB
-
Filesize
10.8MB