Analysis
-
max time kernel
1196s -
max time network
1199s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
16-11-2024 15:08
General
-
Target
Melonloaderinstaller.exe
-
Size
85KB
-
MD5
fa71ad818f4acd9a353b3768c34277c5
-
SHA1
c7a4c2137287549dfd90f228ddc8bf3c3e61ab28
-
SHA256
2ab61dcd70dd811228e99b3d7ff0d7579593e273c4f5e292707c48c5d52efe67
-
SHA512
91c7e8ed90ecdb8713a89e99789fac2cf2abb1e56e18aa491cf3dd49af76a6cd488a0bd9c32a2b6edea72666297012adfeb65806788b5dc5f1bca93707a52cea
-
SSDEEP
1536:nu/6ZTgle2Dw3zr+7baSo8VL552GMXYdsQScFY/YQULA+wgvbx:nu/iTgle2kjr+7baSXL5nrzio7Rx
Score
10/10
Malware Config
Extracted
Family
asyncrat
Version
0.5.7B
Botnet
FDK
C2
ny-case.gl.at.ply.gg:60515
Mutex
AsyncMutex_6SI8OkPnk
Attributes
-
delay
3
-
install
false
-
install_folder
%AppData%
aes.plain
Signatures
-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
Asyncrat family
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Melonloaderinstaller.exe"C:\Users\Admin\AppData\Local\Temp\Melonloaderinstaller.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
104KB
-
Filesize
7.7MB
-
Filesize
408KB
-
Filesize
624KB
-
Filesize
4KB
-
Filesize
7.7MB