Analysis
-
max time kernel
1197s -
max time network
1199s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
16-11-2024 15:15
General
-
Target
AsyncClient.exe
-
Size
49KB
-
MD5
a8ce40fe1fa339126ca0ed8fd35f266f
-
SHA1
f833c7c6f2b8225b74576b503a457c10150e6918
-
SHA256
b163a773d511d97f9c2bf9ca612437f8496c59190d98f2855bd0599d3cdda3d6
-
SHA512
7e6fea1b1c675839eb5400b5fd069a2994d37f88e3a1ff856cbdef5664df4a40f11bee50c2118d5abb6e5c36c4d6ff959f6f976d7bf7c0ab458e2c31fe77d2b7
-
SSDEEP
768:Au/6ZTgoiziWUUM9rmo2qrdzMaND7T5EPIhk1kvnXR0b4FdKqgHPJXkFfisqBDZm:Au/6ZTgle2iztpynb4FdlUQfis0dkx
Score
10/10
Malware Config
Extracted
Family
asyncrat
Version
0.5.7B
Botnet
FDK
C2
ny-case.gl.at.ply.gg:60515
Mutex
AsyncMutex_6SI8OkPnk
Attributes
-
delay
3
-
install
false
-
install_folder
%AppData%
aes.plain
Signatures
-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
Asyncrat family
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\AsyncClient.exe"C:\Users\Admin\AppData\Local\Temp\AsyncClient.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
72KB
-
Filesize
7.7MB
-
Filesize
4KB
-
Filesize
7.7MB