Analysis
-
max time kernel
144s -
max time network
134s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
17-11-2024 14:25
General
-
Target
AsyncClient.exe
-
Size
45KB
-
MD5
c6f1e054e0859686be9d5423dda13eae
-
SHA1
4c24c816dce4c967d9bd0db988c4b94976ad8f4e
-
SHA256
0651e364a7920cee4c127ad0e815bab6efd25648f57499764797b43235e86a28
-
SHA512
3515b9321f6d0dcb5146e66cb0e177570909bd9bd9a10c12383a94aeae8708ad589742f228d74a71d8dea9822fef77badc927b6bb106a909f5dc0e4cfa7fe39f
-
SSDEEP
768:Fu2r1T1tMfdWUdLO3mo2qz5qKjPGaG6PIyzjbFgX3iNfJd3nqhd81ltkBDZvx:Fu2r1T1y22sqKTkDy3bCXSNBd3q781S7
Malware Config
Extracted
asyncrat
0.5.8
Default
127.0.0.1:6606
127.0.0.1:7707
127.0.0.1:8808
127.0.0.1:1337
127.0.0.1:16335
18.119.130.176:6606
18.119.130.176:7707
18.119.130.176:8808
18.119.130.176:1337
18.119.130.176:16335
2.tcp.ngrok.io:6606
2.tcp.ngrok.io:7707
2.tcp.ngrok.io:8808
2.tcp.ngrok.io:1337
2.tcp.ngrok.io:16335
3WIOtiO6KOc9
-
delay
3
-
install
false
-
install_file
RtlUpdate.exe
-
install_folder
%AppData%
Signatures
-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
Asyncrat family
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes
-
C:\Users\Admin\AppData\Local\Temp\AsyncClient.exe"C:\Users\Admin\AppData\Local\Temp\AsyncClient.exe"1⤵
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
72KB
-
Filesize
6.9MB
-
Filesize
4KB
-
Filesize
6.9MB