Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
21-11-2024 19:54
General
-
Target
4931d3817138d1e57c6b2ae0a79df9d649d95e6288d5578edf25f47f03a1f98e.exe
-
Size
63KB
-
MD5
85e35aa8db6e8972dc51afb19cb89965
-
SHA1
d18217b5d767c67037c94524af51b8dbcee7e8aa
-
SHA256
4931d3817138d1e57c6b2ae0a79df9d649d95e6288d5578edf25f47f03a1f98e
-
SHA512
42e0f39e8745015a4801278bc78b8730ea3874a9959b50c12c5344978ae7c98ed8e2e5af77a97f149f92c8c87e02ca28e1b7988521b2531286b9f2b6f4d47b27
-
SSDEEP
1536:5mImx6tX2kNff4sKu+UYFYc5b+APjgFTFrPlTGZxq:5m9x6tmkN7Ku+UYFP5b+Egrdixq
Malware Config
Extracted
asyncrat
| CRACKED BY https://t.me/xworm_v2
12 noviembre
12novwins.duckdns.org:9003
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
false
-
install_folder
%AppData%
Signatures
-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
Asyncrat family
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4931d3817138d1e57c6b2ae0a79df9d649d95e6288d5578edf25f47f03a1f98e.exe"C:\Users\Admin\AppData\Local\Temp\4931d3817138d1e57c6b2ae0a79df9d649d95e6288d5578edf25f47f03a1f98e.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
88KB
-
Filesize
7.7MB
-
Filesize
4KB
-
Filesize
7.7MB