Analysis
-
max time kernel
111s -
max time network
120s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
23-11-2024 22:30
General
-
Target
6514a658cdfcf26f38c2c876f689816b9bbe7ae5e99b26deac1e34b828aa54e1N.exe
-
Size
1.4MB
-
MD5
85dab64468bc0ddee103db8160d3cd00
-
SHA1
f4489f4a8286ae13254423a210da77047b256c00
-
SHA256
6514a658cdfcf26f38c2c876f689816b9bbe7ae5e99b26deac1e34b828aa54e1
-
SHA512
6ba26a05d27a67ca772ce09ed88c5b14a1635b8dc8dc962ef022b999b4a5a9619f40423e4dc31d44a830a6d6f0b10a7df5adf053f231b416e314bab99052069e
-
SSDEEP
24576:WR9IYVaFSvVSXKG+SE4LQ/+6pdWS2W6zT9oG9wxsr7AV:q9xYc/+6/WSl6zT9oGH
Malware Config
Extracted
asyncrat
0.5.8
Default
143.198.82.194:6606
Zin58gVfSemD
-
delay
3
-
install
false
-
install_folder
%AppData%
Signatures
-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
Asyncrat family
-
Async RAT payload 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\6514a658cdfcf26f38c2c876f689816b9bbe7ae5e99b26deac1e34b828aa54e1N.exe"C:\Users\Admin\AppData\Local\Temp\6514a658cdfcf26f38c2c876f689816b9bbe7ae5e99b26deac1e34b828aa54e1N.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1024KB
-
Filesize
4KB
-
Filesize
72KB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
1024KB
-
Filesize
4KB
-
Filesize
7.7MB
-
Filesize
1.5MB