Analysis
-
max time kernel
46s -
max time network
49s -
platform
windows10-ltsc 2021_x64 -
resource
win10ltsc2021-20241023-en -
resource tags
-
submitted
23-11-2024 10:03
General
-
Target
nicegame.exe
-
Size
45KB
-
MD5
6e2b9d4f22b2b200964f3dd556eedc1c
-
SHA1
0bb8b71ba4df36f73d27cae26d69ad6d7b6bbc70
-
SHA256
061b0f097574bc509d7b1562c3531ee8e34c6fce784be47b4239b80ac4523d76
-
SHA512
dcb5a1459ab2f7e55768312e51b89100655de8b596cea356278c1ac5ad16a39a4e806852cb6017fb3d79629f9e47650e0affe39f1ecb5533ee8f5045ed675c7c
-
SSDEEP
768:Bunq5TgoqzqWU8d9rmo2qrgp9+V8H8tPIwzjbWgX3iBYcNiPSgCBDZ3x:Bunq5TgNR2vO8w3bJXS+ag8d3x
Score
10/10
Malware Config
Extracted
Family
asyncrat
Version
0.5.8
Botnet
Default
C2
127.0.0.1:3489
media-stat.gl.at.ply.gg:3489
Mutex
QQJBm0alB0p0
Attributes
-
delay
3
-
install
false
-
install_folder
%AppData%
aes.plain
Signatures
-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
Asyncrat family
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\nicegame.exe"C:\Users\Admin\AppData\Local\Temp\nicegame.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
72KB
-
Filesize
7.7MB
-
Filesize
4KB
-
Filesize
7.7MB