Analysis
-
max time kernel
148s -
max time network
135s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
23-11-2024 20:17
General
-
Target
1ee8ce2f6634dc728f00524fcc01404e791d417168668e2b2c51c51c8bfdb46b.exe
-
Size
48KB
-
MD5
f11412a96f3d7008c56504850e1d940c
-
SHA1
598927bc16c8c63de442be4604720f38323ef702
-
SHA256
1ee8ce2f6634dc728f00524fcc01404e791d417168668e2b2c51c51c8bfdb46b
-
SHA512
b560a688f664740b79ff83cc535724fb2d847546246a65c97c89db0bfbe767b3493f21f365bb1f30aed897eb69e3df886be63e9b1606c5f668305a1c82ebedea
-
SSDEEP
768:cD0q7EILuCCj+DiPYIM81l/4iU08YbWgedYlmvEgK/JDZVc6KN:w0vrAIb9zbJaYlmnkJDZVclN
Malware Config
Extracted
asyncrat
1.0.7
Default
127.0.0.1:8848
127.0.0.1:5552
127.0.0.1:14080
127.0.0.1:18412
0.tcp.eu.ngrok.io:8848
0.tcp.eu.ngrok.io:5552
0.tcp.eu.ngrok.io:14080
0.tcp.eu.ngrok.io:18412
DcRatMutex_qwqdanchun
-
delay
1
-
install
false
-
install_file
pidoras.exe
-
install_folder
%AppData%
Signatures
-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
Asyncrat family
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1ee8ce2f6634dc728f00524fcc01404e791d417168668e2b2c51c51c8bfdb46b.exe"C:\Users\Admin\AppData\Local\Temp\1ee8ce2f6634dc728f00524fcc01404e791d417168668e2b2c51c51c8bfdb46b.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
72KB
-
Filesize
10.8MB
-
Filesize
8KB
-
Filesize
10.8MB