Analysis
-
max time kernel
145s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
24-11-2024 04:04
General
-
Target
92def188af1d90f7d89a42f2966753f8cda9332a9950a7aa49c21ac93881ca89.exe
-
Size
334KB
-
MD5
7ee98c22976fb09ceb6c8639b57ec46c
-
SHA1
493d6e97c7df660901cabe8dc8f0236c7d47bfd8
-
SHA256
92def188af1d90f7d89a42f2966753f8cda9332a9950a7aa49c21ac93881ca89
-
SHA512
2aa04be87c2a2d847dcb599cb4a7f0102379769d0e7c325d7ae637f83dbdafe47476dacfe0525bac4b4f04f7149ceb4ad493b4d33db1984448692da6d2f33177
-
SSDEEP
6144:Li5wh/LyZddE0VxLVLS0hfbKRvUNDhJTIsYI5sgFfv3FJT+ZjlCHbE/PsJU:e5wLOLwgWRMfJTZFv3ojly12
Malware Config
Extracted
asyncrat
1.0.7
Default
host.rorasama.top:63321
127.0.0.1:63321
DcRatMutex_qwqdanchun
-
delay
1
-
install
false
-
install_folder
%AppData%
Signatures
-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
Asyncrat family
-
Async RAT payload 1 IoCs
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\92def188af1d90f7d89a42f2966753f8cda9332a9950a7aa49c21ac93881ca89.exe"C:\Users\Admin\AppData\Local\Temp\92def188af1d90f7d89a42f2966753f8cda9332a9950a7aa49c21ac93881ca89.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
852KB
-
Filesize
104KB
-
Filesize
4KB
-
Filesize
88KB
-
Filesize
9.9MB
-
Filesize
9.9MB
-
Filesize
9.9MB
-
Filesize
852KB
-
Filesize
4KB
-
Filesize
9.9MB
-
Filesize
9.9MB