Overview

overview

10

Static

static

10

8971f4598d...00.exe

windows7-x64

10

8971f4598d...00.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    128s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    25-11-2024 10:57

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    8971f4598d5d15fd2eba21429ac5585d6c1b9a3ca1b246a3a5389924ef60e200.exe

  • Size

    63KB

  • MD5

    be3ec57511b9d1f3e71d5a4e640afa70

  • SHA1

    91b81b3c8d9fa78f4dfc8c7b2ff99e20edc70b7c

  • SHA256

    8971f4598d5d15fd2eba21429ac5585d6c1b9a3ca1b246a3a5389924ef60e200

  • SHA512

    46b439ddd9c79f5ef5807eb0d258843af9b693fc55392923619ba90a3fbd922160a8bc1ef052bcfc5f675b5cb79235431b55548f0f8c76c690603cd1610fb29d

  • SSDEEP

    768:QvsM2sk/978SQC8A+XjlazcBRL5JTk1+T4KSBGHmDbD/ph0oXJ2waKpRRKISu0dn:j1/M/dSJYUbdh9swzpnKPu0dpqKmY7v

Score
10/10
asyncratdefaultrat

Malware Config

Extracted

Family

asyncrat

Botnet

Default

C2

sigmaskibidisigma-36671.portmap.host:36671

Attributes
  • delay

    1

  • install

    false

  • install_folder

    %AppData%

aes.plain

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat
  • Asyncrat family
    asyncrat
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8971f4598d5d15fd2eba21429ac5585d6c1b9a3ca1b246a3a5389924ef60e200.exe
    "C:\Users\Admin\AppData\Local\Temp\8971f4598d5d15fd2eba21429ac5585d6c1b9a3ca1b246a3a5389924ef60e200.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:3052

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3052-0-0x000007FEF5EF3000-0x000007FEF5EF4000-memory.dmp

    Filesize

    4KB

    Download

  • memory/3052-1-0x00000000012D0000-0x00000000012E6000-memory.dmp

    Filesize

    88KB

    Download

  • memory/3052-2-0x000007FEF5EF0000-0x000007FEF68DC000-memory.dmp

    Filesize

    9.9MB

    Download

  • memory/3052-3-0x000007FEF5EF0000-0x000007FEF68DC000-memory.dmp

    Filesize

    9.9MB

    Download

  • memory/3052-4-0x000007FEF5EF3000-0x000007FEF5EF4000-memory.dmp

    Filesize

    4KB

    Download

  • memory/3052-5-0x000007FEF5EF0000-0x000007FEF68DC000-memory.dmp

    Filesize

    9.9MB

    Download