Analysis
-
max time kernel
1032s -
max time network
1050s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
26-11-2024 23:07
General
-
Target
Loader.exe
-
Size
63KB
-
MD5
56c640c4191b4b95ba344032afd14e77
-
SHA1
c93a0fd32b46718ca3bc7d1c78ae6236b88ef3c9
-
SHA256
ebd4b1ab90350e2f13d46f2a356d5a637d5bec704cf3af211c43a89cb11dd142
-
SHA512
617512f96443b7cc9cc315d2eb0322d8b359218d459e80821563336b67ac263f1da9b00c75bde73320d6540572552c47b436c683c862f19b5ed470273001e63e
-
SSDEEP
768:kvsM2sk/978SQC8A+XjivRIOdJD7P7DEhfW1+T4iSBGHmDbDOphLoX34/uSuwdph:v1/MED7jhBYUbghi3U5uwdpqKmY7
Score
10/10
Malware Config
Extracted
Family
asyncrat
Botnet
Default
C2
technical-southwest.gl.at.ply.gg:58694
Attributes
-
delay
1
-
install
false
-
install_folder
%AppData%
aes.plain
Signatures
-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
Asyncrat family
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Loader.exe"C:\Users\Admin\AppData\Local\Temp\Loader.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Loader.exeC:\Users\Admin\AppData\Local\Temp\Loader.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
88KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
8KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
472KB
-
Filesize
208KB
-
Filesize
120KB
-
Filesize
712KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB