Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
26-11-2024 08:34
General
-
Target
6306f45ce30c8aa95083bf427f0107b981fd03eec856e6a4e156b3f7fe096174.exe
-
Size
63KB
-
MD5
b48d70fa8f3198ce5f4ea54137bf9d0a
-
SHA1
20c680d3f653280dbdc1c8aa240b31ad2c97d63d
-
SHA256
6306f45ce30c8aa95083bf427f0107b981fd03eec856e6a4e156b3f7fe096174
-
SHA512
e33b0327e4d08fe7749f8835cd28df9cad80c0b7529f96468c0a1bb35f491eac085d39078cb1208260ada39d36fb4128e615009c8dfdcebeed8d67015efcc93c
-
SSDEEP
1536:Lhp5LrUwk4Xq0Wdbk6E8P7Gbbow/M6ySGpZVclNO:Lhp5LrUwk4XqdI6ljGbboeM6yXzYY
Score
10/10
Malware Config
Extracted
Family
asyncrat
Version
1.0.7
Botnet
Default
C2
where-leads.gl.at.ply.gg:61177
where-leads.gl.at.ply.gg:7777
Mutex
DcRatMutex_qwqdanchun
Attributes
-
delay
1
-
install
false
-
install_folder
%AppData%
aes.plain
Signatures
-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
Asyncrat family
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\6306f45ce30c8aa95083bf427f0107b981fd03eec856e6a4e156b3f7fe096174.exe"C:\Users\Admin\AppData\Local\Temp\6306f45ce30c8aa95083bf427f0107b981fd03eec856e6a4e156b3f7fe096174.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
88KB
-
Filesize
9.9MB
-
Filesize
9.9MB
-
Filesize
4KB
-
Filesize
9.9MB