Analysis
-
max time kernel
144s -
max time network
151s -
platform
windows11-21h2_x64 -
resource
win11-20241007-en -
resource tags
-
submitted
28-11-2024 17:57
General
-
Target
Bitcoin-Address-Utility-main/Bitcoin-Address-Utility-main/bitcoin address utility/bitcoinaddresutility.config.exe
-
Size
224KB
-
MD5
790076ebdb5da5c4b73bdffbd71ba57e
-
SHA1
a4e0a4aafe30d3035bacda771587bb268d82c671
-
SHA256
3f18dfdc6a76b0a69097611b9756070ffae79fcc8dc462df2592ef25b415335e
-
SHA512
f850b38877f8d9c3285a66f4d69a105b5148e65b59b43d1de34e95ba0b03ac1f6e909401adb5b2493d03e832ff3f01205e3b598d3fc9c687ce38b8f720288421
-
SSDEEP
3072:Ru3ZTd4+2nlm0wybQ73JHiq1gXyO/8ucsE92VJZ/x:Ru3QLn1wybyHikgXy5b8VJX
Malware Config
Extracted
asyncrat
0.5.8
Default
192.168.101.7:6606
192.168.101.7:7707
192.168.101.7:8808
192.168.101.7:1111
192.168.101.7:2222
192.168.101.7:3333
192.168.101.7:4444
192.168.101.7:5555
192.168.101.7:6666
192.168.101.7:7777
192.168.101.7:8888
192.168.101.7:9999
H6EV9c34IZEW
-
delay
3
-
install
false
-
install_folder
%AppData%
Signatures
-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
Asyncrat family
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Bitcoin-Address-Utility-main\Bitcoin-Address-Utility-main\bitcoin address utility\bitcoinaddresutility.config.exe"C:\Users\Admin\AppData\Local\Temp\Bitcoin-Address-Utility-main\Bitcoin-Address-Utility-main\bitcoin address utility\bitcoinaddresutility.config.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
248KB
-
Filesize
7.7MB
-
Filesize
408KB
-
Filesize
624KB
-
Filesize
4KB
-
Filesize
7.7MB