Analysis

  • max time kernel
    13s
  • max time network
    11s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01-12-2024 13:10

General

  • Target

    Infected.exe

  • Size

    63KB

  • MD5

    d891c2d2635756caee63dacb489ee7a0

  • SHA1

    b594500c90b06ec765be2df4ab964fc338372027

  • SHA256

    1ffe2f5444253eebef0db7fb1318db03c35ba423165cda5868d85dd0078a1455

  • SHA512

    0d6a357e681e645dd3779cc494e85fab479bd20b04ef2c57d656b74a6fffc6cd65c14f23d6dc06fe45f72c43712cd2f4d8b6f1f39f1da63472d3412ff67ca1ba

  • SSDEEP

    1536:rvCCPTDdSJYUbdh9qRe4YCBuEdpqKmY7:rvvDYYUbd54XGz

Score
10/10

Malware Config

Extracted

Family

asyncrat

Botnet

Default

C2

127.0.0.1:3232

Attributes
  • delay

    1

  • install

    false

  • install_folder

    %AppData%

aes.plain

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

  • Asyncrat family
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Infected.exe
    "C:\Users\Admin\AppData\Local\Temp\Infected.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:1392

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1392-0-0x00007FF888093000-0x00007FF888095000-memory.dmp

    Filesize

    8KB

  • memory/1392-1-0x0000000000090000-0x00000000000A6000-memory.dmp

    Filesize

    88KB

  • memory/1392-2-0x00007FF888090000-0x00007FF888B51000-memory.dmp

    Filesize

    10.8MB

  • memory/1392-3-0x00007FF888093000-0x00007FF888095000-memory.dmp

    Filesize

    8KB

  • memory/1392-4-0x00007FF888090000-0x00007FF888B51000-memory.dmp

    Filesize

    10.8MB