Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
04-12-2024 23:49
General
-
Target
17333560867dc8da0185786b137d3fcabfa4b8f2e8a66a20f4fa5778c110e32f585c627974749.dat-decoded.exe
-
Size
47KB
-
MD5
c5840cbfd14db2b53fc596cad0eeea6f
-
SHA1
345ad3f0849d6ad6b0f1d1fbcd91c3793fcfd7aa
-
SHA256
6181c4a677fd9fc0bd604c357d49f2058fb494013a0d57dba65027e1c87d0bac
-
SHA512
dde81380a6e0e8de021f1685faebf0a8e8a5e4414268caabd2d3c5818f00178390d42715edfbbd973c06e5cc5c8d8a5f6453de818cc21f37ec0ce5f24df6b3f6
-
SSDEEP
768:4q+s3pUtDILNCCa+DiptelDSN+iV08YbygejZuIKDnV467vEgK/JvZVc6KN:4q+AGtQOptKDs4zb1ksT7nkJvZVclN
Score
10/10
Malware Config
Extracted
Family
asyncrat
Version
1.0.7
Botnet
Default
C2
dcsosrat.duckdns.org:2020
Mutex
DcRatMutex_qwqdanchun
Attributes
-
delay
1
-
install
false
-
install_folder
%AppData%
aes.plain
Signatures
-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
Asyncrat family
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\17333560867dc8da0185786b137d3fcabfa4b8f2e8a66a20f4fa5778c110e32f585c627974749.dat-decoded.exe"C:\Users\Admin\AppData\Local\Temp\17333560867dc8da0185786b137d3fcabfa4b8f2e8a66a20f4fa5778c110e32f585c627974749.dat-decoded.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
72KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB