Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
07-12-2024 02:23
General
-
Target
clientbutbetter.exe
-
Size
63KB
-
MD5
8b97b7477309686d0b44b0b921107010
-
SHA1
aa7dd03ddd58375a95f95f22a15c1bc09cfa3263
-
SHA256
39c1512455d57f746149d51e8b788a4a6236aebbce3c238c633e33a5d9811478
-
SHA512
f8f7c4826f5df746097520e9d4b0635456a4302c41848310ea7ebe06dcea4d7cf3ac997d7ac523f8b220b1768a123c5bd1a29d214bc5816643d662244275c352
-
SSDEEP
1536:5BoL3ZEAUoFNuXfFQcZIW6uGbbowaGpZVclN:5BoL3ZEAUoF4fFQKbdGbboKzY
Score
10/10
Malware Config
Extracted
Family
asyncrat
Version
1.0.7
Botnet
Default
C2
Binky812-59707.portmap.host:8848
Binky812-59707.portmap.host:59707
Mutex
DcRatMutex_qwqdanchun
Attributes
-
delay
1
-
install
false
-
install_file
MinecraftUpdater.exe
-
install_folder
%AppData%
aes.plain
Signatures
-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
Asyncrat family
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\clientbutbetter.exe"C:\Users\Admin\AppData\Local\Temp\clientbutbetter.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
88KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
8KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
472KB
-
Filesize
120KB