Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
12-12-2024 01:19
General
-
Target
c66fdb0e04d7bee6ac4513956d1cf5f9fc21e27cad0d32bbc7906ff4440ed2e9.exe
-
Size
47KB
-
MD5
54af7dde5c98e20089ae4a5dc295cb32
-
SHA1
d7affca6008365f9e8c48ed22847f98d97781738
-
SHA256
c66fdb0e04d7bee6ac4513956d1cf5f9fc21e27cad0d32bbc7906ff4440ed2e9
-
SHA512
c2fa8350cdaa1ba19da3bea5c6ef2a90b6cce3f6a9618483cebaf83c4ed47a1dd90aa5a4708ee31fe35a13ef991aa4d66fa3858497bda3d61a8ba1d5c9a52352
-
SSDEEP
768:xGq+s3pUtDILNCCa+Di+0jd3gLqRp8AoPiIiYbrge4k6kNaioVFIJ5vEgK/JLZVS:8q+AGtQO+GaPAKBbUkN8C5nkJLZVclN
Score
10/10
Malware Config
Extracted
Family
asyncrat
Version
1.0.7
Botnet
Server
C2
dcrsf.duckdns.org:5999
Mutex
DcRatMutex_qwqdanchun
Attributes
-
delay
1
-
install
false
-
install_folder
%AppData%
aes.plain
Signatures
-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
Asyncrat family
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c66fdb0e04d7bee6ac4513956d1cf5f9fc21e27cad0d32bbc7906ff4440ed2e9.exe"C:\Users\Admin\AppData\Local\Temp\c66fdb0e04d7bee6ac4513956d1cf5f9fc21e27cad0d32bbc7906ff4440ed2e9.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
72KB
-
Filesize
10.8MB
-
Filesize
8KB
-
Filesize
10.8MB