Analysis
-
max time kernel
134s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
13-12-2024 10:38
General
-
Target
Sync.exe
-
Size
45KB
-
MD5
4d5a086a9634eb694ec941e898fdc3ce
-
SHA1
3b4ce31fcc765f313c95c6844ae206997dc6702b
-
SHA256
149990fa6abd66bd9771383560a23894c70696aaeb3b2304768212be1be8f764
-
SHA512
16546b2d4f361ff0a32ef8314989e28f06bb2ec6b31276031bd7dec4c67ce30e97befb72e962d927cffb57fe283a8de7fa049725f488b3918968c011f9487468
-
SSDEEP
768:GuLN+TwQhclWUlNzWmo2qDQ9fqIpePIhzjblgX3ip99oJDqUwABDZmx:GuLN+Twip2Hpvnh3biXSp9uEUVdmx
Score
10/10
Malware Config
Extracted
Family
asyncrat
Version
0.5.8
Botnet
Default
C2
172.204.136.22:1604
Mutex
ghbyTnUySCmF
Attributes
-
delay
3
-
install
false
-
install_file
RoyalKing.exe
-
install_folder
%AppData%
aes.plain
Signatures
-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
Asyncrat family
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Sync.exe"C:\Users\Admin\AppData\Local\Temp\Sync.exe"1⤵
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
72KB
-
Filesize
6.9MB
-
Filesize
4KB
-
Filesize
6.9MB