Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
14-12-2024 09:07
General
-
Target
svchost.exe
-
Size
63KB
-
MD5
67ca41c73d556cc4cfc67fc5b425bbbd
-
SHA1
ada7f812cd581c493630eca83bf38c0f8b32b186
-
SHA256
23d2e491a8c7f2f7f344764e6879d9566c9a3e55a3788038e48b346c068dde5b
-
SHA512
0dceb6468147cd2497adf31843389a78460ed5abe2c5a13488fc55a2d202ee6ce0271821d3cf12bc1f09a4d6b79a737ea3bccfc2bb87f89b3fff6410fa85ec02
-
SSDEEP
1536:ihbjnR1AioCzmUxIxqFaUm7wPeUJyq8wJGbbUwm/GMNpqKmY7:ihbjnR1AioCzmUxIxwaTwPeUw8GbbUxM
Score
10/10
Malware Config
Extracted
Family
asyncrat
Version
1.0.7
Botnet
Default
C2
51.89.44.68:8848
Mutex
etb3t1tr5n
Attributes
-
delay
1
-
install
true
-
install_file
svchost.exe
-
install_folder
%Temp%
aes.plain
Signatures
-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
Asyncrat family
-
Suspicious use of AdjustPrivilegeToken 21 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\svchost.exe"C:\Users\Admin\AppData\Local\Temp\svchost.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
88KB