Analysis

  • max time kernel
    149s
  • max time network
    136s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16-12-2024 13:29

General

  • Target

    622dedc13f5fe868c33c95bfe8c802d9d7741621c0e8807ceb9f6bd2462eabd4.exe

  • Size

    64KB

  • MD5

    f0ffe0d1d9e72ea6773a5c7a8c5c040c

  • SHA1

    33ef1ee668f2ebd52b6cbe5a0baa0565d0a1458b

  • SHA256

    622dedc13f5fe868c33c95bfe8c802d9d7741621c0e8807ceb9f6bd2462eabd4

  • SHA512

    b4bbd963ff0a34e4f1039bf86c0017556d9163f5523d75134ec51772b5033690570fbf4c22cd7a63b199763418bc8440c9d058eff278f0ff440e518c2f2c9992

  • SSDEEP

    1536:Nq7J63PjxRFvRl9OwZJqbuwmC8DltpqKmY7:NqV6lR/rJqbu12z

Score
10/10

Malware Config

Extracted

Family

asyncrat

Version

1.0.7

Botnet

Default

C2

127.0.0.1:8848

Mutex

DcRatMutex_qwqdanchun

Attributes
  • delay

    1

  • install

    false

  • install_file

    WindowsDefender.exe

  • install_folder

    %AppData%

aes.plain

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

  • Asyncrat family
  • Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\622dedc13f5fe868c33c95bfe8c802d9d7741621c0e8807ceb9f6bd2462eabd4.exe
    "C:\Users\Admin\AppData\Local\Temp\622dedc13f5fe868c33c95bfe8c802d9d7741621c0e8807ceb9f6bd2462eabd4.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:5096

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/5096-0-0x00007FFF703D3000-0x00007FFF703D5000-memory.dmp

    Filesize

    8KB

  • memory/5096-1-0x0000000000C80000-0x0000000000C96000-memory.dmp

    Filesize

    88KB

  • memory/5096-2-0x00007FFF703D0000-0x00007FFF70E91000-memory.dmp

    Filesize

    10.8MB

  • memory/5096-3-0x00007FFF703D3000-0x00007FFF703D5000-memory.dmp

    Filesize

    8KB

  • memory/5096-4-0x00007FFF703D0000-0x00007FFF70E91000-memory.dmp

    Filesize

    10.8MB