Analysis
- max time kernel
136s - max time network
151s - platform
windows7_x64 - resource
win7-20241010-en - resource tags
- submitted
17/12/2024, 05:14
General
- Target eb3be957f0a8e1f2fd544608a90b4c4a5b22f34c6e5ae5bc0342d35de0701a14.exe
- Size 47KB
- Sample241217-fxagfsspdr
- SHA256 eb3be957f0a8e1f2fd544608a90b4c4a5b22f34c6e5ae5bc0342d35de0701a14
Score
10/10
Malware Config
Extracted
Family
-
asyncrat
Version
-
0.5.8
Botnet
-
Default
C2
-
stuff-data.gl.at.ply.gg:54296
Mutex
-
u81wDUVoFHib
Attributes
-
delay
3
-
install
false
-
install_folder
%AppData%
aes.plain
Signatures
- AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
- Asyncrat family
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes
-
C:\Users\Admin\AppData\Local\Temp\eb3be957f0a8e1f2fd544608a90b4c4a5b22f34c6e5ae5bc0342d35de0701a14.exe"C:\Users\Admin\AppData\Local\Temp\eb3be957f0a8e1f2fd544608a90b4c4a5b22f34c6e5ae5bc0342d35de0701a14.exe"1⤵
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3036-0-0x0000000074ACE000-0x0000000074ACF000-memory.dmp
memory/3036-1-0x00000000011B0000-0x00000000011C2000-memory.dmp
memory/3036-2-0x0000000074AC0000-0x00000000751AE000-memory.dmp
memory/3036-3-0x0000000074ACE000-0x0000000074ACF000-memory.dmp
memory/3036-4-0x0000000074AC0000-0x00000000751AE000-memory.dmp