Analysis
-
max time kernel
98s -
max time network
102s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
22-12-2024 19:36
General
-
Target
crss.exe
-
Size
45KB
-
MD5
4a5d7d4186532aa21ac55b4e688450f4
-
SHA1
2066ab4948c8a7a58bc9ae705d01858fb8c60b21
-
SHA256
9184ff2cdd05fcaf111db23123479c845b2ece2fedccc2524b2de592f9980876
-
SHA512
9f7ba044b8f6eb5508e37e527f1052109a56099214caf808d6153daf12db5c0550bbb25b08e77d99be121c34a9a7151479a85d517656d80f41e94a8e08446fda
-
SSDEEP
768:GuskdTsQA/qWU8H+wmo2qsVVllVq6GcPIXzjbhgX3D1shypaOUaT6BDZSx:GuskdTsnb2lV/o6GhX3bOXzWhy1DTkdQ
Malware Config
Extracted
asyncrat
0.5.8
Default
jt8iyre.localto.net:2101
jt8iyre.localto.net:55644
AbAUwI3PK3e3
-
delay
3
-
install
false
-
install_file
winserve.exe
-
install_folder
%AppData%
Signatures
-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
Asyncrat family
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\crss.exe"C:\Users\Admin\AppData\Local\Temp\crss.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
72KB
-
Filesize
7.7MB
-
Filesize
624KB
-
Filesize
5.6MB
-
Filesize
408KB
-
Filesize
4KB
-
Filesize
7.7MB