Analysis
-
max time kernel
93s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
23-12-2024 20:37
General
-
Target
c73b1ffa39c5843b2ed951ac48350d1deb33db4057341f1dab1ee64ea1a62248.exe
-
Size
12.3MB
-
MD5
7fce411ea2b74f227489659113960b18
-
SHA1
543d95b74193a188fe273ce7b065aa177405beb5
-
SHA256
c73b1ffa39c5843b2ed951ac48350d1deb33db4057341f1dab1ee64ea1a62248
-
SHA512
42de7bc4a0b47e1053ff3ff52a3f887e56759f81cfa691996a533d769e80f98b3e8dcf869785fce801d9cc7a2bc3d675e2eb832b520846b053d6b07093be2678
-
SSDEEP
196608:XtfZFB2gaNIsNNNNKmvN8rNNNNNNNNNNHbL7aIXM1B7Z0/3G6tULs8wR:XlT81Bd+3G6
Score
10/10
Malware Config
Signatures
-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
Asyncrat family
-
Suspicious behavior: EnumeratesProcesses 25 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SendNotifyMessage 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c73b1ffa39c5843b2ed951ac48350d1deb33db4057341f1dab1ee64ea1a62248.exe"C:\Users\Admin\AppData\Local\Temp\c73b1ffa39c5843b2ed951ac48350d1deb33db4057341f1dab1ee64ea1a62248.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
12.3MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
1.7MB
-
Filesize
10.8MB