asyncrat | 852a008d3c6ce0c868ebc9e48cce189afb4abee4609dc1f3c05256adc212d865

Analysis

max time kernel
134s
max time network
144s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
24-12-2024 07:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

852a008d3c6ce0c868ebc9e48cce189afb4abee4609dc1f3c05256adc212d865_Sigmanly.exe
Size

4.5MB
MD5

f32e537683d968304ca7c5be6a0a22c8
SHA1

535583ce14bc0ecc2c2f46344ff1c3cc76740211
SHA256

852a008d3c6ce0c868ebc9e48cce189afb4abee4609dc1f3c05256adc212d865
SHA512

2cc24cb737796953f99e407adb7eabd5f915ec40962b6fedd26ba4c7b4ac40c581932c4c7ef0ec8dc69e0967399153fb8514f98d84bb799a7e841515354b7eac
SSDEEP

49152:idMZdRuGZ2OY7SzJLJz6QijzJfLU5CBAWw:idOdRu6tOcJB6RlL2CBA

Score

10^/10

asyncrat default discovery rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

104.236.39.42:6606

104.236.39.42:7707

104.236.39.42:8808

Mutex

NLzwJdZ9VJQw

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Asyncrat family
asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral1/memory/2236-2-0x0000000000820000-0x0000000000832000-memory.dmp	family_asyncrat

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	852a008d3c6ce0c868ebc9e48cce189afb4abee4609dc1f3c05256adc212d865_Sigmanly.exe

C:\Users\Admin\AppData\Local\Temp\852a008d3c6ce0c868ebc9e48cce189afb4abee4609dc1f3c05256adc212d865_Sigmanly.exe
"C:\Users\Admin\AppData\Local\Temp\852a008d3c6ce0c868ebc9e48cce189afb4abee4609dc1f3c05256adc212d865_Sigmanly.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2236

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2236-0-0x0000000000280000-0x00000000006FE480-memory.dmp

Filesize
4.5MB

Download
memory/2236-1-0x0000000073D0E000-0x0000000073D0F000-memory.dmp

Filesize
4KB

Download
memory/2236-2-0x0000000000820000-0x0000000000832000-memory.dmp

Filesize
72KB

Download
memory/2236-3-0x0000000073D00000-0x00000000743EE000-memory.dmp

Filesize
6.9MB

Download
memory/2236-4-0x0000000000280000-0x00000000006FE480-memory.dmp

Filesize
4.5MB

Download
memory/2236-5-0x0000000073D0E000-0x0000000073D0F000-memory.dmp

Filesize
4KB

Download
memory/2236-6-0x0000000073D00000-0x00000000743EE000-memory.dmp

Filesize
6.9MB

Download