Analysis
- max time kernel
149s - max time network
124s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
30/12/2024, 18:24
General
- Target AsyncClient.exe
- Size 47KB
- Sample241230-w11e2sspbr
- SHA256 6bce48fd3cc14863d0383503c4820e3a3b1d3716612bee0891fc54d119d382e3
Malware Config
Extracted
-
asyncrat
-
0.5.8
-
Default
-
127.0.0.1:6606
-
127.0.0.1:7707
-
127.0.0.1:8808
-
127.0.0.1:9003
-
notthesigma-50237.portmap.host:6606
-
notthesigma-50237.portmap.host:7707
-
notthesigma-50237.portmap.host:8808
-
notthesigma-50237.portmap.host:9003
-
oggJOfXbwpIe
-
delay
3
-
install
false
-
install_folder
%AppData%
Signatures
- AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
- Asyncrat family
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\AsyncClient.exe"C:\Users\Admin\AppData\Local\Temp\AsyncClient.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3680-0-0x00000000746EE000-0x00000000746EF000-memory.dmp
memory/3680-1-0x0000000000C20000-0x0000000000C32000-memory.dmp
memory/3680-2-0x00000000746E0000-0x0000000074E90000-memory.dmp
memory/3680-3-0x00000000055A0000-0x0000000005606000-memory.dmp
memory/3680-4-0x0000000005A60000-0x0000000005AFC000-memory.dmp
memory/3680-5-0x00000000746EE000-0x00000000746EF000-memory.dmp
memory/3680-6-0x00000000746E0000-0x0000000074E90000-memory.dmp