Analysis
-
max time kernel
94s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
02-01-2025 19:09
General
-
Target
file.exe
-
Size
280KB
-
MD5
76969acc42256771162be6f285de947c
-
SHA1
071c5791d9ca1c2382450c6ef09432e12e8b3ca2
-
SHA256
155854758b79cdee58f7df5c1a4a07d3b19b3d64a0a58b2e8faf6d8b67042f3c
-
SHA512
c6a687236323e2ea70c89f3ad38a80d8be179ebf281ff2b5b39db9f9a3ecab67eb9ec8237df82464566d0c7fa952e5d9dfa171b61a7f1b3abeb4897f54769f52
-
SSDEEP
6144:U5nFOwQLKFIkwMs+OZBH/5kA5wJEGrNTxhd:UJFOZKFIk2ZBf5kA+JE6h
Malware Config
Signatures
-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
Asyncrat family
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Mxscspd_BelphegorShell.exe"C:\Users\Admin\AppData\Local\Temp\Mxscspd_BelphegorShell.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
186KB
MD5412a8bbc3366fec40120821a598ea26f
SHA1171cc5cf93880517ba70b59c3a26fc9b249bc02d
SHA256d918b089c7cce51352c6bcb6c3851fbf420884221bb30254179c55c42929f466
SHA5122890b21770e6c8fd432aec2193462c19229ad9ae9e2e873784720fb40a46ffd927b58258d76d4fa38b3825a76cd2dd24f2179730783ac3fe6da24bcbeaaf8047
-
Filesize
200KB
-
Filesize
8KB
-
Filesize
192KB
-
Filesize
10.8MB
-
Filesize
8KB
-
Filesize
10.8MB
-
Filesize
4KB
-
Filesize
296KB
-
Filesize
7.7MB
-
Filesize
7.7MB