Analysis
-
max time kernel
108s -
max time network
116s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
07-01-2025 09:22
General
-
Target
93bbb06c0a44ec88a0a44270d83fdd2fb52dfa4e2a20c842d5fa61688c0e7a85N.exe
-
Size
63KB
-
MD5
ca9d6720b591e8dc3ba71e7756fd04b0
-
SHA1
185869dbdbca752c5657884ccf89bf4e22284574
-
SHA256
93bbb06c0a44ec88a0a44270d83fdd2fb52dfa4e2a20c842d5fa61688c0e7a85
-
SHA512
32a9bb2e431f07c4f3c22735b710f4e583ae43af76e036a89e2529a9abfb9f70d6d5706fd7a8d296cbee851cdee5d877468e803664f1200fd6db7d47eb3669e0
-
SSDEEP
1536:zhp5LrUwk4Xq0WdZeeiMl8GbbXwkpGRZVclN:zhp5LrUwk4XqdMeFmGbbXjYzY
Score
10/10
Malware Config
Extracted
Family
asyncrat
Version
1.0.7
Botnet
Default
C2
127.0.0.1:21469
calldc2025.ddns.net:21469
Mutex
DcRatMutex_qwqdanchun
Attributes
-
delay
1
-
install
false
-
install_folder
%AppData%
aes.plain
Signatures
-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
Asyncrat family
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\93bbb06c0a44ec88a0a44270d83fdd2fb52dfa4e2a20c842d5fa61688c0e7a85N.exe"C:\Users\Admin\AppData\Local\Temp\93bbb06c0a44ec88a0a44270d83fdd2fb52dfa4e2a20c842d5fa61688c0e7a85N.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
88KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB