Analysis
-
max time kernel
146s -
max time network
137s -
platform
windows11-21h2_x64 -
resource
win11-20241007-en -
resource tags
-
submitted
12-01-2025 16:36
General
-
Target
Infected.exe
-
Size
63KB
-
MD5
738180b2bffae37d18f98e73e2f9e48c
-
SHA1
c23dea787e40c8a1dfee943ab6f88b61a6ca92a8
-
SHA256
97308fe3e473c649a7b9232c399e49b5c43ffb37d84fb6c3452d1cf7101f7d36
-
SHA512
6ae13b532f67d3a6a49656d1900af81c68ee6d962dcb4b0edabd2743a4f71b1c931bf7468d0f7a8962b4374c27e1403c0ee723605970cc5481084081278f7887
-
SSDEEP
768:Qv0M2UM/978aQC8A+XjlazcBRL5JTk1+T4KSBGHmDbD/ph0oXsGrD82USu0dpqKX:b1/k/dSJYUbdh9x382Tu0dpqKmY7
Score
10/10
Malware Config
Extracted
Family
asyncrat
Botnet
sro
C2
127.0.0.1:1111
daxon.giize.com:1111
Attributes
-
delay
1
-
install
false
-
install_folder
%AppData%
aes.plain
Signatures
-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
Asyncrat family
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Infected.exe"C:\Users\Admin\AppData\Local\Temp\Infected.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
88KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
8KB
-
Filesize
10.8MB
-
Filesize
10.8MB