Analysis
-
max time kernel
134s -
max time network
150s -
platform
windows10-ltsc 2021_x64 -
resource
win10ltsc2021-20241211-en -
resource tags
-
submitted
13-01-2025 10:29
General
-
Target
payload_unpacked.exe
-
Size
45KB
-
MD5
576b5aa29eb38f7df2135d8a60457ebb
-
SHA1
880981827719bf11576305519ba125d15d61c547
-
SHA256
724181e6193f53f82123eb1c906332db51e44a8099bf61d1446b6bdee159aaea
-
SHA512
03782e147324b6f3c0e3f6184a4a14ebecc4fc1c532d3a5f03a79b54b910c32b203d105b263bbeccef224aa23c867652ae2db399fc99aef70e07bc249513a2ea
-
SSDEEP
768:Nu2/0TckJ26WUsFvgmo2q7MKjPGaG6PIyzjbFgX3iRGkP9Fte0BDZOx:Nu2/0TceH2ZKTkDy3bCXSl9FttdOx
Malware Config
Extracted
asyncrat
0.5.8
Default
87.121.105.252:6606
87.121.105.252:7707
87.121.105.252:8808
Lkjt7XvNWr95
-
delay
3
-
install
false
-
install_file
ubase_hr.exe
-
install_folder
%AppData%
Signatures
-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
Asyncrat family
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes
-
C:\Users\Admin\AppData\Local\Temp\payload_unpacked.exe"C:\Users\Admin\AppData\Local\Temp\payload_unpacked.exe"1⤵
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
72KB
-
Filesize
7.7MB
-
Filesize
4KB
-
Filesize
7.7MB