Analysis
-
max time kernel
549s -
max time network
559s -
platform
windows11-21h2_x64 -
resource
win11-20241007-en -
resource tags
-
submitted
27/01/2025, 23:55
General
-
Target
Client.exe
-
Size
47KB
-
MD5
d5c9a99faec2ef972d47aa0a15cb4388
-
SHA1
8832d330806ca587fd9d0da341a530080ff98277
-
SHA256
ae3f87d64dc6c41c9a80287a3d58769b72730402d24e7389f1cdb8b836ebeae9
-
SHA512
83c2524d2947dbcd979d7d3e0b1b1b8b6d043668e8d88785bddaa3daab8263c82dbd62dbbd9c3a4ba9a9f72b03b8186ffbc7c5237dfc021eb9874070b074ba60
-
SSDEEP
768:p9umxLiIL1CaS+DiMtelDSN+iV08YbygekUHuZtbIr/IvEgK/JnZVc6KN:p9uAPWMtKDs4zb1lUuZta/InkJnZVclN
Malware Config
Extracted
asyncrat
1.0.7
Default
127.0.0.1:8848
127.0.0.1:8085
127.0.0.1:65366
record-lopez.gl.at.ply.gg:8848
record-lopez.gl.at.ply.gg:8085
record-lopez.gl.at.ply.gg:65366
DcRatMutex_qwqdanchun
-
delay
1
-
install
false
-
install_folder
%AppData%
Signatures
-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
Asyncrat family
-
Contains code to disable Windows Defender 1 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
-
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
-
Modifies Control Panel 2 IoCs
-
Modifies registry class 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Client.exe"C:\Users\Admin\AppData\Local\Temp\Client.exe"1⤵
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
10KB
MD5b66799d715b113faf28da5aaba5528ef
SHA11b20576808d17c24f7abf2c49a7facfbc1480da4
SHA256bb7ed85e7a1833e5a31d62882937ee6b094f2421b9d1c8d9b6e64b9845b29868
SHA51293d4708a2f4bb3ca7b5bcb0f3dc13eb5e93bfa5e485845822d67770e4c0217797f330ab9395598b1d7452cc8191e4d3848a1b268a6cd1b7a5001266ce53794d6
-
Filesize
10KB
MD577a8b2c86dd26c214bc11c989789b62d
SHA18b0f2d9d0ded2d7f9bff8aed6aefd6b3fdd1a499
SHA256e288c02cbba393c9703519e660bf8709331f11978c6d994ea2a1346eef462cb8
SHA512c287e3ae580343c43a5354347ca5444f54840fba127a2b1edc897b1dfea286fa37b5808f6e89f535c4022db8b3f29448aa4cc2f41ab0f308eec525a99fac4e5e
-
Filesize
1.1MB
MD5daa756fda35cedf3d0f1318cb43edab6
SHA14ba5c772c6d096b4ce2a2146ae90b1aa5017dbca
SHA256435d73ec39ef37851b96b0d896cff604abaec7abb8a03a61c8f698c9e2ad71e9
SHA51286f2326f5e63b10ffd1d30d347d370f02009f8bba9f517b4b21cdfc8e68c253d34921d097682b7cea1ad4cb439fc7fa9cfad815c2b4873486d00069009e89514
-
Filesize
10.8MB
-
Filesize
8KB
-
Filesize
416KB
-
Filesize
472KB
-
Filesize
120KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
8KB
-
Filesize
10.8MB
-
Filesize
56KB
-
Filesize
72KB
-
Filesize
56KB
