Analysis

  • max time kernel
    143s
  • max time network
    145s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    29/01/2025, 14:50

General

  • Target

    AsyncClien2222.exe

  • Size

    45KB

  • MD5

    989ae12ba13de5cef904e2f0a6f30419

  • SHA1

    4e8b7ee1b2e897aca67116be0ca07b71a9378890

  • SHA256

    a9527621f11189098350b93301097ec3cb1ea6fe79081e52bfd082fec340cb8f

  • SHA512

    f5479c9cb2491714c0b56414eabf933428c857a285dda0622dc9c792915a1f3a89c8dbc6a857b960d4d11a713452933fc554eb84a3141988581e0e57c1c203ad

  • SSDEEP

    768:5uPzZT9xSjiWUU22jmo2qr9LNSeIIyPIWzjbvgX3i19mghrc9dBDZLx:5uPzZT9kD2y8qW3bYXSbmg9c9zdLx

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

C2

127.0.0.1:6606

127.0.0.1:7707

127.0.0.1:8808

127.0.0.1:30058

127.0.0.1:22

155.553.112:6606

155.553.112:7707

155.553.112:8808

155.553.112:30058

155.553.112:22

83.168.69.7:6606

83.168.69.7:7707

83.168.69.7:8808

83.168.69.7:30058

83.168.69.7:22

141.144.239.133:6606

141.144.239.133:7707

141.144.239.133:8808

141.144.239.133:30058

141.144.239.133:22

Mutex

s5idDraqoH9C

Attributes
  • delay

    3

  • install

    false

  • install_folder

    %AppData%

aes.plain

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

  • Asyncrat family
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\AsyncClien2222.exe
    "C:\Users\Admin\AppData\Local\Temp\AsyncClien2222.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    PID:2780

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2780-0-0x00000000744CE000-0x00000000744CF000-memory.dmp

    Filesize

    4KB

  • memory/2780-1-0x0000000000AD0000-0x0000000000AE2000-memory.dmp

    Filesize

    72KB

  • memory/2780-2-0x00000000744C0000-0x0000000074BAE000-memory.dmp

    Filesize

    6.9MB

  • memory/2780-3-0x00000000744CE000-0x00000000744CF000-memory.dmp

    Filesize

    4KB

  • memory/2780-4-0x00000000744C0000-0x0000000074BAE000-memory.dmp

    Filesize

    6.9MB