Analysis
-
max time kernel
146s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
29/03/2025, 19:51
General
-
Target
bf270f997e52702a802660c3497f80e147c7810569fa0133cec7a9f87a24d065.exe
-
Size
113KB
-
MD5
0897ab28be19bd34525a93321a8b19e0
-
SHA1
b7f9c1921e200f31d957f80c88e77ef6181fe885
-
SHA256
bf270f997e52702a802660c3497f80e147c7810569fa0133cec7a9f87a24d065
-
SHA512
a8d6a89e0abe52953d9f3b7d0408dd27aff29ba3932c57a5dc2d0635f7984c3fb05a5a120d6c21d5b0b2a03899a648122eaf48cf726b7b27d15b7566089904e5
-
SSDEEP
768:WHy8akZihTUYWFmEEBB9gVV8H5PAxExogHKhacFIS++qaje/W3PENsn4FOBkStBw:WHy8aOtmdmqH2WVqhacFngW/3g0YmF+
Malware Config
Extracted
asyncrat
false
Default
MznA1nJ9Lu6K
-
delay
3
-
install
false
-
install_file
hamid.exe
-
install_folder
%AppData%
Signatures
-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
Asyncrat family
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\bf270f997e52702a802660c3497f80e147c7810569fa0133cec7a9f87a24d065.exe"C:\Users\Admin\AppData\Local\Temp\bf270f997e52702a802660c3497f80e147c7810569fa0133cec7a9f87a24d065.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
136KB
-
Filesize
6.9MB
-
Filesize
4KB
-
Filesize
6.9MB