Analysis
-
max time kernel
54s -
max time network
42s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
-
submitted
30/03/2025, 19:21
General
-
Target
6cfbf1c691150566b43fa1b9bb097ab2fe8b49af365355e8256320de3a105812.exe
-
Size
52KB
-
MD5
a387dede5d1339c11671b36f96d46be7
-
SHA1
00327a5550301e066da8319245db3368dcef908d
-
SHA256
6cfbf1c691150566b43fa1b9bb097ab2fe8b49af365355e8256320de3a105812
-
SHA512
a8eaa84292244b2db2dcaf62170cbb4fd6bdf8a39bec059a0d17f92c61765878c15859aadc54e3208505dcaf450c78091f7e7b5bf3db57ce15903649d3aae9b1
-
SSDEEP
1536:vu/dRTUPE2ggZsk6Fi38HdtbF5gbnudzx:vu/DTUPE2gMskR38HdtbFkuNx
Malware Config
Extracted
asyncrat
0.5.8
Default
127.0.0.1:6606
127.0.0.1:7707
127.0.0.1:8808
rFcovhcp50Pu
-
delay
3
-
install
false
-
install_folder
%AppData%
Signatures
-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
Asyncrat family
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\6cfbf1c691150566b43fa1b9bb097ab2fe8b49af365355e8256320de3a105812.exe"C:\Users\Admin\AppData\Local\Temp\6cfbf1c691150566b43fa1b9bb097ab2fe8b49af365355e8256320de3a105812.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
72KB
-
Filesize
7.7MB
-
Filesize
408KB
-
Filesize
624KB
-
Filesize
4KB
-
Filesize
7.7MB