Analysis
-
max time kernel
58s -
max time network
45s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
-
submitted
30/03/2025, 19:25
General
-
Target
bb5dc9978dea81984a403ca77932287ebb8f29692064dd4d1b9a4de4177db311.exe
-
Size
60KB
-
MD5
832b74237397c1c0c66889645881fd81
-
SHA1
160655636d08c597561aee907dfa8e9c5fa3bf36
-
SHA256
bb5dc9978dea81984a403ca77932287ebb8f29692064dd4d1b9a4de4177db311
-
SHA512
eed9fd2293d204b0c3ddce92318ad101c838ee7e0fd78c823aa1f65c51ba2323794e4185c165a983adc107192aadb836831c5656f74da0b5a5d85016840fa9aa
-
SSDEEP
1536:jVDVd0eNaJOhfmwPS8zQ00j7t4JDUr12Vbb4gIu+h1wW:jVxd0eNaJOhfmwPS8zQ00GK2Vbb45z
Score
10/10
Malware Config
Extracted
Family
asyncrat
Version
LMTEAM RAT
C2
127.0.0.1:8848
Attributes
-
delay
1
-
install
false
-
install_folder
%AppData%
aes.plain
Signatures
-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
Asyncrat family
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\bb5dc9978dea81984a403ca77932287ebb8f29692064dd4d1b9a4de4177db311.exe"C:\Users\Admin\AppData\Local\Temp\bb5dc9978dea81984a403ca77932287ebb8f29692064dd4d1b9a4de4177db311.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
88KB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
4KB
-
Filesize
7.7MB