Analysis
-
max time kernel
103s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20250313-en -
resource tags
-
submitted
30/03/2025, 19:06
General
-
Target
80b187c27f68fb888ff43b95b6d36a7a1917c0cfd77ffdde720046ba03f3aca0.exe
-
Size
221KB
-
MD5
a02489a6dbbecb3aeeb04a8b6600e90e
-
SHA1
1818207c4d694214563e298a9fe169c3444d72a0
-
SHA256
80b187c27f68fb888ff43b95b6d36a7a1917c0cfd77ffdde720046ba03f3aca0
-
SHA512
255a1db4b7dee9e1cf1d87799dd80d909559702f7c4880a78af0bf969ca98c4694839e4afb38042a4d9bd2c9d9671b88c5df975078272aff029cd9dc5283760c
-
SSDEEP
3072:SotQOptQrzb1NTRG7ITTmSrwlOeZje7k9/JgaY:dtQWwzbXu/SckeZjvr
Score
10/10
Malware Config
Extracted
Family
asyncrat
Version
1.0.7
Botnet
Default
C2
rat.portal2707070.keenetic.pro:3000
Mutex
DcRatMutex_qwqdanchun
Attributes
-
delay
1
-
install
false
-
install_folder
%AppData%
aes.plain
Signatures
-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
Asyncrat family
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\80b187c27f68fb888ff43b95b6d36a7a1917c0cfd77ffdde720046ba03f3aca0.exe"C:\Users\Admin\AppData\Local\Temp\80b187c27f68fb888ff43b95b6d36a7a1917c0cfd77ffdde720046ba03f3aca0.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
248KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
8KB
-
Filesize
10.8MB
-
Filesize
10.8MB