Analysis
-
max time kernel
33s -
max time network
38s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
-
submitted
19/04/2025, 19:43
General
-
Target
e9cfbad62b47ef90ebf4634ae39693f335c74078b05ef575017c6e6d191aed98.exe
-
Size
62KB
-
MD5
f46329550b0c532f6a6253a2f8faecaa
-
SHA1
24036515b0f5266662a7378da701c193c05573e3
-
SHA256
e9cfbad62b47ef90ebf4634ae39693f335c74078b05ef575017c6e6d191aed98
-
SHA512
44df552e12f4b0cc50ea4311222ba8aa6d88aa801414b97827dbcce2c5b2352b6834da545a6e3348afdf012ae83967a8352118d0a2495e73152376ed07f79010
-
SSDEEP
1536:i5gfnNsYMnl70qDzMRphC8dTGbbewBGTkpqKmY7k:i5gfnNsYMnl7XzWfC81Gbbepvz3
Score
10/10
Malware Config
Extracted
Family
asyncrat
Version
0.0.1
Botnet
Default
C2
127.0.0.1:8848
127.0.0.1:31880
111.180.190.199:8848
111.180.190.199:31880
Mutex
DcRatMutex_qwqdanchun
Attributes
-
delay
1
-
install
true
-
install_file
msedgewebview2.exe
-
install_folder
%AppData%
aes.plain
Signatures
-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
Asyncrat family
-
Suspicious use of AdjustPrivilegeToken 21 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e9cfbad62b47ef90ebf4634ae39693f335c74078b05ef575017c6e6d191aed98.exe"C:\Users\Admin\AppData\Local\Temp\e9cfbad62b47ef90ebf4634ae39693f335c74078b05ef575017c6e6d191aed98.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
80KB
-
Filesize
8KB
-
Filesize
10.8MB
-
Filesize
10.8MB