Analysis
-
max time kernel
53s -
platform
windows11-21h2_x64 -
resource
win11-20250410-en -
resource tags
-
submitted
20/04/2025, 19:02
General
-
Target
7292279b64796292104cefe4781f67ffad8d0d4e3ffe14cbe1a28e488ac87259.exe
-
Size
66KB
-
MD5
b786d21c0110c9104c21cc7ce09fe3af
-
SHA1
b294ab84cc34292de2dc8475a9e5440416994c13
-
SHA256
7292279b64796292104cefe4781f67ffad8d0d4e3ffe14cbe1a28e488ac87259
-
SHA512
2a75f3be4deca8e4024bbad16381d4c09d271a41e55c00623199c816e39bb4d0a190ddc82c4ccbd4abbf1d9fb0c629303bfff446079e481d02274a581ed8ebe6
-
SSDEEP
1536:cUqg6U0uk+pmYk6+vrqkpml2WqLYlKf/VLb31v7Wfa0wqSKVO0V5Ma+:cUqfU0uk+pmdvbpml2x7fNb38JVO0o7
Malware Config
Extracted
asyncrat
0.5.7B
Default
127.0.0.1:6606
127.0.0.1:7707
127.0.0.1:8808
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
false
-
install_folder
%AppData%
Signatures
-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
Asyncrat family
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7292279b64796292104cefe4781f67ffad8d0d4e3ffe14cbe1a28e488ac87259.exe"C:\Users\Admin\AppData\Local\Temp\7292279b64796292104cefe4781f67ffad8d0d4e3ffe14cbe1a28e488ac87259.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
88KB
-
Filesize
7.7MB
-
Filesize
4KB
-
Filesize
7.7MB