Analysis
-
max time kernel
44s -
max time network
48s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
-
submitted
01-07-2024 01:30
Errors
Reason
Machine shutdown
General
-
Target
Borat/BoratRat.exe
-
Size
20.0MB
-
MD5
65b694d69d327efe28fcbce125401e96
-
SHA1
049d4d71742b99a598c074458f1f2d5b0119e912
-
SHA256
de60ecbbfef30c93fe8875ef69b358b20076d1f969fc3d21ab44d59dc9ef7cab
-
SHA512
7ab57642e414e134e851d9aa2ed3ef8b483f3a5f77877cdc04e08d7f95c44884f8ccc6beaf8ba7f6949cfd7398c46be46c024d4fdeacd3a332d4565609baad5b
-
SSDEEP
393216:V+G+oTCP+Zw6NLIsFfskh1BmXGnfBd+Uw:IGpTCP+Zlnk0rmkBYUw
Score
10/10
Malware Config
Signatures
-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
Suspicious behavior: EnumeratesProcesses 10 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of FindShellTrayWindow 3 IoCs
-
Suspicious use of SendNotifyMessage 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Borat\BoratRat.exe"C:\Users\Admin\AppData\Local\Temp\Borat\BoratRat.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 352 -s 16202⤵
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x01⤵
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x11⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/352-0-0x000007FEF5653000-0x000007FEF5654000-memory.dmpFilesize
4KB
-
memory/352-1-0x00000000008A0000-0x0000000001CAA000-memory.dmpFilesize
20.0MB
-
memory/352-2-0x000007FEF5650000-0x000007FEF603C000-memory.dmpFilesize
9.9MB
-
memory/352-3-0x000007FEF5650000-0x000007FEF603C000-memory.dmpFilesize
9.9MB
-
memory/352-6-0x000007FEF5650000-0x000007FEF603C000-memory.dmpFilesize
9.9MB
-
memory/352-9-0x000007FEF5653000-0x000007FEF5654000-memory.dmpFilesize
4KB
-
memory/352-10-0x000007FEF5650000-0x000007FEF603C000-memory.dmpFilesize
9.9MB
-
memory/352-11-0x000007FEF5650000-0x000007FEF603C000-memory.dmpFilesize
9.9MB
-
memory/352-12-0x000007FEF5650000-0x000007FEF603C000-memory.dmpFilesize
9.9MB
-
memory/3048-13-0x0000000002F90000-0x0000000002F91000-memory.dmpFilesize
4KB