Overview

overview

10

Static

static

8

PROFORMA I...-2.xls

windows7_x64

10

PROFORMA I...-2.xls

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    PROFORMA INVOICE INV-2.xls

  • Size

    66KB

  • Sample

    201026-xktyxcfj9x

  • MD5

    d826d09f1432b2bb0acc619457ef494d

  • SHA1

    04bc30cf1239c71f72f118d0aa784e473200457c

  • SHA256

    2792661e79078e6635f7c57b0d4add154a75bd1f10c9c80b3bf8af81d80fff03

  • SHA512

    c4d60dd90684588a8defa797c6c356fe3cc697772f31329541b2aff35efe5eb84c1b234b25a3c5f7987532ed82df6841789738f185bb9f651966debe1d05616e

Score
10/10
asyncratmacrorat

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

https://tinyurl.com/y3z5vx5a

Extracted

Family

asyncrat

Version

0.5.7B

C2

185.165.153.249:4371

Attributes
  • aes_key

    4lpLfCzV6wCkayaT0MjD3qp2ZVBd759O

  • anti_detection

    false

  • autorun

    false

  • bdos

    false

  • delay

    Default

  • host

    185.165.153.249

  • hwid

    3

  • install_file

  • install_folder

    %AppData%

  • mutex

    AsyncMutex_6SI8OkPnk

  • pastebin_config

    null

  • port

    4371

  • version

    0.5.7B

aes.plain

Targets

    • Target

      PROFORMA INVOICE INV-2.xls

    • Size

      66KB

    • MD5

      d826d09f1432b2bb0acc619457ef494d

    • SHA1

      04bc30cf1239c71f72f118d0aa784e473200457c

    • SHA256

      2792661e79078e6635f7c57b0d4add154a75bd1f10c9c80b3bf8af81d80fff03

    • SHA512

      c4d60dd90684588a8defa797c6c356fe3cc697772f31329541b2aff35efe5eb84c1b234b25a3c5f7987532ed82df6841789738f185bb9f651966debe1d05616e

    Score
    10/10
    ratasyncrat

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers.

      ratasyncrat

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • ServiceHost packer

      Detects ServiceHost packer used for .NET malware

    • Blacklisted process makes network request

    • Executes dropped EXE

    • Loads dropped DLL

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Collection

    Command and Control

      Credential Access

        Defense Evasion

        Discovery

        Execution

          Exfiltration

            Impact

              Initial Access

                Lateral Movement

                  Persistence

                    Privilege Escalation

                      Tasks