Overview

overview

10

Static

static

Curriculo ...).xlsm

windows7_x64

10

Curriculo ...).xlsm

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Curriculo Laura Sperandio (ps).xlsm

  • Size

    23KB

  • Sample

    201224-zwgdeqncge

  • MD5

    dbad290342a0f6cd2554a4d7b06ff400

  • SHA1

    ea9e6a18734a7a389eaa66eace35c84ede9152c3

  • SHA256

    cf0f7d178b74a724d306e95469e7e3a8a8974c69a659a365ab8f1c129a69ec10

  • SHA512

    a26c41a262c375fce4369b51ee19283504e7aeed975416551f193b00313a083a26a034e69bcff59b6719b006e0dfb0ec4fb295ba6426a12a5d901c5c1810dc63

Score
10/10
asyncratpersistencerat

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

https://bitbucket.org/seveca-emilia/onemoreslave/downloads/sz.exe

Targets

    • Target

      Curriculo Laura Sperandio (ps).xlsm

    • Size

      23KB

    • MD5

      dbad290342a0f6cd2554a4d7b06ff400

    • SHA1

      ea9e6a18734a7a389eaa66eace35c84ede9152c3

    • SHA256

      cf0f7d178b74a724d306e95469e7e3a8a8974c69a659a365ab8f1c129a69ec10

    • SHA512

      a26c41a262c375fce4369b51ee19283504e7aeed975416551f193b00313a083a26a034e69bcff59b6719b006e0dfb0ec4fb295ba6426a12a5d901c5c1810dc63

    Score
    10/10
    asyncratpersistencerat

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers.

      ratasyncrat

    • Contains code to disable Windows Defender

      A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Async RAT payload

      rat

    • Blocklisted process makes network request

    • Executes dropped EXE

    • Uses the VBS compiler for execution

    • Adds Run key to start application

      persistence

    • Legitimate hosting services abused for malware hosting/C2

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1
T1064

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Scripting

1
T1064

Modify Registry

2
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Tasks