Overview

overview

10

Static

static

10

04C164391E...15.exe

windows7_x64

10

04C164391E...15.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    04C164391EFCEDD93B5C04DC137E8B80336265246FA15.exe

  • Size

    770KB

  • Sample

    210911-ht553abbb7

  • MD5

    2f087c02e5a65fc3a150ba96ddde8a0f

  • SHA1

    d8b02d1cd0d582b93866ea2e2da10cb148828566

  • SHA256

    04c164391efcedd93b5c04dc137e8b80336265246fa15318a67d4b2d20bf257f

  • SHA512

    86b078abb4270864802f0056c5657c82c2f375472d821fd888aa0252c10e270cba8beb5bc5063236d7c1192ccf573d7df7dec83ddf753638e96aa6d06f5c0edd

Score
10/10
asyncratdarkcometdefaultsazanpersistenceratspywarestealertrojan

Malware Config

Extracted

Family

darkcomet

Botnet

Sazan

C2

marbeyli.duckdns.org:1604

Mutex

DC_MUTEX-D2KTVT9

Attributes
  • InstallPath

    MSDCSC\svchost.exe

  • gencode

    iGJFx2jaJsy3

  • install

    true

  • offline_keylogger

    true

  • persistence

    false

  • reg_key

    MicroUpdate

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

Default

C2

marbeyli.duckdns.org:6606

Mutex

AsyncMutex_6SI8OkPnk

Attributes
  • anti_vm

    false

  • bsod

    false

  • delay

    3

  • install

    true

  • install_file

    svchost.exe

  • install_folder

    %AppData%

  • pastebin_config

    null

aes.plain

Targets

    • Target

      04C164391EFCEDD93B5C04DC137E8B80336265246FA15.exe

    • Size

      770KB

    • MD5

      2f087c02e5a65fc3a150ba96ddde8a0f

    • SHA1

      d8b02d1cd0d582b93866ea2e2da10cb148828566

    • SHA256

      04c164391efcedd93b5c04dc137e8b80336265246fa15318a67d4b2d20bf257f

    • SHA512

      86b078abb4270864802f0056c5657c82c2f375472d821fd888aa0252c10e270cba8beb5bc5063236d7c1192ccf573d7df7dec83ddf753638e96aa6d06f5c0edd

    Score
    10/10
    asyncratdarkcometdefaultsazanpersistenceratspywarestealertrojan

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers.

      ratasyncrat

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Modifies WinLogon for persistence

      persistence

    • Modifies system executable filetype association

      persistence

    • Async RAT payload

      rat

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Winlogon Helper DLL

1
T1004

Change Default File Association

1
T1042

Registry Run Keys / Startup Folder

1
T1060

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Modify Registry

3
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks