Zakaz na pokupku 21-10-2021.doc

General
Target

Zakaz na pokupku 21-10-2021.doc

Size

4KB

Sample

211021-wkp95sbeap

Score
10 /10
MD5

e205f10f887754bd65281f14c25c0f21

SHA1

b356aab56ba5eb993326e4ede7e254e7181aa165

SHA256

5d77fcbee204c6b9fea6ec4bda5216714e2e46f4247f673956e64e36a9c3424d

SHA512

cd43d1cb4193ef5aa4f77a290e186a4e87d55f42a61b502cbc2beeb2044613855e82553effca9f6bcda5cd4174c8c0ce6989774530c3b68c7a612ba26c2ef0a2

Malware Config

Extracted

Family asyncrat
Version 0.5.7B
Botnet 1
C2

185.157.160.136:1973

Attributes
anti_vm
false
bsod
false
delay
38
install
false
install_folder
%AppData%
pastebin_config
null
aes.plain
Targets
Target

Zakaz na pokupku 21-10-2021.doc

MD5

e205f10f887754bd65281f14c25c0f21

Filesize

4KB

Score
10/10
SHA1

b356aab56ba5eb993326e4ede7e254e7181aa165

SHA256

5d77fcbee204c6b9fea6ec4bda5216714e2e46f4247f673956e64e36a9c3424d

SHA512

cd43d1cb4193ef5aa4f77a290e186a4e87d55f42a61b502cbc2beeb2044613855e82553effca9f6bcda5cd4174c8c0ce6989774530c3b68c7a612ba26c2ef0a2

Tags

Signatures

  • AsyncRat

    Description

    AsyncRAT is designed to remotely monitor and control other computers.

    Tags

  • BitRAT

    Description

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

    Tags

  • BitRAT Payload

  • Async RAT payload

    Tags

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    Tags

    TTPs

    Registry Run Keys / Startup FolderModify Registry
  • Drops file in System32 directory

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

Related Tasks

MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
        Exfiltration
          Impact
            Initial Access
              Lateral Movement
                Privilege Escalation
                  Tasks

                  static1

                  behavioral2

                  1/10