Overview

overview

10

Static

static

1698db1832...6f.exe

windows7_x64

10

1698db1832...6f.exe

windows10-2004_x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1698db183216accc635a1495991ba96f.exe

  • Size

    500KB

  • Sample

    220120-y8ejnabee4

  • MD5

    1698db183216accc635a1495991ba96f

  • SHA1

    ea0332707c2e008dacd1023fcc201850f972f387

  • SHA256

    74d6ce17a5ef1abd3c1c2bf8b9cc472bc8f3816299a06498cc7266c8f479beae

  • SHA512

    3bb9e69ad94fb083530b91b24c20c2ae45e5d41333a305c3e43cbcabc44ef92232509501ad915cd5a77bc06940f5a2ad8e5f6da45b13c379392823429ff04687

Score
10/10
asyncratdigipersistencerat

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

digi

C2

deli.mywire.org:6606

deli.mywire.org:7707

deli.mywire.org:8808

kingspy.mywire.org:6606

kingspy.mywire.org:7707

kingspy.mywire.org:8808

kraldeli.linkpc.net:6606

kraldeli.linkpc.net:7707

kraldeli.linkpc.net:8808
Mutex

AsyncMutex_6SI8OkPnk

Attributes
  • anti_vm

    false

  • bsod

    false

  • delay

    3

  • install

    false

  • install_folder

    %AppData%

  • pastebin_config

    null

aes.plain

Targets

    • Target

      1698db183216accc635a1495991ba96f.exe

    • Size

      500KB

    • MD5

      1698db183216accc635a1495991ba96f

    • SHA1

      ea0332707c2e008dacd1023fcc201850f972f387

    • SHA256

      74d6ce17a5ef1abd3c1c2bf8b9cc472bc8f3816299a06498cc7266c8f479beae

    • SHA512

      3bb9e69ad94fb083530b91b24c20c2ae45e5d41333a305c3e43cbcabc44ef92232509501ad915cd5a77bc06940f5a2ad8e5f6da45b13c379392823429ff04687

    Score
    10/10
    asyncratdigipersistencerat

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers.

      ratasyncrat

    • Modifies WinLogon for persistence

      persistence

    • Async RAT payload

      rat

    • Sets service image path in registry

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

1
T1004

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks