General

  • Target

    Ref. # IRQ-21-07778.exe

  • Size

    638KB

  • Sample

    220125-fm1kwshae9

  • MD5

    ea1c43b63702044738928927ee2c9703

  • SHA1

    4ec7f29c7e0e2b9e1babd04f94b1297088dc64f7

  • SHA256

    7d1962c7ac6121291ef77096176106435182e49873b65f4438a1c45b4337672a

  • SHA512

    11c8c955877c49e01503f0859d5ba520e44bee678d711a545faff1cd72ab8e516ae3301d4480c267f1ab7a7b033170270568e16cd94fbe60b7973bc1cccfeffb

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

Default

C2

89.238.150.43:57095

Mutex

AsyncMutex_6SI8OkPnk

Attributes
  • anti_vm

    false

  • bsod

    false

  • delay

    3

  • install

    true

  • install_file

    chromeex.exe

  • install_folder

    %Temp%

  • pastebin_config

    null

aes.plain

Targets

    • Target

      Ref. # IRQ-21-07778.exe

    • Size

      638KB

    • MD5

      ea1c43b63702044738928927ee2c9703

    • SHA1

      4ec7f29c7e0e2b9e1babd04f94b1297088dc64f7

    • SHA256

      7d1962c7ac6121291ef77096176106435182e49873b65f4438a1c45b4337672a

    • SHA512

      11c8c955877c49e01503f0859d5ba520e44bee678d711a545faff1cd72ab8e516ae3301d4480c267f1ab7a7b033170270568e16cd94fbe60b7973bc1cccfeffb

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers.

    • Async RAT payload

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Credential Access

Credentials in Files

1
T1081

Discovery

System Information Discovery

1
T1082

Collection

Data from Local System

1
T1005

Tasks