Overview

overview

10

Static

static

Anfrage Schweiz.rtf

windows7_x64

10

Anfrage Schweiz.rtf

windows10-2004_x64

4

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Anfrage Schweiz.doc

  • Size

    3KB

  • Sample

    220210-vza84aafak

  • MD5

    4c7380ca7d98489df3ca858c2e39127f

  • SHA1

    cfcf194ed9a7c4ef48201b062186bf6b7e793b2c

  • SHA256

    2200158c41a2516e208d5b1c730dd422537334e9712d0c350810d11b26b6fc65

  • SHA512

    0b093dbe35462e05b36a8cbb444024a48c8e562974de3b6e19a1da40a5fcb76f193e125464cd725d2a32c8050d1cc6cba38f42ba710ab907971381e2b65bcaa9

Score
10/10
asyncrat1persistencerat

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

1

C2

212.193.30.54:8754

Mutex

gyQ12!.,=FDpsdf2_@

Attributes
  • anti_vm

    false

  • bsod

    false

  • delay

    3

  • install

    false

  • install_folder

    %AppData%

  • pastebin_config

    null

aes.plain

Targets

    • Target

      Anfrage Schweiz.doc

    • Size

      3KB

    • MD5

      4c7380ca7d98489df3ca858c2e39127f

    • SHA1

      cfcf194ed9a7c4ef48201b062186bf6b7e793b2c

    • SHA256

      2200158c41a2516e208d5b1c730dd422537334e9712d0c350810d11b26b6fc65

    • SHA512

      0b093dbe35462e05b36a8cbb444024a48c8e562974de3b6e19a1da40a5fcb76f193e125464cd725d2a32c8050d1cc6cba38f42ba710ab907971381e2b65bcaa9

    Score
    10/10
    asyncrat1persistencerat

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers.

      ratasyncrat

    • Async RAT payload

      rat

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Exploitation for Client Execution

1
T1203

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

System Information Discovery

3
T1082

Query Registry

2
T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks