Inquiry 24 FEB 2022.doc

General
Target

Inquiry 24 FEB 2022.doc

Size

10KB

Sample

220224-jjn98sccd5

Score
10 /10
MD5

657289d8ae04dadd13f446b97e7f23ae

SHA1

b75268f3acabd538a37c004830c6c5a9bd07af57

SHA256

f865adf4b5445985e0814ce70cc9b32701f1640de72f0facd385e1a5c549bae2

SHA512

9cb856069fcda83e8dabf9ffddc15bc4f967791f7d01e4ba5ebc68da7cffc33af721714a50671d1ca7222018e2541efab40724df5f96969819a961642211dd68

Malware Config

Extracted

Family asyncrat
Version 0.5.7B
Botnet 1
C2

212.193.30.54:8755
Attributes
anti_vm
false
bsod
false
delay
3
install
false
install_folder
%AppData%
pastebin_config
null
aes.plain
Targets
Target

Inquiry 24 FEB 2022.doc

MD5

657289d8ae04dadd13f446b97e7f23ae

Filesize

10KB

Score
10/10
SHA1

b75268f3acabd538a37c004830c6c5a9bd07af57

SHA256

f865adf4b5445985e0814ce70cc9b32701f1640de72f0facd385e1a5c549bae2

SHA512

9cb856069fcda83e8dabf9ffddc15bc4f967791f7d01e4ba5ebc68da7cffc33af721714a50671d1ca7222018e2541efab40724df5f96969819a961642211dd68

Tags

Signatures

  • AsyncRat

    Description

    AsyncRAT is designed to remotely monitor and control other computers.

    Tags

  • Async RAT payload

    Tags

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    Tags

    TTPs

    Registry Run Keys / Startup FolderModify Registry

  • Suspicious use of SetThreadContext

Related Tasks

behavioral1behavioral2
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
        Discovery
        Execution
        Exfiltration
          Impact
            Initial Access
              Lateral Movement
                Persistence
                Privilege Escalation
                  Tasks

                  static1

                  behavioral1

                  10/10

                  behavioral2

                  1/10