Analysis
-
max time kernel
147s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
21-05-2022 03:23
General
-
Target
disposable protective mask.exe
-
Size
375KB
-
MD5
e18ddc52047f3d3147d94db4bc50cb63
-
SHA1
7d2f3257ce09b8fd7aad305cb23309348a4b9790
-
SHA256
369e06999d4475ecc6e01a440ac20bebb744dbbf14b609c002f65379403f4be7
-
SHA512
f0ebd0c7a72e6419b37a607ce282acebecec2c9c80356f35fddaaf3f0ec8edac0cd6b00d81ad0a61a377eb70e7c5a9bcca70cf7088232d74c79f7bea8bf4cf61
Score
10/10
Malware Config
Extracted
Family
asyncrat
Version
0.5.6D
Botnet
HARDHARD
C2
185.165.153.215:6606
Mutex
uqeolevmck
Attributes
-
delay
1
-
install
false
-
install_folder
%AppData%
aes.plain
Signatures
-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
-
CoreEntity .NET Packer 1 IoCs
A .NET packer called CoreEntity where it has embedded the payload as a BitMap object which is later decrypted.
-
Async RAT payload 6 IoCs
-
ReZer0 packer 1 IoCs
Detects ReZer0, a packer with multiple versions used in various campaigns.
-
Suspicious use of SetThreadContext 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\disposable protective mask.exe"C:\Users\Admin\AppData\Local\Temp\disposable protective mask.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\disposable protective mask.exe"{path}"2⤵
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
400KB
-
Filesize
8KB
-
Filesize
32KB
-
Filesize
104KB