Overview

overview

10

Static

static

order-82148214124.vbs

windows7-x64

10

order-82148214124.vbs

windows10-1703-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    order-82148214124.VBS

  • Size

    377B

  • Sample

    220719-tvng7agbdn

  • MD5

    0f2b047310e67d7cd019fcecab748e60

  • SHA1

    a645f62df84cfb673cabedcde468886fc8f4e04a

  • SHA256

    e99d298b9699a377758ff12e42670465444329a49b47d51a533365a8f12b91f1

  • SHA512

    f54c7ae16c19ec7785972daef9e5607ba0c140677315a07bc21666e2da5b1562ff1d93ca62275ca44a5745d2e763cf819950ee965d033b1e1e2517ae32270b81

Score
10/10
asyncratnowpersistencerat

Malware Config

Extracted

Language
hta
Source
URLs
hta.dropper

https://royaltpita.com/wp-admin/maint/enc.txt

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

Now

C2

moaaaza.com:9090

Mutex

AsyncMutex_6SI8OkPnk

Attributes
  • delay

    3

  • install

    false

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      order-82148214124.VBS

    • Size

      377B

    • MD5

      0f2b047310e67d7cd019fcecab748e60

    • SHA1

      a645f62df84cfb673cabedcde468886fc8f4e04a

    • SHA256

      e99d298b9699a377758ff12e42670465444329a49b47d51a533365a8f12b91f1

    • SHA512

      f54c7ae16c19ec7785972daef9e5607ba0c140677315a07bc21666e2da5b1562ff1d93ca62275ca44a5745d2e763cf819950ee965d033b1e1e2517ae32270b81

    Score
    10/10
    asyncratnowpersistencerat

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers.

      ratasyncrat

    • Contains code to disable Windows Defender

      A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Async RAT payload

      rat

    • Blocklisted process makes network request

    • Registers COM server for autorun

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks