Overview

overview

10

Static

static

SecuriteIn...66.exe

windows7-x64

10

SecuriteIn...66.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    SecuriteInfo.com.Trojan.Mardom.MN.24.2388.366.exe

  • Size

    379KB

  • Sample

    220919-n7fp8afgh4

  • MD5

    011558167163f6d90c9a2db9d3483c38

  • SHA1

    6f93f666f2c8b83db55e4f543fbd30c696e38be3

  • SHA256

    0c02d6eef179e83089cce5444a5904397d9a3035155c5b4269af6749e4e039b7

  • SHA512

    4f87791636dbd48b2713d1cb71435a8aa4c7bfbfcc20a404c2c4efa99c76fe9be2e41e4da1163e1664c813a5ef7c4651b9ef6d19332ca3713be9f1f4f1aeaeb9

  • SSDEEP

    6144:RLZwe13u0ca2SFJjzhqvKy8UyiFXMgRPqj:RNwe9rJB6KWysXQj

Score
10/10
asyncratdefaultmicrosoftpersistencephishingrat

Malware Config

Extracted

Family

asyncrat

Version

1.0.7

Botnet

Default

C2

iphanyi.edns.biz:3369

Mutex

Mtex_qwqdanchun

Attributes
  • delay

    1

  • install

    true

  • install_file

    windowss.exe

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      SecuriteInfo.com.Trojan.Mardom.MN.24.2388.366.exe

    • Size

      379KB

    • MD5

      011558167163f6d90c9a2db9d3483c38

    • SHA1

      6f93f666f2c8b83db55e4f543fbd30c696e38be3

    • SHA256

      0c02d6eef179e83089cce5444a5904397d9a3035155c5b4269af6749e4e039b7

    • SHA512

      4f87791636dbd48b2713d1cb71435a8aa4c7bfbfcc20a404c2c4efa99c76fe9be2e41e4da1163e1664c813a5ef7c4651b9ef6d19332ca3713be9f1f4f1aeaeb9

    • SSDEEP

      6144:RLZwe13u0ca2SFJjzhqvKy8UyiFXMgRPqj:RNwe9rJB6KWysXQj

    Score
    10/10
    asyncratdefaultratmicrosoftpersistencephishing

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers.

      ratasyncrat

    • Async RAT payload

      rat

    • Adds Run key to start application

      persistence

    • Detected potential entity reuse from brand microsoft.

      phishingmicrosoft

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Registry Run Keys / Startup Folder

1
T1060

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

System Information Discovery

2
T1082

Query Registry

1
T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks