General

  • Target

    tmp

  • Size

    2.1MB

  • Sample

    221007-fw9j6abhbr

  • MD5

    6d87f123772612929da682d8097938be

  • SHA1

    563fa72a6b4b2084db8a54f3fc9076b9b744e8cb

  • SHA256

    d8ccf0d00dbf712744ba342e641ad6faf8d917254e7fd44cef4e0e4cb3ac99c7

  • SHA512

    cd09c640eb2598b2a31c2aa9cbdf79920256a1d7e4fd7d5771fc4a837fd74a284532b14da397a380b8f363ed00130b5af40224242609a49c15c4955ac97925fe

  • SSDEEP

    24576:ve3yAGxmrk7ugY2yDWAzBOFaeLWxtUPom69bX83RJV6VPzKZUvW32r0enf3ELps8:ve9Q7ugcrvtUXCbXwcT1QMUdLlbU5M9

Malware Config

Targets

    • Target

      tmp

    • Size

      2.1MB

    • MD5

      6d87f123772612929da682d8097938be

    • SHA1

      563fa72a6b4b2084db8a54f3fc9076b9b744e8cb

    • SHA256

      d8ccf0d00dbf712744ba342e641ad6faf8d917254e7fd44cef4e0e4cb3ac99c7

    • SHA512

      cd09c640eb2598b2a31c2aa9cbdf79920256a1d7e4fd7d5771fc4a837fd74a284532b14da397a380b8f363ed00130b5af40224242609a49c15c4955ac97925fe

    • SSDEEP

      24576:ve3yAGxmrk7ugY2yDWAzBOFaeLWxtUPom69bX83RJV6VPzKZUvW32r0enf3ELps8:ve9Q7ugcrvtUXCbXwcT1QMUdLlbU5M9

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers.

    • Detects Smokeloader packer

    • Modifies WinLogon for persistence

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

    • Async RAT payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Accesses Microsoft Outlook profiles

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Winlogon Helper DLL

1
T1004

Defense Evasion

Modify Registry

1
T1112

Discovery

Query Registry

2
T1012

System Information Discovery

3
T1082

Peripheral Device Discovery

1
T1120

Collection

Email Collection

1
T1114

Tasks