Overview

overview

10

Static

static

New_order.exe

windows7-x64

1

New_order.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    New_order.exe

  • Size

    24KB

  • Sample

    221010-gxledsbacn

  • MD5

    8a61656c59b9ece4c4334a27fe91aa39

  • SHA1

    fb48ddb4bc7ff5bb8f1c95e5db3a9032d8013996

  • SHA256

    86f422b15b1672d2d1e42051f56e018810daa8f890c1a60d630693fd98c14887

  • SHA512

    53aac238a7d1023254b47f1ef05d6321558e669f883d049ab9baabe994cb2b00c9638b0146838bd7d94a8485d8753adeae624792565ccc7daf688b08850737c4

  • SSDEEP

    384:to2Sa91twZUvq9kiQGaW7NLGOLyYLK8LILQyPAhpswFVx:toc91twZp9ZQw7xNqQ8RPAJP

Score
10/10
asyncratpersistencerat

Malware Config

Targets

    • Target

      New_order.exe

    • Size

      24KB

    • MD5

      8a61656c59b9ece4c4334a27fe91aa39

    • SHA1

      fb48ddb4bc7ff5bb8f1c95e5db3a9032d8013996

    • SHA256

      86f422b15b1672d2d1e42051f56e018810daa8f890c1a60d630693fd98c14887

    • SHA512

      53aac238a7d1023254b47f1ef05d6321558e669f883d049ab9baabe994cb2b00c9638b0146838bd7d94a8485d8753adeae624792565ccc7daf688b08850737c4

    • SSDEEP

      384:to2Sa91twZUvq9kiQGaW7NLGOLyYLK8LILQyPAhpswFVx:toc91twZp9ZQw7xNqQ8RPAJP

    Score
    10/10
    asyncratpersistencerat

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers.

      ratasyncrat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks