Overview

overview

10

Static

static

WindowsDef...rt.exe

windows7-x64

10

WindowsDef...rt.exe

windows10-2004-x64

6

Sharing

Copy URL
Twitter E-mail

General

  • Target

    WindowsDefenderSmart.exe

  • Size

    4.2MB

  • Sample

    221101-qanqnsdadl

  • MD5

    b434851a5623bb2041b0a13f67f0e398

  • SHA1

    11941d54e13c763ca05f89f1199ccde1f4481a7c

  • SHA256

    60aeb8e84cfa5ffcfb62ccd283f7e5c8137725afcd1f05ba13ff0fed7f85f07f

  • SHA512

    a172a1e36cd6c3acb27fa56d37682660e13af5e6a830d0876b6a37f2fe0b86064f3441514bb68f8c65c9e1885fa41b2bffa56e37da3e2b20e96adcf82cff3d01

  • SSDEEP

    49152:qDFKT31ccMxMQg3Q3cX5C/wnvdAlPjcmY1GURXSCJakDxO:g81ccnRJAyx

Score
10/10
asyncratwindowsdefendersmarttscreenpersistencerat

Malware Config

Extracted

Family

asyncrat

Version

1.0.7

Botnet

WindowsDefenderSmarttScreen

C2

217.64.31.3:9742

Mutex

WindowsDefenderSmarttScreen

Attributes
  • delay

    1

  • install

    false

  • install_file

    WindowsDefenderSmarttScreen.exe

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      WindowsDefenderSmart.exe

    • Size

      4.2MB

    • MD5

      b434851a5623bb2041b0a13f67f0e398

    • SHA1

      11941d54e13c763ca05f89f1199ccde1f4481a7c

    • SHA256

      60aeb8e84cfa5ffcfb62ccd283f7e5c8137725afcd1f05ba13ff0fed7f85f07f

    • SHA512

      a172a1e36cd6c3acb27fa56d37682660e13af5e6a830d0876b6a37f2fe0b86064f3441514bb68f8c65c9e1885fa41b2bffa56e37da3e2b20e96adcf82cff3d01

    • SSDEEP

      49152:qDFKT31ccMxMQg3Q3cX5C/wnvdAlPjcmY1GURXSCJakDxO:g81ccnRJAyx

    Score
    10/10
    asyncratwindowsdefendersmarttscreenpersistencerat

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers.

      ratasyncrat

    • Async RAT payload

      rat

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks