Analysis

  • max time kernel
    125s
  • max time network
    138s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    01-11-2022 13:03

General

  • Target

    WindowsDefenderSmart.exe

  • Size

    4.2MB

  • MD5

    b434851a5623bb2041b0a13f67f0e398

  • SHA1

    11941d54e13c763ca05f89f1199ccde1f4481a7c

  • SHA256

    60aeb8e84cfa5ffcfb62ccd283f7e5c8137725afcd1f05ba13ff0fed7f85f07f

  • SHA512

    a172a1e36cd6c3acb27fa56d37682660e13af5e6a830d0876b6a37f2fe0b86064f3441514bb68f8c65c9e1885fa41b2bffa56e37da3e2b20e96adcf82cff3d01

  • SSDEEP

    49152:qDFKT31ccMxMQg3Q3cX5C/wnvdAlPjcmY1GURXSCJakDxO:g81ccnRJAyx

Malware Config

Extracted

Family

asyncrat

Version

1.0.7

Botnet

WindowsDefenderSmarttScreen

C2

217.64.31.3:9742

Mutex

WindowsDefenderSmarttScreen

Attributes
  • delay

    1

  • install

    false

  • install_file

    WindowsDefenderSmarttScreen.exe

  • install_folder

    %AppData%

aes.plain

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers.

  • Async RAT payload 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\WindowsDefenderSmart.exe
    "C:\Users\Admin\AppData\Local\Temp\WindowsDefenderSmart.exe"
    1⤵
    • Adds Run key to start application
    PID:1084

Network

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Modify Registry

1
T1112

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1084-54-0x0000000000D90000-0x00000000011BE000-memory.dmp
    Filesize

    4.2MB

  • memory/1084-55-0x0000000074C91000-0x0000000074C93000-memory.dmp
    Filesize

    8KB

  • memory/1084-56-0x0000000000960000-0x0000000000972000-memory.dmp
    Filesize

    72KB