Overview

overview

10

Static

static

8d8a8672df...53.exe

windows7-x64

10

8d8a8672df...53.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8d8a8672dfff84bc479258d004a884339d9c3b53.exe

  • Size

    69KB

  • Sample

    221130-k9lsgaag3v

  • MD5

    ec7ea366e3d42308a1b8aee82b799dfe

  • SHA1

    8d8a8672dfff84bc479258d004a884339d9c3b53

  • SHA256

    f0c54049ee4311eb991f87a8eb76c700af19d5ebbfc5410f3bafef574b28d0e5

  • SHA512

    59bbd5acb73e5c5b37890b8fcdf3b8a239129117b0bb5422f77d10b4194a23a9cb8a93e94cc4574c3aa44f242e763f4daf92282ed258f96fdd7dedcfd785e6f6

  • SSDEEP

    1536:rwEjos8LrepSGToFwu/MRkSx4Y7uP6Wjh0IA/VD9LCwOC6/CKR09OnE3D:TjosyrepvToFH/Ly4xiKh0tNpMC6Kcnk

Score
10/10
asyncratpersistencerat

Malware Config

Extracted

Family

asyncrat

Version

0.5.4H

C2

0.tcp.ngrok.io:4444

Mutex

dchckeuexyjmudh

Attributes
  • delay

    0

  • install

    true

  • install_file

    explorer23i.exe

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      8d8a8672dfff84bc479258d004a884339d9c3b53.exe

    • Size

      69KB

    • MD5

      ec7ea366e3d42308a1b8aee82b799dfe

    • SHA1

      8d8a8672dfff84bc479258d004a884339d9c3b53

    • SHA256

      f0c54049ee4311eb991f87a8eb76c700af19d5ebbfc5410f3bafef574b28d0e5

    • SHA512

      59bbd5acb73e5c5b37890b8fcdf3b8a239129117b0bb5422f77d10b4194a23a9cb8a93e94cc4574c3aa44f242e763f4daf92282ed258f96fdd7dedcfd785e6f6

    • SSDEEP

      1536:rwEjos8LrepSGToFwu/MRkSx4Y7uP6Wjh0IA/VD9LCwOC6/CKR09OnE3D:TjosyrepvToFH/Ly4xiKh0tNpMC6Kcnk

    Score
    10/10
    asyncratpersistencerat

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers.

      ratasyncrat

    • Async RAT payload

      rat

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Registry Run Keys / Startup Folder

1
T1060

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks