Overview

overview

10

Static

static

dridex

windows10-1703-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9ba3d5c38a92abe046af042f657dba1d4e995add4d7f19fb0317e7d5f7c4efea

  • Size

    6KB

  • Sample

    221206-hs93made96

  • MD5

    43092801b433d21c31682428366f4e4c

  • SHA1

    2935b85e09a0f78224755a6ebd443cf067705ade

  • SHA256

    9ba3d5c38a92abe046af042f657dba1d4e995add4d7f19fb0317e7d5f7c4efea

  • SHA512

    680a7ab8d7f5ed6222451ed50806040b3ad1454d4d4aa737ff205614277cb57b294c707148fbb6aa4cd68d5ceb48454d3d9396fa795da29469692e3bb7eab873

  • SSDEEP

    96:Vqni791kCFjoYD966lyUqEwhAY0s0vk+WjD1TIoDjpWwQPWw3d3ojarl:Vq091PFrD6UqExYMvkXhpWwAWed5

Score
10/10
asyncratsystem guard runtimepersistencerat

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

System Guard Runtime

C2

85.105.88.221:2531

Mutex

System Guard Runtime

Attributes
  • delay

    3

  • install

    false

  • install_file

    System Guard Runtime

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      9ba3d5c38a92abe046af042f657dba1d4e995add4d7f19fb0317e7d5f7c4efea

    • Size

      6KB

    • MD5

      43092801b433d21c31682428366f4e4c

    • SHA1

      2935b85e09a0f78224755a6ebd443cf067705ade

    • SHA256

      9ba3d5c38a92abe046af042f657dba1d4e995add4d7f19fb0317e7d5f7c4efea

    • SHA512

      680a7ab8d7f5ed6222451ed50806040b3ad1454d4d4aa737ff205614277cb57b294c707148fbb6aa4cd68d5ceb48454d3d9396fa795da29469692e3bb7eab873

    • SSDEEP

      96:Vqni791kCFjoYD966lyUqEwhAY0s0vk+WjD1TIoDjpWwQPWw3d3ojarl:Vq091PFrD6UqExYMvkXhpWwAWed5

    Score
    10/10
    asyncratsystem guard runtimepersistencerat

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers.

      ratasyncrat

    • Async RAT payload

      rat

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Registry Run Keys / Startup Folder

1
T1060

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks