Overview

overview

10

Static

static

dridex

windows10-1703-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e77332f5da65528cd1cd7edd282cf410f3a2d0d9629f02fa0beff3be20cccc21

  • Size

    5KB

  • Sample

    221217-h8eawsbb6x

  • MD5

    b8b554fb5654c7d50ac5bda2537b763b

  • SHA1

    c092b57e7ad8e7c0d831e7fd9e386fc523882a75

  • SHA256

    e77332f5da65528cd1cd7edd282cf410f3a2d0d9629f02fa0beff3be20cccc21

  • SHA512

    d4717d816d0ea063c670b6d2c7139c6b06d1321e11f1d0c30f5a504ab6177b222ee343efc898b0504e15726e0bae7fcf343a50c7633157756cffa07cb4708a4f

  • SSDEEP

    96:wht79BDCFWZZaoUiUq3k3n8G/K5XDFT0d3ojLrl:i9BWFWBUq3kX8G/Kp10d6

Score
10/10
asyncratsystem guard runtimepersistencerat

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

System Guard Runtime

C2

85.105.88.221:2531

Mutex

System Guard Runtime

Attributes
  • delay

    3

  • install

    false

  • install_file

    System Guard Runtime

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      e77332f5da65528cd1cd7edd282cf410f3a2d0d9629f02fa0beff3be20cccc21

    • Size

      5KB

    • MD5

      b8b554fb5654c7d50ac5bda2537b763b

    • SHA1

      c092b57e7ad8e7c0d831e7fd9e386fc523882a75

    • SHA256

      e77332f5da65528cd1cd7edd282cf410f3a2d0d9629f02fa0beff3be20cccc21

    • SHA512

      d4717d816d0ea063c670b6d2c7139c6b06d1321e11f1d0c30f5a504ab6177b222ee343efc898b0504e15726e0bae7fcf343a50c7633157756cffa07cb4708a4f

    • SSDEEP

      96:wht79BDCFWZZaoUiUq3k3n8G/K5XDFT0d3ojLrl:i9BWFWBUq3kX8G/Kp10d6

    Score
    10/10
    asyncratsystem guard runtimepersistencerat

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers.

      ratasyncrat

    • Async RAT payload

      rat

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Registry Run Keys / Startup Folder

1
T1060

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks