Overview

overview

10

Static

static

AssistSetup.exe

windows7-x64

8

AssistSetup.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    AssistSetup.exe

  • Size

    28MB

  • Sample

    230201-grnbsscb24

  • MD5

    51643b94c22b0d6a0aaa53dc15308f8d

  • SHA1

    bf0830f651cd289a90a46d7dd5f9c24bae495fdb

  • SHA256

    b083bc071898398980cc296335bfa73553bf87e2f0826ed01ad2f71e3f314f04

  • SHA512

    592e926fded2bdcadaffb65877e370c01adfff77f5ea99f626c765d439beb1050de395f3157da3252cb56bfa79f6926316593acfe7108f31a995ac335751380a

  • SSDEEP

    786432:NlEMdXj09/AYxfSqq/Z+r8FwH/+CEwWFsS/ZxeIH83Rs:NlEMdX5RquJycwW+IZcIYi

Score
10/10
asyncratcoreentitydiscoverypersistencerat

Malware Config

Targets

    • Target

      AssistSetup.exe

    • Size

      28MB

    • MD5

      51643b94c22b0d6a0aaa53dc15308f8d

    • SHA1

      bf0830f651cd289a90a46d7dd5f9c24bae495fdb

    • SHA256

      b083bc071898398980cc296335bfa73553bf87e2f0826ed01ad2f71e3f314f04

    • SHA512

      592e926fded2bdcadaffb65877e370c01adfff77f5ea99f626c765d439beb1050de395f3157da3252cb56bfa79f6926316593acfe7108f31a995ac335751380a

    • SSDEEP

      786432:NlEMdXj09/AYxfSqq/Z+r8FwH/+CEwWFsS/ZxeIH83Rs:NlEMdX5RquJycwW+IZcIYi

    Score
    10/10
    asyncratcoreentitydiscoverypersistencerat

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers.

      ratasyncrat

    • CoreEntity .NET Packer

      A .NET packer called CoreEntity where it has embedded the payload as a BitMap object which is later decrypted.

      coreentity

    • Async RAT payload

      rat

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2

MITRE ATT&CK Matrix

Collection

Command and Control

Credential Access

Defense Evasion

Modify Registry

1
T1112

Discovery

Query Registry

5
T1012

System Information Discovery

5
T1082

Peripheral Device Discovery

2
T1120

Execution

Exfiltration

Impact

Initial Access

Lateral Movement

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Tasks