Extracted

• • Target

    ORDER-230316.xlsm

  • Size

    41KB

  • MD5

    91b915d7c1079e51e241748a006da03c

  • SHA1

    846a9d44011340ebc31439f316efc2d1e5b279a6

  • SHA256

    7508dd55323850161d037626592fc56eb6be4cc917c68ba90f3c5866f5c2b59d

  • SHA512

    e40c725e1ca805ea9613e6f8f77f1119337e5bda49b6f5cd1f3cd7aa9f4f4da2aa744ec86cc6c5d7f264173390148ba07cc7968c22d340aceea31df5d3bf54c2

  • SSDEEP

    768:iATtXvQ04qta8v+nWE8hMBIJYfTH+niSplFFiKk/fsgvRag+neWM:VxvSqJv+xG1BjFFi3/Egvg/e9

  Score

  10^/10

  asyncratlatestpersistencerat

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Async RAT payload

    rat

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2