Resubmissions
21/02/2024, 22:28
240221-2d6lfagf691020/02/2024, 02:07
240220-cjy14shc8z1019/02/2024, 17:57
240219-wjrftaaa5s1001/02/2024, 17:44
240201-wbb16addcj10Analysis
- max time kernel
1218s - max time network
1216s - platform
windows10-2004_x64 - resource
win10v2004-20231222-en - resource tags
- submitted
01/02/2024, 17:44
General
- Target S500 CRASHED DESTROYED BY BIG DICK.zip
- Size 82.3MB
- Sample240201-wbb16addcj
- SHA256 511a99c70f3a3aaad381b3bf626e411b3b41f7a7cf3e040068a8cdddc6224296
Malware Config
Extracted
-
asyncrat
-
127.0.0.1:3232
-
nNx2ΔΙgg吉C伊弗Gp德WrDT
-
delay
3
-
install
false
-
install_folder
.
Signatures
- AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
- Async RAT payload 1 IoCs
- Executes dropped EXE 2 IoCs
- Drops file in Program Files directory 1 IoCs
- Modifies Internet Explorer settings 1 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 25 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 6 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SendNotifyMessage 1 IoCs
Processes
-
C:\Windows\Explorer.exeC:\Windows\Explorer.exe /idlist,,"C:\Users\Admin\AppData\Local\Temp\S500 CRASHED DESTROYED BY BIG DICK.zip"1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\AppData\Local\Temp\S500 CRASHED DESTROYED BY BIG DICK\" -spe -an -ai#7zMap2148:148:7zEvent137801⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\AppData\Local\Temp\S500 CRASHED DESTROYED BY BIG DICK\S500RAT.exe"C:\Users\Admin\AppData\Local\Temp\S500 CRASHED DESTROYED BY BIG DICK\S500RAT.exe"1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\S500 CRASHED DESTROYED BY BIG DICK\sEXYbABY.exe"C:\Users\Admin\AppData\Local\Temp\S500 CRASHED DESTROYED BY BIG DICK\sEXYbABY.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
Anarchy.Forms.FormRegValueEditMultiString.resources
Anarchy.Forms.FormSendFileToMemory.resources
Guna.UI2.dll
KNTmoSnG.AnarHs.dll
ReaLTaiizor.dll
S500RAT.exe
S500RAT.exe
S500RAT.exe.config
S500RAT.pdb
Siticone.UI.dll
Usrs.p12
cGeoIp.dll
sEXYbABY.exe
memory/1984-461-0x000002499D990000-0x000002499D9A4000-memory.dmp
memory/1984-468-0x00000249FF140000-0x00000249FF150000-memory.dmp
memory/1984-451-0x0000024999A60000-0x000002499A61E000-memory.dmp
memory/1984-452-0x00000249FF140000-0x00000249FF150000-memory.dmp
memory/1984-453-0x00000249FF140000-0x00000249FF150000-memory.dmp
memory/1984-455-0x0000024A005F0000-0x0000024A00BD8000-memory.dmp
memory/1984-449-0x00000249FF400000-0x00000249FF466000-memory.dmp
memory/1984-456-0x00000249FF140000-0x00000249FF150000-memory.dmp
memory/1984-457-0x00000249FF140000-0x00000249FF150000-memory.dmp
memory/1984-458-0x00007FFE98130000-0x00007FFE98BF1000-memory.dmp
memory/1984-448-0x00000249FF2E0000-0x00000249FF3FA000-memory.dmp
memory/1984-460-0x0000024A00000000-0x0000024A0014E000-memory.dmp
memory/1984-447-0x00000249FFBD0000-0x00000249FFDC4000-memory.dmp
memory/1984-462-0x00000249FF140000-0x00000249FF150000-memory.dmp
memory/1984-464-0x00000249FF140000-0x00000249FF150000-memory.dmp
memory/1984-463-0x00000249FF140000-0x00000249FF150000-memory.dmp
memory/1984-465-0x00000249FF140000-0x00000249FF150000-memory.dmp
memory/1984-466-0x00000249FF140000-0x00000249FF150000-memory.dmp
memory/1984-467-0x00000249FF140000-0x00000249FF150000-memory.dmp
memory/1984-450-0x00000249FF1A0000-0x00000249FF1C4000-memory.dmp
memory/1984-445-0x00000249FF140000-0x00000249FF150000-memory.dmp
memory/1984-472-0x00000249FF140000-0x00000249FF150000-memory.dmp
memory/1984-473-0x00000249FF140000-0x00000249FF150000-memory.dmp
memory/1984-475-0x00000249A7270000-0x00000249A7370000-memory.dmp
memory/1984-476-0x00000249A7270000-0x00000249A7370000-memory.dmp
memory/1984-444-0x00000249FF860000-0x00000249FFAB2000-memory.dmp
memory/1984-478-0x00000249A7270000-0x00000249A7370000-memory.dmp
memory/1984-479-0x00000249A7270000-0x00000249A7370000-memory.dmp
memory/1984-442-0x00000249DFBC0000-0x00000249E0BC0000-memory.dmp
memory/1984-489-0x00000249A7270000-0x00000249A7370000-memory.dmp
memory/1984-441-0x00007FFE98130000-0x00007FFE98BF1000-memory.dmp
memory/1984-487-0x00000249A7270000-0x00000249A7370000-memory.dmp
memory/2804-485-0x00007FFE98130000-0x00007FFE98BF1000-memory.dmp
memory/2804-486-0x00000000024B0000-0x00000000024C0000-memory.dmp
memory/2804-484-0x00000000024B0000-0x00000000024C0000-memory.dmp
memory/2804-483-0x00007FFE98130000-0x00007FFE98BF1000-memory.dmp
memory/2804-482-0x0000000000120000-0x0000000000136000-memory.dmp