Resubmissions
21-02-2024 22:28
240221-2d6lfagf69 1020-02-2024 02:07
240220-cjy14shc8z 1019-02-2024 17:57
240219-wjrftaaa5s 1001-02-2024 17:44
240201-wbb16addcj 10Analysis
-
max time kernel
162s -
max time network
162s -
platform
windows10-2004_x64 -
resource
win10v2004-20240221-en -
resource tags
-
submitted
21-02-2024 22:28
General
-
Target
S500 CRASHED DESTROYED BY BIG DICK.zip
-
Size
82.3MB
-
MD5
5aa9ba2618a5e528af208ee5854cf2be
-
SHA1
3cf3eb1d8339bd5bc624ac10e797ccf556b538ca
-
SHA256
511a99c70f3a3aaad381b3bf626e411b3b41f7a7cf3e040068a8cdddc6224296
-
SHA512
f9d65db7b6ee067092ec08d4abeed3cbf40f2d7ada1a12ebe20d737aac9b1ed71895c9f9b7b1162a75733b25b14a022147cfd81970fcb9e7808eed3f9d79e087
-
SSDEEP
1572864:/JcbzDm3OZLuFkmVmzDmum6Whftzjat/Y34F1zBLgrNka51ML:Bcni3Gu/VmzWJ3KxYwANka51ML
Malware Config
Extracted
asyncrat
127.0.0.1:3232
nNx2ΔΙgg吉C伊弗Gp德WrDT
-
delay
3
-
install
false
-
install_folder
.
Signatures
-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
Async RAT payload 1 IoCs
-
Executes dropped EXE 2 IoCs
-
Modifies Internet Explorer settings 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 26 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 5 IoCs
-
Suspicious use of FindShellTrayWindow 3 IoCs
-
Suspicious use of SendNotifyMessage 1 IoCs
Processes
-
C:\Windows\Explorer.exeC:\Windows\Explorer.exe /idlist,,"C:\Users\Admin\AppData\Local\Temp\S500 CRASHED DESTROYED BY BIG DICK.zip"1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\S500 CRASHED DESTROYED BY BIG DICK.zip"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\Desktop\S500 CRASHED DESTROYED BY BIG DICK\S500RAT.exe"C:\Users\Admin\Desktop\S500 CRASHED DESTROYED BY BIG DICK\S500RAT.exe"1⤵
- Executes dropped EXE
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
-
C:\Users\Admin\Desktop\S500 CRASHED DESTROYED BY BIG DICK\sEXYbABY.exe"C:\Users\Admin\Desktop\S500 CRASHED DESTROYED BY BIG DICK\sEXYbABY.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
67KB
MD5beda8bbd2a72e45431cf5dd68f7c6e61
SHA118e28ada040e4c62e33d946046a9ccf66f839f0d
SHA256f9f9c2a4855d61b7c7f93e9258d0306be802ef9c8c8929186deb71ee96b06d4c
SHA5126287bb138431c33a2dd30b7c06c979ee89f691900eb407e14465d58188d04d7697ecc68eb6d479db664ea86f35b7ce6b611834028ddbd56513003c1ca28f0899
-
Filesize
66KB
MD5fa80841e3dc9ffb31dd5d015c1030172
SHA1aa0d9e66db2a8528edf9931fe132f18870307216
SHA256a5b9f5ccfe8ac46a630ac1cc112d343364fa2bc4a2bec0f3911322cff174cff9
SHA512a38cc863d3c0c8d944340cd4116f03bbdb2f1526fb40b476cd0adbd444fd1dc10790d35eaf50ea34a1083b163baa82251a5048f075651bc14e46ac4cb82897bd
-
Filesize
1.1MB
MD51ccd3249a32f6019e828df3ed85ef8ea
SHA105622520b62b33579f7ec7b4282e8fceead2e1cf
SHA2567784861a5c142680cf1517182608a5e42d5b2ad298048b92dd3a92f27b272e79
SHA512d66fbc3b8d36bab264a51bfa948778cfc3d9ad63d472ad72a49cd7102f0c49c1197b49012652281854cc8d7b26db4200b9f43dd51dcfdf31a50e47383733f4e8
-
Filesize
3.2MB
MD58ad964aec42e06380f54764b4b9a46c1
SHA104e0e8386bf9af46690ad63cc21bb825411550ff
SHA2562648e5669ff4161b7f4670384eaec58270fa326c0292dce97ece3be7ddcdd191
SHA51263e8213e553d26e61f3520eddf3829532fa3c09c5ca92ba4d3c445dfeac8caa496416170a4a3715b60ecb3e08f4d0588550d5a2dd71ef291c9f4ad92001a1cde
-
Filesize
4.0MB
MD51e2c9d00fcfb200b42110da79ff9d735
SHA18addde7986ea7b4c68aabdc5b8afd62dffee9bf3
SHA25697fbc16237ecf4a1b02f6557e574178f950d35d6f5e6f37e14608a18f9e52817
SHA5124d2af3353bf3b6d2bd75ef8947bd82c4d102d2848dec658112946f69add9c6cfa5d6a911e35c26884020fd3da682b741b4d58c1eb09a6eff77e465f765f3d555
-
Filesize
3.5MB
MD57e9bb5491037c8c8717dd83a748cae68
SHA1e84b434fb88032f68d079257fdddfe5e08c26c87
SHA256ba488e2f67a3234b185878d7cc1f2cf450f3b91f084ede5f5ccad3fda8ac4e59
SHA5123578728fc2f2929a95b320f81019ffacdc96aa061d07f340a45a32773e92f67fed380a7336b66c2e38f69dd72a06658f5f793269ac7f8634926694d4a77401b2
-
Filesize
530B
MD5c7a4606f8f222fc96e1e6b08c093794b
SHA12700b3727ab01d93e75e1e12f308dcaeb1d37dba
SHA25632d656a69b19be98ae050512a4d0f49ebe21b6f7bb9c50130b7e952ea4f5239b
SHA5127516375b47536a51ede8079d25760e0142ac93077326b6cc033fd6cb1676b65aec7edb3f702922506f2b6b18992cd219be01e7adbf70c6d13404adceb410472b
-
Filesize
1KB
MD5e14c7402da26e4a1a1c226d546ec3aba
SHA13234c40fa2aec2d483d2b7ede9b901d3899d5336
SHA256dd00f7ce28d7ef1e14f50b046ca1736f15ab08e6458d2c2cc72d078e4354ddb7
SHA512cba4cd515319b11be1a94ffb22c4b14b933868217a1b7f6ce126568b82723769baf170f9d1f262135b8867162b8e932a9c2143603c4c9d668edc3f4622cfb5b2
-
Filesize
102KB
MD5ae0da7323d7b1fdff5eeab7f54511a7c
SHA1d102b6e612c04e4a33c60fd906cd408ae7840c1d
SHA2566da4fdcf3a75f6ed1525d106b217adfed6910be458e78775d0269ac7160d011d
SHA512b8bc5d94595308b410b26bb28d87de436ad978fcd467061a15601e4e12f193a343b067783f745aa0d632794905dead0d67413b8e4123cce8d43ffbd5155e2df5
-
Filesize
63KB
MD59cabbaa5f95805449b6b39dfb5363ef7
SHA1bfc9f92dcb82de22f2cfafbc2004375a3de0e112
SHA2566ee41c8e942eadb4053b0b0e4535366e7a3921c740aa7d607bf3f3c9f8b20df9
SHA5129fcc2be5099620108668dd06e42c43565c7bc1e8b22e092b1dbd20fbb5145e70a24513010c089a13c1e4ed6575778c4a7ca18669b8a977109f63545a7b430471
-
Filesize
88KB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
11.7MB
-
Filesize
64KB
-
Filesize
408KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
10.8MB
-
Filesize
1.1MB
-
Filesize
5.9MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
144KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.3MB
-
Filesize
16.0MB
-
Filesize
10.8MB