Resubmissions
21/02/2024, 22:28
240221-2d6lfagf691020/02/2024, 02:07
240220-cjy14shc8z1019/02/2024, 17:57
240219-wjrftaaa5s1001/02/2024, 17:44
240201-wbb16addcj10Analysis
- max time kernel
162s - max time network
162s - platform
windows10-2004_x64 - resource
win10v2004-20240221-en - resource tags
- submitted
21/02/2024, 22:28
General
- Target S500 CRASHED DESTROYED BY BIG DICK.zip
- Size 82.3MB
- Sample240221-2d6lfagf69
- SHA256 511a99c70f3a3aaad381b3bf626e411b3b41f7a7cf3e040068a8cdddc6224296
Malware Config
Extracted
-
asyncrat
-
127.0.0.1:3232
-
nNx2ΔΙgg吉C伊弗Gp德WrDT
-
delay
3
-
install
false
-
install_folder
.
Signatures
- AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
- Async RAT payload 1 IoCs
- Executes dropped EXE 2 IoCs
- Modifies Internet Explorer settings 1 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 26 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 5 IoCs
- Suspicious use of FindShellTrayWindow 3 IoCs
- Suspicious use of SendNotifyMessage 1 IoCs
Processes
-
C:\Windows\Explorer.exeC:\Windows\Explorer.exe /idlist,,"C:\Users\Admin\AppData\Local\Temp\S500 CRASHED DESTROYED BY BIG DICK.zip"1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\S500 CRASHED DESTROYED BY BIG DICK.zip"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\Desktop\S500 CRASHED DESTROYED BY BIG DICK\S500RAT.exe"C:\Users\Admin\Desktop\S500 CRASHED DESTROYED BY BIG DICK\S500RAT.exe"1⤵
- Executes dropped EXE
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
-
C:\Users\Admin\Desktop\S500 CRASHED DESTROYED BY BIG DICK\sEXYbABY.exe"C:\Users\Admin\Desktop\S500 CRASHED DESTROYED BY BIG DICK\sEXYbABY.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
Anarchy.Forms.FormRegValueEditMultiString.resources
Anarchy.Forms.FormSendFileToMemory.resources
Guna.UI2.dll
ReaLTaiizor.dll
S500RAT.exe
S500RAT.exe
S500RAT.exe.config
Usrs.p12
cGeoIp.dll
sEXYbABY.exe
memory/440-472-0x0000000000030000-0x0000000000046000-memory.dmp
memory/440-473-0x00007FFDEEE10000-0x00007FFDEF8D1000-memory.dmp
memory/440-474-0x000000001AD50000-0x000000001AD60000-memory.dmp
memory/2808-452-0x00000272F01C0000-0x00000272F0D7E000-memory.dmp
memory/2808-460-0x00000272D3670000-0x00000272D3680000-memory.dmp
memory/2808-450-0x00000272EFB10000-0x00000272EFB76000-memory.dmp
memory/2808-449-0x00000272D3670000-0x00000272D3680000-memory.dmp
memory/2808-453-0x00000272D3670000-0x00000272D3680000-memory.dmp
memory/2808-454-0x00000272D3670000-0x00000272D3680000-memory.dmp
memory/2808-455-0x00007FFDEEE10000-0x00007FFDEF8D1000-memory.dmp
memory/2808-448-0x00000272EF9F0000-0x00000272EFB0A000-memory.dmp
memory/2808-457-0x00000272FD750000-0x00000272FDD38000-memory.dmp
memory/2808-458-0x00000272D3670000-0x00000272D3680000-memory.dmp
memory/2808-459-0x00000272D3670000-0x00000272D3680000-memory.dmp
memory/2808-451-0x00000272EFB70000-0x00000272EFB94000-memory.dmp
memory/2808-461-0x00000272D3670000-0x00000272D3680000-memory.dmp
memory/2808-447-0x00000272EFFC0000-0x00000272F01B4000-memory.dmp
memory/2808-466-0x00000272D3670000-0x00000272D3680000-memory.dmp
memory/2808-465-0x00000272D3670000-0x00000272D3680000-memory.dmp
memory/2808-467-0x00000272D3670000-0x00000272D3680000-memory.dmp
memory/2808-469-0x00000272D3670000-0x00000272D3680000-memory.dmp
memory/2808-445-0x00000272D3670000-0x00000272D3680000-memory.dmp
memory/2808-444-0x00000272EFC50000-0x00000272EFEA2000-memory.dmp
memory/2808-442-0x00000272B6220000-0x00000272B7220000-memory.dmp
memory/2808-441-0x00007FFDEEE10000-0x00007FFDEF8D1000-memory.dmp