General
-
Target
External Resounls..scr
-
Size
351KB
-
Sample
240301-a6hljaha5s
-
MD5
13d1fc17b74fdbe39d0141d4f5e2b6db
-
SHA1
0c48d2d21eff6bc55fefe111b25e81fcc27e25a5
-
SHA256
194c0a05958c8ead4bfa916ace6e1a5acdb7f433ce57c1d48abc9160a6bca4e5
-
SHA512
3eaf731772e1c1386a84eae459ca1d8cb81fa8d79be1cb91f5e8678e9861a687178007e881a0fd03d116c597918e3a5f580a5060e32dc0faeeee22ebe1ac3b0c
-
SSDEEP
6144:haxxiw0qvLJXnlUGujCtjno6itQl+REw6FMG/UHQS8PUHIRA8yVYtFm6axHUZ:hukqjVnl36ud0zR/6CtQ9PUHIG8Dn
Static task
static1
Behavioral task
behavioral1
Sample
External Resounls..scr
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
External Resounls..scr
Resource
win10v2004-20240226-en
Malware Config
Extracted
asyncrat
0.5.8
GoogleCrash
109.205.162.97:4739
GoogleCrash
-
delay
3
-
install
false
-
install_file
GoogleCrashHandler
-
install_folder
%AppData%
Extracted
asyncrat
0.5.8
SystemSetting
109.205.162.97:8361
Y68jUtK0cI3V
-
delay
3
-
install
false
-
install_file
MemoryCompression
-
install_folder
%AppData%
Targets
-
-
Target
External Resounls..scr
-
Size
351KB
-
MD5
13d1fc17b74fdbe39d0141d4f5e2b6db
-
SHA1
0c48d2d21eff6bc55fefe111b25e81fcc27e25a5
-
SHA256
194c0a05958c8ead4bfa916ace6e1a5acdb7f433ce57c1d48abc9160a6bca4e5
-
SHA512
3eaf731772e1c1386a84eae459ca1d8cb81fa8d79be1cb91f5e8678e9861a687178007e881a0fd03d116c597918e3a5f580a5060e32dc0faeeee22ebe1ac3b0c
-
SSDEEP
6144:haxxiw0qvLJXnlUGujCtjno6itQl+REw6FMG/UHQS8PUHIRA8yVYtFm6axHUZ:hukqjVnl36ud0zR/6CtQ9PUHIG8Dn
-
Downloads MZ/PE file
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1