Overview

overview

10

Static

static

3

2024-05-24...rd.exe

windows7-x64

10

2024-05-24...rd.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2024-05-24_709ed19b7a560246f2d8be96d1a426e1_megazord

  • Size

    4.1MB

  • Sample

    240524-kmxlfsbe6t

  • MD5

    709ed19b7a560246f2d8be96d1a426e1

  • SHA1

    b5aab1c97e3c235931fa31765eb42cc58a3a79a3

  • SHA256

    4906a283d9ac5b358a5ed6967b0518ff934c0373add85a15b433cb536b0d97ef

  • SHA512

    12e21a160f3d8eeaf61827d8b07a91c27e65dea831493fb6c20c8177d55b7b2d378faf439187948c42aba4721afdccea7c5bd093609fac698a7066c0bdcb50b9

  • SSDEEP

    49152:NlN0gW7O2/4DkO2srmDrPP1hvauFUHu480TJenr1vJb:N7HG3nf0TJeJt

Score
10/10
asyncratdefaultexecutionpersistencerat

Malware Config

Extracted

Family

asyncrat

Version

2.0.0

Botnet

Default

C2

webwhatsapp.cc:65503

Mutex

ShiningForceRatMutex_cs_cs_cs

Attributes
  • delay

    1

  • install

    false

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      2024-05-24_709ed19b7a560246f2d8be96d1a426e1_megazord

    • Size

      4.1MB

    • MD5

      709ed19b7a560246f2d8be96d1a426e1

    • SHA1

      b5aab1c97e3c235931fa31765eb42cc58a3a79a3

    • SHA256

      4906a283d9ac5b358a5ed6967b0518ff934c0373add85a15b433cb536b0d97ef

    • SHA512

      12e21a160f3d8eeaf61827d8b07a91c27e65dea831493fb6c20c8177d55b7b2d378faf439187948c42aba4721afdccea7c5bd093609fac698a7066c0bdcb50b9

    • SSDEEP

      49152:NlN0gW7O2/4DkO2srmDrPP1hvauFUHu480TJenr1vJb:N7HG3nf0TJeJt

    Score
    10/10
    asyncratdefaultexecutionpersistencerat

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

      ratasyncrat

    • Detects executables attemping to enumerate video devices using WMI

    • Detects executables containing the string DcRatBy

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

PowerShell

1
T1059.001

Scheduled Task/Job

1
T1053

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Scheduled Task/Job

1
T1053

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Scheduled Task/Job

1
T1053

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks