General

  • Target

    LOIC2.exe

  • Size

    4.7MB

  • Sample

    240619-147qraycrp

  • MD5

    f0c1a8f2121060299f00c12f2b2d9eb5

  • SHA1

    468cac69f0dc64b099e9b483beb7ca8f48341591

  • SHA256

    f47616e1ab4fc52d125b91a94eef6e87f7589b5d664d3dcdaef7063d80149b64

  • SHA512

    7111b3e586d2af067d391ed0e18eab5f7f93d2ebcacd7b469ba2c7abe0479daf1ef06f3e5d75aec686e05248e72a62dd776c001d2464ed4842aa911cc8ce4c80

  • SSDEEP

    49152:PeKplaGpXu2CIFw//LYf6JhIPXZabK6NoihEWUbNapgFrnH/melr7O1/3gGJiz5G:plr5CzL7zucbK6NcWU4p6c1/36P

Malware Config

Extracted

Family

asyncrat

Botnet

Default

C2

127.0.0.1:3334

127.0.0.1:21265

193.161.193.99:3334

193.161.193.99:21265

Attributes
  • delay

    1

  • install

    true

  • install_file

    COM Surrogate.exe

  • install_folder

    %AppData%

aes.plain

Extracted

Family

metasploit

Version

metasploit_stager

C2

193.161.193.99:52695

Targets

    • Target

      LOIC2.exe

    • Size

      4.7MB

    • MD5

      f0c1a8f2121060299f00c12f2b2d9eb5

    • SHA1

      468cac69f0dc64b099e9b483beb7ca8f48341591

    • SHA256

      f47616e1ab4fc52d125b91a94eef6e87f7589b5d664d3dcdaef7063d80149b64

    • SHA512

      7111b3e586d2af067d391ed0e18eab5f7f93d2ebcacd7b469ba2c7abe0479daf1ef06f3e5d75aec686e05248e72a62dd776c001d2464ed4842aa911cc8ce4c80

    • SSDEEP

      49152:PeKplaGpXu2CIFw//LYf6JhIPXZabK6NoihEWUbNapgFrnH/melr7O1/3gGJiz5G:plr5CzL7zucbK6NcWU4p6c1/36P

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

    • MetaSploit

      Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    • Modifies Windows Defender Real-time Protection settings

    • Async RAT payload

    • Blocklisted process makes network request

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

MITRE ATT&CK Matrix ATT&CK v13

Execution

Command and Scripting Interpreter

1
T1059

PowerShell

1
T1059.001

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Persistence

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Privilege Escalation

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Defense Evasion

Modify Registry

1
T1112

Impair Defenses

1
T1562

Disable or Modify Tools

1
T1562.001

Discovery

Query Registry

4
T1012

System Information Discovery

4
T1082

Peripheral Device Discovery

1
T1120

Tasks