General

  • Target

    Dropper.exe

  • Size

    13KB

  • Sample

    240622-kqd9aasbqd

  • MD5

    422fdc110f8ab86ca2330575b0aa0136

  • SHA1

    87fc555366b2dbf4cf792b4aa0db45bebd5ea721

  • SHA256

    872603a182d5cbbc9252c99ff6f724b39fa9fdfff14cfe1d884b04669f36b039

  • SHA512

    ba545a5678fb2911937adaa4dfb6b1602ddf862d4d4b7a8fbd8838b48d3301808e263275f165e169e9fa566cf7a308966b19880c2c28cc0e1ceeea6a49ccb7cd

  • SSDEEP

    384:hEPiOThaLNI7mbpnz66MQM+pfolI6mfrhD9VCss:GF+9bpPMn7krhD9wss

Malware Config

Extracted

Family

asyncrat

Botnet

Default

C2

environmental-blank.gl.at.ply.gg:25944

Attributes
  • delay

    1

  • install

    true

  • install_file

    $77-aachost.exe

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      Dropper.exe

    • Size

      13KB

    • MD5

      422fdc110f8ab86ca2330575b0aa0136

    • SHA1

      87fc555366b2dbf4cf792b4aa0db45bebd5ea721

    • SHA256

      872603a182d5cbbc9252c99ff6f724b39fa9fdfff14cfe1d884b04669f36b039

    • SHA512

      ba545a5678fb2911937adaa4dfb6b1602ddf862d4d4b7a8fbd8838b48d3301808e263275f165e169e9fa566cf7a308966b19880c2c28cc0e1ceeea6a49ccb7cd

    • SSDEEP

      384:hEPiOThaLNI7mbpnz66MQM+pfolI6mfrhD9VCss:GF+9bpPMn7krhD9wss

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Async RAT payload

    • Downloads MZ/PE file

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Legitimate hosting services abused for malware hosting/C2

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v13

Execution

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Defense Evasion

Modify Registry

1
T1112

Discovery

Query Registry

7
T1012

System Information Discovery

6
T1082

Peripheral Device Discovery

1
T1120

Command and Control

Web Service

1
T1102

Tasks