General

  • Target

    w.exe

  • Size

    362KB

  • Sample

    240626-lelpnaxgnh

  • MD5

    7c031479dedab585b453098453a09f35

  • SHA1

    401ec0bf7ce170a67c0317150c2b83885e8abc54

  • SHA256

    138be3a5769af371a332cf9404cca591cd78d594d6a072fa8047e222ac92770e

  • SHA512

    17160d0c966c6ea6f8ac182ccd361baf2900dbfbf92ae59804861a404ba5a77a37e499ae0ac2588d46fcd26ce08d29a02e66b09894e4319212fb9f0d23a9643f

  • SSDEEP

    6144:rBx7iw0qvLJXnlUGujCtjno6itQl+REw6FMG/UHQS8PUHIRA8yVYtFmCaxHU0bM:rTkqjVnl36ud0zR/6CtQ9PUHIG8Dn

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

T

C2

20.199.8.16:1726

Mutex

31FGTEWnaxDE

Attributes
  • delay

    3

  • install

    false

  • install_file

    SeacrhIndexer

  • install_folder

    %AppData%

aes.plain

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Y

C2

20.199.8.16:1726

Mutex

eYLuHMmPZK7A

Attributes
  • delay

    3

  • install

    false

  • install_file

    SeacrhIndexer

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      w.exe

    • Size

      362KB

    • MD5

      7c031479dedab585b453098453a09f35

    • SHA1

      401ec0bf7ce170a67c0317150c2b83885e8abc54

    • SHA256

      138be3a5769af371a332cf9404cca591cd78d594d6a072fa8047e222ac92770e

    • SHA512

      17160d0c966c6ea6f8ac182ccd361baf2900dbfbf92ae59804861a404ba5a77a37e499ae0ac2588d46fcd26ce08d29a02e66b09894e4319212fb9f0d23a9643f

    • SSDEEP

      6144:rBx7iw0qvLJXnlUGujCtjno6itQl+REw6FMG/UHQS8PUHIRA8yVYtFmCaxHU0bM:rTkqjVnl36ud0zR/6CtQ9PUHIG8Dn

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

    • UAC bypass

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

    • Legitimate hosting services abused for malware hosting/C2

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks