General
-
Target
w.exe
-
Size
362KB
-
Sample
240626-lelpnaxgnh
-
MD5
7c031479dedab585b453098453a09f35
-
SHA1
401ec0bf7ce170a67c0317150c2b83885e8abc54
-
SHA256
138be3a5769af371a332cf9404cca591cd78d594d6a072fa8047e222ac92770e
-
SHA512
17160d0c966c6ea6f8ac182ccd361baf2900dbfbf92ae59804861a404ba5a77a37e499ae0ac2588d46fcd26ce08d29a02e66b09894e4319212fb9f0d23a9643f
-
SSDEEP
6144:rBx7iw0qvLJXnlUGujCtjno6itQl+REw6FMG/UHQS8PUHIRA8yVYtFmCaxHU0bM:rTkqjVnl36ud0zR/6CtQ9PUHIG8Dn
Static task
static1
Malware Config
Extracted
asyncrat
0.5.8
T
20.199.8.16:1726
31FGTEWnaxDE
-
delay
3
-
install
false
-
install_file
SeacrhIndexer
-
install_folder
%AppData%
Extracted
asyncrat
0.5.8
Y
20.199.8.16:1726
eYLuHMmPZK7A
-
delay
3
-
install
false
-
install_file
SeacrhIndexer
-
install_folder
%AppData%
Targets
-
-
Target
w.exe
-
Size
362KB
-
MD5
7c031479dedab585b453098453a09f35
-
SHA1
401ec0bf7ce170a67c0317150c2b83885e8abc54
-
SHA256
138be3a5769af371a332cf9404cca591cd78d594d6a072fa8047e222ac92770e
-
SHA512
17160d0c966c6ea6f8ac182ccd361baf2900dbfbf92ae59804861a404ba5a77a37e499ae0ac2588d46fcd26ce08d29a02e66b09894e4319212fb9f0d23a9643f
-
SSDEEP
6144:rBx7iw0qvLJXnlUGujCtjno6itQl+REw6FMG/UHQS8PUHIRA8yVYtFmCaxHU0bM:rTkqjVnl36ud0zR/6CtQ9PUHIG8Dn
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Legitimate hosting services abused for malware hosting/C2
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1