General
-
Target
https://gofile.io/d/JwlP3t
-
Sample
240727-dv3n4sxanf
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://gofile.io/d/JwlP3t
Resource
win10-20240611-en
Behavioral task
behavioral2
Sample
https://gofile.io/d/JwlP3t
Resource
win11-20240709-en
Malware Config
Extracted
asyncrat
1.0.7
Default
127.0.0.1:8848
127.0.0.1:37029
147.185.221.21:8848
147.185.221.21:37029
DcRatMutex_qwqdanchun
-
delay
1
-
install
false
-
install_folder
%AppData%
Extracted
xworm
147.185.221.21:27469
-
Install_directory
%AppData%
-
install_file
astroGG.exe
Targets
-
-
Target
https://gofile.io/d/JwlP3t
-
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
-
Detect Xworm Payload
-
Async RAT payload
-
Renames multiple (3949) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Downloads MZ/PE file
-
Drops startup file
-
Executes dropped EXE
-
Adds Run key to start application
-
Sets desktop wallpaper using registry
-
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Modify Registry
5Impair Defenses
2Disable or Modify Tools
2Subvert Trust Controls
1SIP and Trust Provider Hijacking
1