Overview

overview

10

Static

static

3

SearchFilter.exe

windows10-2004-x64

10

d3dcompiler_47.dll

windows10-2004-x64

3

ffmpeg.dll

windows10-2004-x64

3

libEGL.dll

windows10-2004-x64

3

libGLESv2.dll

windows10-2004-x64

3

locales/af.ps1

windows10-2004-x64

3

locales/uk.ps1

windows10-2004-x64

3

resources/...RBx.js

windows10-2004-x64

3

vk_swiftshader.dll

windows10-2004-x64

3

vulkan-1.dll

windows10-2004-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target
    Windows-Search.zip
  • Size 88.6MB
  • Sample240730-avk8aatamd
  • SHA256 5215d350f917e8f1df09581b835fb5189a00461a1041b898505bd39180203c1d
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
asyncrat12defense_evasiondiscoveryevasionexecutionrattrojan

Malware Config

Extracted

Family

  • asyncrat

Version

  • 0.5.8

Botnet

  • 1

C2

  • 20.82.141.111:6570

Mutex

  • mutex_boot-AsZzpYBmoad2u1S

Attributes
  • delay

    3

  • install

    false

  • install_folder

    %AppData%

aes.plain

Extracted

Family

  • asyncrat

Version

  • 0.5.8

Botnet

  • 2

C2

  • 20.82.141.111:6576

Mutex

  • mutex_kernel-SLhrSjUhEXvqIIS

Attributes
  • delay

    3

  • install

    false

  • install_folder

    %AppData%

aes.plain

Targets

    • Target
      SearchFilter.exe
    • Size 132.0MB
    • SHA256 59909bf0cc831cdb3553fa31eceeb8be207a65d2072da65fb6b38577770b036f
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    asyncrat12defense_evasiondiscoveryevasionexecutionrattrojan

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

      ratasyncrat

    • UAC bypass

      evasiontrojan

    • Async RAT payload

      rat

    • Command and Scripting Interpreter: PowerShell

      Start PowerShell.

      execution

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Hide Artifacts: Hidden Window

      Windows that would typically be displayed when an application carries out an operation can be hidden.

      defense_evasion

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Enumerates processes with tasklist

      discovery

    • Hide Artifacts: Hidden Files and Directories

      defense_evasion
    behavioral1
    • Target
      d3dcompiler_47.dll
    • Size 3.9MB
    • SHA256 35773c397036b368c1e75d4e0d62c36d98139ebe74e42c1ff7be71c6b5a19fd7
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    discovery
    behavioral2
    • Target
      ffmpeg.dll
    • Size 2.5MB
    • SHA256 c0d9edde3864d9450744f4bc526a98608b629aeed01c6647f600802e1b1cf671
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    discovery
    behavioral3
    • Target
      libEGL.dll
    • Size 371KB
    • SHA256 aa5da4005c76cfe5195b69282b2ad249d7dc2300bbc979592bd67315fc30c669
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    discovery
    behavioral4
    • Target
      libGLESv2.dll
    • Size 6.4MB
    • SHA256 f6259a9b9c284ee5916447dd9d0ba051c2908c9d3662d42d8bbe6ce6d65a37de
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    discovery
    behavioral5
    • Target
      locales/af.pak
    • Size 368KB
    • SHA256 f528e698b164283872f76df2233a47d7d41e1aba980ce39f6b078e577fd14c97
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    execution
    behavioral6
    • Target
      locales/uk.pak
    • Size 688KB
    • SHA256 54324671a161f6d67c790bfd29349db2e2d21f5012dc97e891f8f5268bdf7e22
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    execution
    behavioral7
    • Target
      resources/NmnfgaXt2luNfmDz65AVkRBx.js
    • Size 1.1MB
    • SHA256 1cb4d19492c8821adbf4daff078eaddf4e6fdf4f1e4104d1c97e407d75b36fcd
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    execution
    behavioral8
    • Target
      vk_swiftshader.dll
    • Size 4.5MB
    • SHA256 4c4b935cbb320033f504a89b1eb0a4bcb176bbd46a5981153cb1f54deb146a1c
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    discovery
    behavioral9
    • Target
      vulkan-1.dll
    • Size 786KB
    • SHA256 29cb256921a1b0f222c82650469d534ccdf038d1f395b3aaa9f1086918f5d3fa
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    discovery
    behavioral10

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

3
T1059

JavaScript

1
T1059.007

PowerShell

2
T1059.001

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Persistence

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Hide Artifacts

3
T1564

Hidden Files and Directories

2
T1564.001

Hidden Window

1
T1564.003

Impair Defenses

1
T1562

Disable or Modify Tools

1
T1562.001

Modify Registry

2
T1112

Subvert Trust Controls

1
T1553

Install Root Certificate

1
T1553.004

Credential Access

Discovery

Process Discovery

1
T1057

Query Registry

3
T1012

System Information Discovery

2
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks