Overview

overview

10

Static

static

3

9721eb18c2...42.exe

windows7-x64

10

9721eb18c2...42.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9721eb18c2ff91ea66e952511785099d8f444f3263ae8f397b3cf962f1fd0842

  • Size

    266KB

  • Sample

    240801-b5zdbszcke

  • MD5

    52b871709702c3274059da027fab92fb

  • SHA1

    a6a5c0db9087e2e5e2606c4792e5ba41a87acf25

  • SHA256

    9721eb18c2ff91ea66e952511785099d8f444f3263ae8f397b3cf962f1fd0842

  • SHA512

    e4001437082c4d7d190fcace9cfc7b86d7b96b8d4bb0a36f6fb9d586471245d4e91ee2c46e9d563d979c57f153c0790c49809ccf49180b072ad99e8f5e1438a2

  • SSDEEP

    3072:WdvzDqxs8ORikgogWfiuRXd3YmSffdTKXNXANewGBvskX1pWA/s8G:WFzDqa86hV6uRRqX1evPlwAEH

Score
10/10
asyncratdiscoverypersistencerat

Malware Config

Targets

    • Target

      9721eb18c2ff91ea66e952511785099d8f444f3263ae8f397b3cf962f1fd0842

    • Size

      266KB

    • MD5

      52b871709702c3274059da027fab92fb

    • SHA1

      a6a5c0db9087e2e5e2606c4792e5ba41a87acf25

    • SHA256

      9721eb18c2ff91ea66e952511785099d8f444f3263ae8f397b3cf962f1fd0842

    • SHA512

      e4001437082c4d7d190fcace9cfc7b86d7b96b8d4bb0a36f6fb9d586471245d4e91ee2c46e9d563d979c57f153c0790c49809ccf49180b072ad99e8f5e1438a2

    • SSDEEP

      3072:WdvzDqxs8ORikgogWfiuRXd3YmSffdTKXNXANewGBvskX1pWA/s8G:WFzDqa86hV6uRRqX1evPlwAEH

    Score
    10/10
    asyncratdiscoverypersistencerat

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

      ratasyncrat

    • Contains code to disable Windows Defender

      A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks