Overview

overview

10

Static

static

10

Client.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Client.exe

  • Size

    265KB

  • Sample

    240805-mtqgtsxfpg

  • MD5

    73503a6b7502669d3937c8406cf97d22

  • SHA1

    dc9426f95a5b53cfe949f051ec96aca42775c97e

  • SHA256

    96cea5aa04bf16efa6f0c768643013fe621e1efd5e17180e1c4d26bba2c60823

  • SHA512

    2314a6972f3d268fd5a9209c5fa6484e0dfb2af07154060ca54c157ef345b27a5c279c9f15d5bec25292f5908e65f250533dcf4b3261f7b7acf0946fc7feb56d

  • SSDEEP

    3072:vviJueXGbbXBGmAtPBKCQCeLhiGGGGGGGGGGGGGGGGGGGGGGGG9YGGGnGGGGGGGV:y/XkbwHPBKCQC6hUvoJ2zG+MQ4

Score
10/10
asyncratwindows defenderdiscoveryevasionpersistenceprivilege_escalationrat

Malware Config

Extracted

Family

asyncrat

Version

5.0.5

Botnet

Windows Defender

C2

mode-clusters.gl.at.ply.gg:36304

Mutex

Venom_RAT_HVNC_Mutex_Venom RAT_HVNC

Attributes
  • delay

    1

  • install

    true

  • install_file

    Windows Defender.exe

  • install_folder

    %Temp%

aes.plain

Targets

    • Target

      Client.exe

    • Size

      265KB

    • MD5

      73503a6b7502669d3937c8406cf97d22

    • SHA1

      dc9426f95a5b53cfe949f051ec96aca42775c97e

    • SHA256

      96cea5aa04bf16efa6f0c768643013fe621e1efd5e17180e1c4d26bba2c60823

    • SHA512

      2314a6972f3d268fd5a9209c5fa6484e0dfb2af07154060ca54c157ef345b27a5c279c9f15d5bec25292f5908e65f250533dcf4b3261f7b7acf0946fc7feb56d

    • SSDEEP

      3072:vviJueXGbbXBGmAtPBKCQCeLhiGGGGGGGGGGGGGGGGGGGGGGGG9YGGGnGGGGGGGV:y/XkbwHPBKCQC6hUvoJ2zG+MQ4

    Score
    10/10
    asyncratwindows defenderdiscoveryevasionpersistenceprivilege_escalationrat

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

      ratasyncrat

    • Async RAT payload

      rat

    • Grants admin privileges

      Uses net.exe to modify the user's privileges.

    • Modifies Windows Firewall

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Network Service Discovery

      Attempt to gather information on host's network.

      discovery

    • Enumerates processes with tasklist

      discovery
    behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Persistence

Account Manipulation

1
T1098

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Privilege Escalation

Account Manipulation

1
T1098

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Defense Evasion

Impair Defenses

1
T1562

Disable or Modify System Firewall

1
T1562.004

Credential Access

Discovery

Network Service Discovery

1
T1046

Permission Groups Discovery

1
T1069

Local Groups

1
T1069.001

Process Discovery

1
T1057

Query Registry

2
T1012

System Information Discovery

4
T1082

System Network Connections Discovery

1
T1049

Lateral Movement

Collection

Data from Local System

1
T1005

Command and Control

Exfiltration

Impact

Tasks