Overview

overview

10

Static

static

10

Client.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Client.exe

  • Size

    63KB

  • Sample

    241101-aden6ssrhw

  • MD5

    95a90a84d38204747c8f158d0cb15a86

  • SHA1

    0ad40240b22dece3be97794eae74218521bdde56

  • SHA256

    1dd578c827eb3f79672a66c65b71f4571823e78cb23481bb6a86f7b2094acc57

  • SHA512

    7e49f76c37456246449a4587216f626685f27e39bdd1ef7c3aafe47b1ef94a90e13cb90769717eb6b473fec6598f5a034f897f014f2b261eab57c4b4b7728fca

  • SSDEEP

    1536:zhLpLbRQkB4+ENtJeeiMl8GbbXw/sPzhGhZVclN:zhLpLbRQkB4ttceFmGbbX1bAzY

Score
10/10
asyncratdefaultdiscoveryevasionpersistenceprivilege_escalationrat

Malware Config

Extracted

Family

asyncrat

Version

1.0.7

Botnet

Default

Mutex

NUEJFR_RT

Attributes
  • delay

    1

  • install

    true

  • install_file

    svchost.exe

  • install_folder

    %AppData%

  • pastebin_config

    https://pastebin.com/raw/c5xtcUfn

aes.plain

Targets

    • Target

      Client.exe

    • Size

      63KB

    • MD5

      95a90a84d38204747c8f158d0cb15a86

    • SHA1

      0ad40240b22dece3be97794eae74218521bdde56

    • SHA256

      1dd578c827eb3f79672a66c65b71f4571823e78cb23481bb6a86f7b2094acc57

    • SHA512

      7e49f76c37456246449a4587216f626685f27e39bdd1ef7c3aafe47b1ef94a90e13cb90769717eb6b473fec6598f5a034f897f014f2b261eab57c4b4b7728fca

    • SSDEEP

      1536:zhLpLbRQkB4+ENtJeeiMl8GbbXw/sPzhGhZVclN:zhLpLbRQkB4ttceFmGbbX1bAzY

    Score
    10/10
    asyncratdefaultdiscoveryevasionpersistenceprivilege_escalationrat

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

      ratasyncrat

    • Asyncrat family

      asyncrat

    • Async RAT payload

      rat

    • Grants admin privileges

      Uses net.exe to modify the user's privileges.

    • Modifies Windows Firewall

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Legitimate hosting services abused for malware hosting/C2

    • Network Service Discovery

      Attempt to gather information on host's network.

      discovery

    • Enumerates processes with tasklist

      discovery
    behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Persistence

Account Manipulation

1
T1098

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Privilege Escalation

Account Manipulation

1
T1098

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Defense Evasion

Impair Defenses

1
T1562

Disable or Modify System Firewall

1
T1562.004

Credential Access

Discovery

Network Service Discovery

1
T1046

Peripheral Device Discovery

1
T1120

Permission Groups Discovery

1
T1069

Local Groups

1
T1069.001

Process Discovery

1
T1057

Query Registry

3
T1012

System Information Discovery

5
T1082

System Network Connections Discovery

1
T1049

Lateral Movement

Collection

Data from Local System

1
T1005

Command and Control

Web Service

1
T1102

Exfiltration

Impact

Tasks