Extracted

Extracted

• • Target
    RE_42002683_EG.lnk
  • Size 1KB
  • SHA256 bc5368ce2f8ee8694732302feb62ad901b8520423ecbdfda51d872f29dac6fd1
  • MD5 89efa8d1723b3f17988744d2b2bd57e3
  • SHA1 12a25e515d66b5766cce0d512e45897b1252db78
  • SHA512 9cb849ef71c37dda27a5b39127d4e5a5ca1f18bb9b183f82a47a4dfa21ffc196b69d907135ce760ec320529cb6ed6304d0cfc4ba8e45c1dc76c248cc13ad7e61
  • TLSH
    T10431EF022FD14678F2B549715C33BB65D6BBF81A4A09C22E818419459C17F14D43DBF7
  • MD5 SHA1 SHA512 TLSH

  Score

  10^/10

  jan 1[26]jan-26collectiondefense_evasiondiscoveryexecutionasyncratdonutloaderloaderpersistencerat

  • Async RAT payload

    rat

  • Detects DonutLoader

    loader

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to get system information as a root user.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates processes with tasklist

    discovery
  behavioral1behavioral2
• • Target
    logutil_5tcen6.dll
  • Size 14KB
  • SHA256 b2fa2988c6ad45276eaf737416fafb8328d90a452eff47f5ca5b9770f87c87bd
  • MD5 33875da893fcfdffb8d52244229c776f
  • SHA1 21a65ba0e6298acebb063e04b02d00e3754d6934
  • SHA512 55b629fc56b39965e703761f76aab75ab8fcc20207e9e61afed1522a96cbaa4dc7f33bb3e28fa07a7b1ea31c3105b9d77f4ffca4045c8c287cbcb35a1628e1a0
  • SSDEEP 96:ix0flL+u6HgEXyoFl3PvMLsu/B4lFVA2Z8gVsWYyMz17GRbqPe1pt8V+9L+3SbcD:a0NCHgEXJrMZBgVfc1Kc21po+F+4d4L
  • TLSH
    T12362A90E321358E9C54AC5B941EB4B79B6F9B811C9F65B3C4334DA322EB07A5672AE10
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  adwarejan 1[26]jan-26collectiondefense_evasiondiscoveryexecutionasyncratdonutloaderloaderpersistenceratspyware

  • Async RAT payload

    rat

  • Detects DonutLoader

    loader

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates processes with tasklist

    discovery
  behavioral3behavioral4