Overview

overview

10

Static

static

10

1e3966e77a...5b.exe

windows10-2004-x64

6

1e3966e77a...5b.exe

windows11-ltsc_2024-x64

6

76123bdf89...1d.exe

windows10-2004-x64

10

76123bdf89...1d.exe

windows11-ltsc_2024-x64

10

ee6febf6f1...69.exe

windows10-2004-x64

3

ee6febf6f1...69.exe

windows11-ltsc_2024-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target
    new_samples.zip
  • Size 1.0MB
  • Sample260720-psmqnacw2s
  • SHA256 5e781d3c73732f56f8daace697c6cd96182b15f102c3e25d5985329d3921823a
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
asyncratdefaultdefense_evasiondiscoveryexecutionpersistenceratrevoked_codesignspywaretrojanupx

Malware Config

Extracted

Family

  • asyncrat

Version

  • 1.0.7

Botnet

  • Default

C2

  • castlerocks.za.com:8080

  • castlerocks.za.com:443

  • castlerocks.za.com:8848

  • castlerocks.za.com:8888

  • app.castlerocks.za.com:8080

  • app.castlerocks.za.com:443

  • app.castlerocks.za.com:8848

  • app.castlerocks.za.com:8888

Mutex

  • DcRatMutex_qwqdanchun

Attributes
  • delay

    1

  • install

    true

  • install_file

    app.exe

  • install_folder

    %AppData%

aes.plain

Targets

    • Target
      1e3966e77ad1cbf3e3ef76803fbf92300b2b88af39650a1208520e0cdc05645b.exe
    • Size 766KB
    • SHA256 1e3966e77ad1cbf3e3ef76803fbf92300b2b88af39650a1208520e0cdc05645b
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    6/10
    discoverypersistenceupx

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2
    • Target
      76123bdf89c69344ccbf5a7770d92c40d49adcde963a9546054aa783fb6b581d.exe
    • Size 129KB
    • SHA256 76123bdf89c69344ccbf5a7770d92c40d49adcde963a9546054aa783fb6b581d
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    defaultdefense_evasionexecutionasyncratpersistencerat

    • Async RAT payload

      rat

    • Family: AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

      ratasyncrat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    behavioral3behavioral4
    • Target
      ee6febf6f1a088dd965ba800989fcf27e2392454c15370f3231a8cefd7934969.exe
    • Size 176KB
    • SHA256 ee6febf6f1a088dd965ba800989fcf27e2392454c15370f3231a8cefd7934969
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    defense_evasionspywaretrojan
    behavioral5behavioral6

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

Windows Command Shell

1
T1059.003

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Defense Evasion

Modify Registry

2
T1112

Subvert Trust Controls

2
T1553

Install Root Certificate

2
T1553.004

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks