Overview

overview

10

Static

static

3

132.exe

windows10-2004-x64

10

132.exe

windows11-ltsc_2024-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    132.exe
  • Size 181KB
  • Sample260830-3qpn5abl6x
  • SHA256 9109d9bd117f540aed9afa6f293c1396cc18ed979056eadca97c69e3f957c14d
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
asyncratdonutloaderdefaultdefense_evasiondiscoveryexecutionloaderpersistencerat

Malware Config

Extracted

Family

  • asyncrat

Version

  • BwRat 1.0.0

Botnet

  • Default

C2

  • 112.213.103.58:5812

Mutex

  • DcRatMutex_qwqdanchun

Attributes
  • delay

    1

  • install

    false

  • install_folder

    %AppData%

aes.plain

Targets

    • Target
      132.exe
    • Size 181KB
    • SHA256 9109d9bd117f540aed9afa6f293c1396cc18ed979056eadca97c69e3f957c14d
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    defaultdefense_evasiondiscoveryexecutionasyncratdonutloaderloaderpersistencerat

    • Async RAT payload

      rat

    • Detects DonutLoader

      loader

    • Family: AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

      ratasyncrat

    • Family: DonutLoader

      DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

      loaderdonutloader

    • Modifies WinLogon for persistence

      persistence

    • Adds policy Run key to start application

      persistence

    • Creates new service(s)

      persistenceexecution

    • Stops running service(s)

      defense_evasionexecution

    • Adds Run key to start application

      persistence

    • Indicator Removal: Clear Persistence

      Clear artifacts associated with previously established persistence like scheduletasks on a host.

      defense_evasion
    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

Windows Command Shell

1
T1059.003

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

System Services

2
T1569

Service Execution

2
T1569.002

Persistence

Boot or Logon Autostart Execution

3
T1547

Registry Run Keys / Startup Folder

2
T1547.001

Winlogon Helper DLL

1
T1547.004

Create or Modify System Process

2
T1543

Windows Service

2
T1543.003

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

3
T1547

Registry Run Keys / Startup Folder

2
T1547.001

Winlogon Helper DLL

1
T1547.004

Create or Modify System Process

2
T1543

Windows Service

2
T1543.003

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Defense Evasion

Impair Defenses

1
T1562

Indicator Removal

1
T1070

Clear Persistence

1
T1070.009

Modify Registry

3
T1112

Credential Access

Discovery

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

1
T1489

Tasks