General
- Target 192.exe
- Size 423KB
- Sample260905-wx2tpsgl5w
- SHA256 08295c1247b7ce6dc020bfba5ba75540e3b5c98665ba99f2f73b37016811f47c
Malware Config
Targets
-
- Target 192.exe
- Size 423KB
- SHA256 08295c1247b7ce6dc020bfba5ba75540e3b5c98665ba99f2f73b37016811f47c
Score10/10-
Async RAT payload
-
Detects DonutLoader
-
Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Creates a file in the Startup directory
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
-
Executes dropped EXE
-
Loads dropped DLL
-
- Target C:/Users/Public/Documents/11.exe
- Size 202KB
- SHA256 db413d7a7f36a922d30489d4df22d8fecd4da3a6e08f0a227ca770d6afa24bc3
Score1/10 -
- Target C:/Users/Public/Documents/dbgeng.dll
- Size 452KB
- SHA256 53abcbd55948172502618a66218a7d68ea986106e084cd07bd4c9321d58689f7
Score1/10
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1