Extracted

Extracted

• • Target
    dmmm3.exe
  • Size 90KB
  • SHA256 3e0b643f6532c376297100d659c371cdb049d08d3a90b82e21d3676c13d75735
  • MD5 c1c47d14b6f92861fd801630ae87f75f
  • SHA1 0a06d7ff917b285b53956fa79982787fda245fae
  • SHA512 b160767f16e415896cf11d33eaca2ab47dc3c1dc3227c959ba23883067b8407ece56b54c662df96c1e4c688081becd7c3719df18c1567b3d0f8cead297d841b7
  • SSDEEP 1536:oPtLFi5GaiYSWmOdAJbkffcyLNFcZAlymyyRLdEU51:oPgGaixYAJbkXcWVFpp1
  • TLSH
    T1D593E9443BFD4112F2BF5FBC99B161048A7AB9636811DB5D1CE420CD0A72FC49992BBB
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  adwaredefaultdefense_evasiondiscoveryexecutionasyncratpersistenceprivilege_escalationratspyware

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Modifies WinLogon for persistence

    persistence

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Event Triggered Execution: Image File Execution Options Injection

    persistence

  • Sets service image path in registry

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Registers new Windows logon scripts automatically executed at logon.

    persistence

  • Adds Run key to start application

    persistence
  behavioral1behavioral2