Extracted

• • Target
    7e865d77cc98964cb403fad981a9538e4c65b37c74cb998ef5dcc57151ad6c59.exe
  • Size 13.0MB
  • SHA256 7e865d77cc98964cb403fad981a9538e4c65b37c74cb998ef5dcc57151ad6c59
  • MD5 af3198e9c8dfe23fc32e5f188cd37065
  • SHA1 e5e85ba741f28469c8b85a2c9a635005b1a6e37b
  • SHA512 d0aeb147150b0dae2435d2dfa127b598d7afc45cdd8b25db92226d73e1d9b595d3c580e5a939fa70003d4ec3ba2f6733718148bf4ee66ff745a3903d8a7e391f
  • SSDEEP 393216:e7whmWJnoyMxtDDAxXtN3ZWn2T4w0h7y4s5o:e7whm+noy2AltN3gnPd
  • TLSH
    T14ED633F7775009B8E02D4236A958403D891F740C07EBEC1B4A672E617FA72ED6E74A6C
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  admindefense_evasiondiscoveryexecutionasyncratxmrigminerpersistenceprivilege_escalationrat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Family: xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • XMRig Miner payload

    miner

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Modifies Windows Firewall

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Obfuscated Files or Information: Command Obfuscation

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion

  • Executes a VBScript file via the Windows Script Host.

    execution

  • Hide Artifacts: Hidden Files and Directories

    defense_evasion

  • Suspicious use of SetThreadContext

  behavioral1behavioral2