Overview

overview

10

Static

static

1

Output.bat

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Output.bat

  • Size

    1.1MB

  • Sample

    240629-yyk9fsveja

  • MD5

    1897b3980473ad054ab05b0f2ced4de7

  • SHA1

    a694b444dc8dd30e07f69671c3905ffb6fe13532

  • SHA256

    3d25b09ab5a16a6b49a7394175b3bce37ba2ae9ce8771408b05280b1bd14b036

  • SHA512

    6f67fe1aca76aa0ff33ebf7f1edc4bae6b25c34c543ffa8f59220e520dea91fe92bd50681a5d3086353ef245bd28887bca93efa276ad2544dfbdbdd188ba5ee1

  • SSDEEP

    24576:H9/ZDtETtFPa65VkOdET4sDgnVI4jGzwMVACzrDc:HqRcRBkwAGM

Score
10/10
asyncratquasarxwormdefaultevasionexecutionpersistenceprivilege_escalationratspywaretrojan

Malware Config

Extracted

Family

xworm

C2

best-bird.gl.at.ply.gg:27196

super-nearest.gl.at.ply.gg:17835

Extracted

Family

asyncrat

Botnet

Default

C2

finally-grande.gl.at.ply.gg:25844

Attributes
  • delay

    1

  • install

    false

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      Output.bat

    • Size

      1.1MB

    • MD5

      1897b3980473ad054ab05b0f2ced4de7

    • SHA1

      a694b444dc8dd30e07f69671c3905ffb6fe13532

    • SHA256

      3d25b09ab5a16a6b49a7394175b3bce37ba2ae9ce8771408b05280b1bd14b036

    • SHA512

      6f67fe1aca76aa0ff33ebf7f1edc4bae6b25c34c543ffa8f59220e520dea91fe92bd50681a5d3086353ef245bd28887bca93efa276ad2544dfbdbdd188ba5ee1

    • SSDEEP

      24576:H9/ZDtETtFPa65VkOdET4sDgnVI4jGzwMVACzrDc:HqRcRBkwAGM

    Score
    10/10
    asyncratquasarxwormdefaultevasionexecutionpersistenceprivilege_escalationratspywaretrojan

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

      ratasyncrat

    • Detect Xworm Payload

    • Modifies firewall policy service

      evasion

    • Modifies security service

      evasion

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

      trojanspywarequasar

    • Quasar payload

    • Xworm

      Xworm is a remote access trojan written in C#.

      trojanratxworm

    • Async RAT payload

      rat

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops file in System32 directory

    behavioral1

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

PowerShell

1
T1059.001

Persistence

Create or Modify System Process

2
T1543

Windows Service

2
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Privilege Escalation

Create or Modify System Process

2
T1543

Windows Service

2
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Defense Evasion

Modify Registry

3
T1112

Impair Defenses

1
T1562

Disable or Modify System Firewall

1
T1562.004

Credential Access

Discovery

Query Registry

5
T1012

System Information Discovery

5
T1082

Peripheral Device Discovery

1
T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks