Overview

overview

10

Static

static

3

becf832ddc...e9.exe

windows7-x64

10

becf832ddc...e9.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    becf832ddc730f55b034b135640ba2149334c29eca1291509d64c35bcf2a6ce9

  • Size

    266KB

  • Sample

    240701-ck49hsshjg

  • MD5

    d65b5445fa5e3736626098ef689331c5

  • SHA1

    b62313172586337872dd25b1ecb968c9c5a9010e

  • SHA256

    becf832ddc730f55b034b135640ba2149334c29eca1291509d64c35bcf2a6ce9

  • SHA512

    769adc82278c4dbce0a42769119d7ca7fca17712d4ae6a7669ae95d54060e0fa89d142479d080b7c569142d6471f25697324277c3619d0fb3ede78ce8a8e0337

  • SSDEEP

    3072:WdvzDqxs8ORikgogWfiuRXd3YmSffdTKXNXANewGBvskX1pWA/s8w:WFzDqa86hV6uRRqX1evPlwAEJ

Score
10/10
asyncratpersistencerat

Malware Config

Targets

    • Target

      becf832ddc730f55b034b135640ba2149334c29eca1291509d64c35bcf2a6ce9

    • Size

      266KB

    • MD5

      d65b5445fa5e3736626098ef689331c5

    • SHA1

      b62313172586337872dd25b1ecb968c9c5a9010e

    • SHA256

      becf832ddc730f55b034b135640ba2149334c29eca1291509d64c35bcf2a6ce9

    • SHA512

      769adc82278c4dbce0a42769119d7ca7fca17712d4ae6a7669ae95d54060e0fa89d142479d080b7c569142d6471f25697324277c3619d0fb3ede78ce8a8e0337

    • SSDEEP

      3072:WdvzDqxs8ORikgogWfiuRXd3YmSffdTKXNXANewGBvskX1pWA/s8w:WFzDqa86hV6uRRqX1evPlwAEJ

    Score
    10/10
    asyncratpersistencerat

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

      ratasyncrat

    • Contains code to disable Windows Defender

      A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

    • Detects Windows executables referencing non-Windows User-Agents

    • Detects executables containing artifacts associated with disabling Widnows Defender

    • Detects executables embedding registry key / value combination indicative of disabling Windows Defender features

    • Detects file containing reversed ASEP Autorun registry keys

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks