asyncrat | 0f90e79e032587cae06aa617716d7a0b54e472ff07814f8ded3080cb7bb331ee

Analysis

max time kernel
80s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
14/09/2022, 22:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
core.exe
Size 17KB
Sample220914-19jacafbhl
SHA256 0f90e79e032587cae06aa617716d7a0b54e472ff07814f8ded3080cb7bb331ee
MD5 6a11efa7426680b2cb0ff4c3350f3f29
SHA1 af9a7e2e34a6c9c70018c8281b3942f20bce5a64
SHA512 3afc332349080ece7d05db5c1dded587bec58a207d9e7afb1f7c284a1bafceca0760ea139a50d80574c6eb03579ee29649ba98e5bc541192f1c4867db51f4ff2
SSDEEP 384:Ubok0K/Hm8+f+gqdSLWIbjIkMuy6NdhCJO+HKv9lY6UW:Ukk0K/5+f0sWIbvHrheOZ1lY6UW
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

asyncrat stormkitty rat stealer

Malware Config

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
rat asyncrat
StormKitty
StormKitty is an open source info stealer written in C#.
stealer stormkitty

StormKitty payload 1 IoCs

resource	yara_rule
behavioral2/memory/3228-145-0x0000000000400000-0x000000000054E000-memory.dmp	family_stormkitty

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral2/memory/3228-145-0x0000000000400000-0x000000000054E000-memory.dmp	asyncrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	core.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4736 set thread context of 3228	4736	core.exe	90

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
4952	powershell.exe
4952	powershell.exe
4736	core.exe
4220	powershell.exe
4220	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4952	powershell.exe
Token: SeDebugPrivilege	4736	core.exe
Token: SeDebugPrivilege	4220	powershell.exe
Token: SeDebugPrivilege	3228	InstallUtil.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 4736 wrote to memory of 4952	4736	core.exe	79
PID 4736 wrote to memory of 4952	4736	core.exe	79
PID 4736 wrote to memory of 4952	4736	core.exe	79
PID 4736 wrote to memory of 4220	4736	core.exe	87
PID 4736 wrote to memory of 4220	4736	core.exe	87
PID 4736 wrote to memory of 4220	4736	core.exe	87
PID 4736 wrote to memory of 3228	4736	core.exe	90
PID 4736 wrote to memory of 3228	4736	core.exe	90
PID 4736 wrote to memory of 3228	4736	core.exe	90
PID 4736 wrote to memory of 3228	4736	core.exe	90
PID 4736 wrote to memory of 3228	4736	core.exe	90
PID 4736 wrote to memory of 3228	4736	core.exe	90
PID 4736 wrote to memory of 3228	4736	core.exe	90
PID 4736 wrote to memory of 3228	4736	core.exe	90

C:\Users\Admin\AppData\Local\Temp\core.exe
"C:\Users\Admin\AppData\Local\Temp\core.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4736
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Start-Sleep -Seconds 30
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4952
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAANQAwAA==
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4220
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3228

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 53KB
SHA256 474813b625f00710f29fa3b488235a6a22201851efb336bddf60d7d24a66bfba
MD5 06ad34f9739c5159b4d92d702545bd49
SHA1 9152a0d4f153f3f40f7e606be75f81b582ee0c17
SHA512 c272cd28ae164d465b779163ba9eca6a28261376414c6bbdfbd9f2128adb7f7ff1420e536b4d6000d0301ded2ec9036bc5c657588458bff41f176bdce8d74f92
SSDEEP 1536:q5C+jH04tAHkCSMrxyNhftflJdPYoFi3j39MVvjMLUsszyhMUp7Fv+Eca5b/h4ie:KC+jH04tAHk5MrxyNhftflJdPYoFi3jc
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3228-148-0x00000000059E0000-0x0000000005A7C000-memory.dmp

Download

memory/3228-147-0x0000000005B00000-0x00000000060A4000-memory.dmp

Download

memory/3228-146-0x0000000002E20000-0x0000000002E42000-memory.dmp

Download

memory/3228-145-0x0000000000400000-0x000000000054E000-memory.dmp

Download

memory/4736-132-0x0000000000070000-0x000000000007A000-memory.dmp

Download

memory/4952-136-0x0000000005310000-0x0000000005332000-memory.dmp

Download

memory/4952-141-0x00000000068E0000-0x00000000068FA000-memory.dmp

Download

memory/4952-140-0x0000000007C10000-0x000000000828A000-memory.dmp

Download

memory/4952-139-0x00000000063D0000-0x00000000063EE000-memory.dmp

Download

memory/4952-138-0x0000000005530000-0x0000000005596000-memory.dmp

Download

memory/4952-137-0x00000000054C0000-0x0000000005526000-memory.dmp

Download

memory/4952-135-0x00000000055E0000-0x0000000005C08000-memory.dmp

Download

memory/4952-134-0x0000000002AA0000-0x0000000002AD6000-memory.dmp

Download