asyncrat | 82acc1095843da9a689f138666b41520ccb2bda8be0c8b3cd734adbfa14d6746

General

Target

82acc1095843da9a689f138666b41520ccb2bda8be0c8b3cd734adbfa14d6746.exe
Size

335KB
MD5

c7fbe52e88456eabb4d4a1a1a0670cf4
SHA1

3b479f15645c31c7067c31aede6e1802093ac78b
SHA256

82acc1095843da9a689f138666b41520ccb2bda8be0c8b3cd734adbfa14d6746
SHA512

3302aa29196e3864850c7f6bfdc274a285f3f51fd1d60b0e728caa29b4f25bc70f30429819de1ea27855841fa0ec00f0fec69c1745794a96c5c19d11d0c8fa05
SSDEEP

6144:wcjrQ/rcaXeLfKqsmLjCkHhUcuS37N7E+rdR2cFoWIEh89dHHWtjunUU:wcjiuJsmXCkStSLNnRVFopEhAdH2tK

Score

10^/10

asyncrat stormkitty default persistence rat spyware stealer

Malware Config

Extracted

Family

asyncrat

Botnet

Default

C2

127.0.0.1:6606

127.0.0.1:7707

127.0.0.1:8808

https://api.telegram.org/bot5980420064:AAHGrlOU2WsgF90Pcyz-L7wrGgC_Cj54k4Q/sendMessage?chat_id=806259874

Mutex

AsyncMutex_6SI8OkPnk

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
rat asyncrat
StormKitty
StormKitty is an open source info stealer written in C#.
stealer stormkitty

StormKitty payload 4 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1044-55-0x000000001A8E0000-0x000000001A936000-memory.dmp	family_stormkitty
C:\Users\Admin\AppData\Local\Temp\wwst.exe	family_stormkitty
C:\Users\Admin\AppData\Local\Temp\wwst.exe	family_stormkitty
behavioral1/memory/1204-66-0x0000000000CA0000-0x0000000000CD2000-memory.dmp	family_stormkitty

Async RAT payload 4 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1044-55-0x000000001A8E0000-0x000000001A936000-memory.dmp	asyncrat
C:\Users\Admin\AppData\Local\Temp\wwst.exe	asyncrat
C:\Users\Admin\AppData\Local\Temp\wwst.exe	asyncrat
behavioral1/memory/1204-66-0x0000000000CA0000-0x0000000000CD2000-memory.dmp	asyncrat

Executes dropped EXE 3 IoCs

Processes:

WindowsDataC.exeRunIt.exewwst.exe

pid process

1304 WindowsDataC.exe
1096 RunIt.exe
1204 wwst.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

pid	process
1304	WindowsDataC.exe
1096	RunIt.exe
1204	wwst.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

82acc1095843da9a689f138666b41520ccb2bda8be0c8b3cd734adbfa14d6746.exeRunIt.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsDataC.exe = "C:\\ProgramData\\WindowsDataC.exe"	82acc1095843da9a689f138666b41520ccb2bda8be0c8b3cd734adbfa14d6746.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\Rnts.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Rnts.exe"	RunIt.exe

Drops desktop.ini file(s) 8 IoCs

Processes:

wwst.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Local\7e055254bc7ffda9edff77063f0aa4d8\Admin@ZERMMMDR_en-US\Grabber\DRIVE-C\Users\Admin\Documents\desktop.ini	wwst.exe
File created	C:\Users\Admin\AppData\Local\7e055254bc7ffda9edff77063f0aa4d8\Admin@ZERMMMDR_en-US\Grabber\DRIVE-C\Users\Admin\Pictures\desktop.ini	wwst.exe
File created	C:\Users\Admin\AppData\Local\7e055254bc7ffda9edff77063f0aa4d8\Admin@ZERMMMDR_en-US\Grabber\DRIVE-C\Users\Admin\Downloads\desktop.ini	wwst.exe
File created	C:\Users\Admin\AppData\Local\7e055254bc7ffda9edff77063f0aa4d8\Admin@ZERMMMDR_en-US\Grabber\DRIVE-C\Users\Admin\Documents\desktop.ini	wwst.exe
File opened for modification	C:\Users\Admin\AppData\Local\7e055254bc7ffda9edff77063f0aa4d8\Admin@ZERMMMDR_en-US\Grabber\DRIVE-C\Users\Admin\Pictures\desktop.ini	wwst.exe
File opened for modification	C:\Users\Admin\AppData\Local\7e055254bc7ffda9edff77063f0aa4d8\Admin@ZERMMMDR_en-US\Grabber\DRIVE-C\Users\Admin\Downloads\desktop.ini	wwst.exe
File created	C:\Users\Admin\AppData\Local\7e055254bc7ffda9edff77063f0aa4d8\Admin@ZERMMMDR_en-US\Grabber\DRIVE-C\Users\Admin\Desktop\desktop.ini	wwst.exe
File opened for modification	C:\Users\Admin\AppData\Local\7e055254bc7ffda9edff77063f0aa4d8\Admin@ZERMMMDR_en-US\Grabber\DRIVE-C\Users\Admin\Desktop\desktop.ini	wwst.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

4 icanhazip.com
Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

flow	ioc
4	icanhazip.com

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

wwst.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	wwst.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	wwst.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

wwst.exe

pid process

1204 wwst.exe
1204 wwst.exe
1204 wwst.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

wwst.exe

description pid process

Token: SeDebugPrivilege 1204 wwst.exe

pid	process
1204	wwst.exe
1204	wwst.exe
1204	wwst.exe

description	pid	process
Token: SeDebugPrivilege	1204	wwst.exe

Suspicious use of WriteProcessMemory 39 IoCs

Processes:

82acc1095843da9a689f138666b41520ccb2bda8be0c8b3cd734adbfa14d6746.exewwst.execmd.execmd.exe

description	pid	process	target process
PID 1044 wrote to memory of 1304	1044	82acc1095843da9a689f138666b41520ccb2bda8be0c8b3cd734adbfa14d6746.exe	WindowsDataC.exe
PID 1044 wrote to memory of 1304	1044	82acc1095843da9a689f138666b41520ccb2bda8be0c8b3cd734adbfa14d6746.exe	WindowsDataC.exe
PID 1044 wrote to memory of 1304	1044	82acc1095843da9a689f138666b41520ccb2bda8be0c8b3cd734adbfa14d6746.exe	WindowsDataC.exe
PID 1044 wrote to memory of 1096	1044	82acc1095843da9a689f138666b41520ccb2bda8be0c8b3cd734adbfa14d6746.exe	RunIt.exe
PID 1044 wrote to memory of 1096	1044	82acc1095843da9a689f138666b41520ccb2bda8be0c8b3cd734adbfa14d6746.exe	RunIt.exe
PID 1044 wrote to memory of 1096	1044	82acc1095843da9a689f138666b41520ccb2bda8be0c8b3cd734adbfa14d6746.exe	RunIt.exe
PID 1044 wrote to memory of 1096	1044	82acc1095843da9a689f138666b41520ccb2bda8be0c8b3cd734adbfa14d6746.exe	RunIt.exe
PID 1044 wrote to memory of 1204	1044	82acc1095843da9a689f138666b41520ccb2bda8be0c8b3cd734adbfa14d6746.exe	wwst.exe
PID 1044 wrote to memory of 1204	1044	82acc1095843da9a689f138666b41520ccb2bda8be0c8b3cd734adbfa14d6746.exe	wwst.exe
PID 1044 wrote to memory of 1204	1044	82acc1095843da9a689f138666b41520ccb2bda8be0c8b3cd734adbfa14d6746.exe	wwst.exe
PID 1044 wrote to memory of 1204	1044	82acc1095843da9a689f138666b41520ccb2bda8be0c8b3cd734adbfa14d6746.exe	wwst.exe
PID 1204 wrote to memory of 1980	1204	wwst.exe	cmd.exe
PID 1204 wrote to memory of 1980	1204	wwst.exe	cmd.exe
PID 1204 wrote to memory of 1980	1204	wwst.exe	cmd.exe
PID 1204 wrote to memory of 1980	1204	wwst.exe	cmd.exe
PID 1980 wrote to memory of 608	1980	cmd.exe	chcp.com
PID 1980 wrote to memory of 608	1980	cmd.exe	chcp.com
PID 1980 wrote to memory of 608	1980	cmd.exe	chcp.com
PID 1980 wrote to memory of 608	1980	cmd.exe	chcp.com
PID 1980 wrote to memory of 296	1980	cmd.exe	netsh.exe
PID 1980 wrote to memory of 296	1980	cmd.exe	netsh.exe
PID 1980 wrote to memory of 296	1980	cmd.exe	netsh.exe
PID 1980 wrote to memory of 296	1980	cmd.exe	netsh.exe
PID 1980 wrote to memory of 1564	1980	cmd.exe	findstr.exe
PID 1980 wrote to memory of 1564	1980	cmd.exe	findstr.exe
PID 1980 wrote to memory of 1564	1980	cmd.exe	findstr.exe
PID 1980 wrote to memory of 1564	1980	cmd.exe	findstr.exe
PID 1204 wrote to memory of 1624	1204	wwst.exe	cmd.exe
PID 1204 wrote to memory of 1624	1204	wwst.exe	cmd.exe
PID 1204 wrote to memory of 1624	1204	wwst.exe	cmd.exe
PID 1204 wrote to memory of 1624	1204	wwst.exe	cmd.exe
PID 1624 wrote to memory of 1352	1624	cmd.exe	chcp.com
PID 1624 wrote to memory of 1352	1624	cmd.exe	chcp.com
PID 1624 wrote to memory of 1352	1624	cmd.exe	chcp.com
PID 1624 wrote to memory of 1352	1624	cmd.exe	chcp.com
PID 1624 wrote to memory of 1532	1624	cmd.exe	netsh.exe
PID 1624 wrote to memory of 1532	1624	cmd.exe	netsh.exe
PID 1624 wrote to memory of 1532	1624	cmd.exe	netsh.exe
PID 1624 wrote to memory of 1532	1624	cmd.exe	netsh.exe

C:\Users\Admin\AppData\Local\Temp\82acc1095843da9a689f138666b41520ccb2bda8be0c8b3cd734adbfa14d6746.exe
"C:\Users\Admin\AppData\Local\Temp\82acc1095843da9a689f138666b41520ccb2bda8be0c8b3cd734adbfa14d6746.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1044

C:\ProgramData\WindowsDataC.exe
"C:\ProgramData\WindowsDataC.exe"
2⤵
- Executes dropped EXE
PID:1304

C:\Users\Admin\AppData\Local\Temp\RunIt.exe
"C:\Users\Admin\AppData\Local\Temp\RunIt.exe"
2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:1096

C:\Users\Admin\AppData\Local\Temp\wwst.exe
"C:\Users\Admin\AppData\Local\Temp\wwst.exe"
2⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1204

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All
3⤵
- Suspicious use of WriteProcessMemory
PID:1980

C:\Windows\SysWOW64\chcp.com
chcp 65001
4⤵
PID:608

C:\Windows\SysWOW64\netsh.exe
netsh wlan show profile
4⤵
PID:296

C:\Windows\SysWOW64\findstr.exe
findstr All
4⤵
PID:1564

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid
3⤵
- Suspicious use of WriteProcessMemory
PID:1624

C:\Windows\SysWOW64\chcp.com
chcp 65001
4⤵
PID:1352

C:\Windows\SysWOW64\netsh.exe
netsh wlan show networks mode=bssid
4⤵
PID:1532

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials in Files

1

T1081

Discovery

System Information Discovery

2

T1082

Query Registry

1

T1012

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\WindowsDataC.exe
Filesize
335KB

MD5
c7fbe52e88456eabb4d4a1a1a0670cf4

SHA1
3b479f15645c31c7067c31aede6e1802093ac78b

SHA256
82acc1095843da9a689f138666b41520ccb2bda8be0c8b3cd734adbfa14d6746

SHA512
3302aa29196e3864850c7f6bfdc274a285f3f51fd1d60b0e728caa29b4f25bc70f30429819de1ea27855841fa0ec00f0fec69c1745794a96c5c19d11d0c8fa05

Download Submit
C:\ProgramData\WindowsDataC.exe
Filesize
335KB

MD5
c7fbe52e88456eabb4d4a1a1a0670cf4

SHA1
3b479f15645c31c7067c31aede6e1802093ac78b

SHA256
82acc1095843da9a689f138666b41520ccb2bda8be0c8b3cd734adbfa14d6746

SHA512
3302aa29196e3864850c7f6bfdc274a285f3f51fd1d60b0e728caa29b4f25bc70f30429819de1ea27855841fa0ec00f0fec69c1745794a96c5c19d11d0c8fa05

Download Submit
C:\Users\Admin\AppData\Local\Temp\RunIt.exe
Filesize
143KB

MD5
d067619856f7f3079375960f62b99369

SHA1
964d548557dec3aa8e851526b71adca4b4ddbfd5

SHA256
9770561d2a27dbc16c230fe88af51f718d7d6274fcd63a3f109c381be848b4a9

SHA512
1ec891082ac133833217ce8314f6d163451c5554b789cbf8a5ff0d5ebd0b55a7ec49ea5c408bf784e6952a37526de9e77e6c39b9a4ea3b950c3fda44e7f973b8

Download Submit
C:\Users\Admin\AppData\Local\Temp\RunIt.exe
Filesize
143KB

MD5
d067619856f7f3079375960f62b99369

SHA1
964d548557dec3aa8e851526b71adca4b4ddbfd5

SHA256
9770561d2a27dbc16c230fe88af51f718d7d6274fcd63a3f109c381be848b4a9

SHA512
1ec891082ac133833217ce8314f6d163451c5554b789cbf8a5ff0d5ebd0b55a7ec49ea5c408bf784e6952a37526de9e77e6c39b9a4ea3b950c3fda44e7f973b8

Download Submit
C:\Users\Admin\AppData\Local\Temp\wwst.exe
Filesize
175KB

MD5
5224b9398f4ed7a52b85b432b3d50a04

SHA1
c7bfe32e841f87c2b15a8a9266ddb981e8786157

SHA256
82e62dbfd6aa5df5162e2a6a9cd5a0dfb97f94fb5f5bf531ca9f974ec0464ae2

SHA512
2a6374f9bbad9f198e671d2707abfee1d74af935da62c89acac9e5be6467008b96f1879e61ab76a4a9fbf4b568b8d2f697bbc4fe79dc32eef7461686ca245ef0

Download Submit
C:\Users\Admin\AppData\Local\Temp\wwst.exe
Filesize
175KB

MD5
5224b9398f4ed7a52b85b432b3d50a04

SHA1
c7bfe32e841f87c2b15a8a9266ddb981e8786157

SHA256
82e62dbfd6aa5df5162e2a6a9cd5a0dfb97f94fb5f5bf531ca9f974ec0464ae2

SHA512
2a6374f9bbad9f198e671d2707abfee1d74af935da62c89acac9e5be6467008b96f1879e61ab76a4a9fbf4b568b8d2f697bbc4fe79dc32eef7461686ca245ef0

Download Submit
memory/296-76-0x0000000000000000-mapping.dmp

Download
memory/608-75-0x0000000000000000-mapping.dmp

Download
memory/1044-55-0x000000001A8E0000-0x000000001A936000-memory.dmp

Filesize
344KB

Download
memory/1044-70-0x000000001AF66000-0x000000001AF85000-memory.dmp

Filesize
124KB

Download
memory/1044-54-0x0000000000360000-0x00000000003BC000-memory.dmp

Filesize
368KB

Download
memory/1096-67-0x0000000000F40000-0x0000000000F6A000-memory.dmp

Filesize
168KB

Download
memory/1096-60-0x0000000000000000-mapping.dmp

Download
memory/1096-72-0x0000000004D35000-0x0000000004D46000-memory.dmp

Filesize
68KB

Download
memory/1204-73-0x00000000043C5000-0x00000000043D6000-memory.dmp

Filesize
68KB

Download
memory/1204-68-0x0000000075601000-0x0000000075603000-memory.dmp

Filesize
8KB

Download
memory/1204-66-0x0000000000CA0000-0x0000000000CD2000-memory.dmp

Filesize
200KB

Download
memory/1204-61-0x0000000000000000-mapping.dmp

Download
memory/1204-83-0x00000000043C5000-0x00000000043D6000-memory.dmp

Filesize
68KB

Download
memory/1304-71-0x00000000002B6000-0x00000000002D5000-memory.dmp

Filesize
124KB

Download
memory/1304-59-0x0000000001350000-0x00000000013AC000-memory.dmp

Filesize
368KB

Download
memory/1304-56-0x0000000000000000-mapping.dmp

Download
memory/1352-80-0x0000000000000000-mapping.dmp

Download
memory/1532-81-0x0000000000000000-mapping.dmp

Download
memory/1564-77-0x0000000000000000-mapping.dmp

Download
memory/1624-79-0x0000000000000000-mapping.dmp

Download
memory/1980-74-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads