Malware sandboxing report by Hatching Triage

Sharing

Copy URL

Twitter E-mail

General

Target

Builder WorldWind Pro.zip
Size

991KB
Sample

230606-vcs6dsef72
MD5

4a952a54799b2e4d3a865f62cb3dee83
SHA1

0d00173fa4e28968f5fbb5db646e1d6d98e6fa5b
SHA256

28553084a22a3336caf73b0c576843f93472e76a6586601def820db18dc025c0
SHA512

0f7f5204d7a6a9599fad0114a81e3681096e5af868339a54d80269cde0b274576c8b78b47b36cb9b5e826f62bbde8d869c8b1c9c44aaabbefd455094e8083ebb
SSDEEP

24576:OKG7SKaZIq3hYiaThGFvIkrlb4yBpssssssss0P0txRwlLcL:mOKK3/a1lkrlb10PGxSKL

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Botnet

Default

127.0.0.1:6606

127.0.0.1:7707

127.0.0.1:8808

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Extracted

Language

ps1

Source

URLs

ps1.dropper

https://rentry.org/nipkv/raw

Targets

- Target
  
  Builder WorldWind Pro/Builder WorldWind Pro/Builder WorldWind Pro.exe
- Size
  
  73KB
- MD5
  
  15b7bffd31462f0ca361a1c2b2211f86
- SHA1
  
  bdf831203ded29b82e4aa989f26fea441b6a20ba
- SHA256
  
  1ef388812d9c21af5a0a508d5a37561deba51dcbebe9f8a5a9a7397300865580
- SHA512
  
  c48fd5855527f2e2615b3614ad43c025fac85ef1538de2a52a6267e3e61be611b04854bbcad54111c56f3ce661159b94d1639414cb0ce0086f466163ed0d3153
- SSDEEP
  
  768:6o9jqvFupCbxbbcaqcCNXdca6Nt//cO3wmhrV2pL:V9mN7B33dw
Score

10^/10

evasion persistence
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Blocklisted process makes network request
- Downloads MZ/PE file
- Drops file in Drivers directory
- Stops running service(s)
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Adds Run key to start application
  persistence
- Legitimate hosting services abused for malware hosting/C2
- Suspicious use of SetThreadContext
behavioral1
- Target
  
  Builder WorldWind Pro/Builder WorldWind Pro/DotNetZip.dll
- Size
  
  448KB
- MD5
  
  6d1c62ec1c2ef722f49b2d8dd4a4df16
- SHA1
  
  1bb08a979b7987bc7736a8cfa4779383cb0ecfa6
- SHA256
  
  00da1597d92235d3f84da979e2fa5dbf049bafb52c33bd6fc8ee7b29570c124c
- SHA512
  
  c0dce8eaa52eb6c319d4be2eec4622bb3380c65b659cfb77ff51a4ada7d3e591e791ee823dad67b5556ffac5c060ff45d09dd1cc21baaf70ba89806647cb3bd2
- SSDEEP
  
  6144:FuCIjOL8qwWN/jMlC/XiapWSu9vnITVxGtSV41kJDsTDD5rlGe6wfxLV/7:dZLJLdvOSsnjS4csBrge6sf7
Score

1^/10
behavioral2
- Target
  
  Builder WorldWind Pro/Builder WorldWind Pro/Extreme.Net.dll
- Size
  
  121KB
- MD5
  
  f79f0e3a0361cac000e2d3553753cd68
- SHA1
  
  4314bcef76fddc9379a8f3a266b37d685d0adb79
- SHA256
  
  8a6518ab7419fbec3ac9875baa3afb410ad1398c7aa622a09cd9084ec6cadfcd
- SHA512
  
  c77516e7f5540ecd13fa5d8cecfce34629acecd9b5a445f5f48902c9e823328fa9a6694ecaa39f5b6053de61c2b850c2d87df25357548afaad6ec37eb3e5e355
- SSDEEP
  
  3072:bdoECIgjBibgp2tBqL0Y++ruXqMG4ih3lbpMqc:bdoECIgUrG
Score

1^/10
behavioral3
- Target
  
  Builder WorldWind Pro/Builder WorldWind Pro/MetroFramework.Design.dll
- Size
  
  16KB
- MD5
  
  c853e9e8c720249198ff376f42328ef9
- SHA1
  
  a56ee195148023571e26ffeaa5a736bc73a76c40
- SHA256
  
  28089707733c92c7fade97e7b6fab4007e7b8bfd6dc7a8526a3ea597f1a30845
- SHA512
  
  d21cf5cfe0a5e2f7d4c128e64e0decee28028297c804319fb957b1f0e60d62e3103976b95abc3d2bd5ba66801cb5fe9bef4bae067273079177be28c73132c739
- SSDEEP
  
  384:k1q4fJwcRJTxK0JLBamLGqPkO9V1VFf5L7W1OYKjbq9w:6q4hwcRBJLBamSqPkO9V1ViGq9
Score

1^/10
behavioral4
- Target
  
  Builder WorldWind Pro/Builder WorldWind Pro/MetroFramework.Fonts.dll
- Size
  
  656KB
- MD5
  
  b8c8a532438c4b421081efb258355469
- SHA1
  
  41aa88d5eaf398da55f712f30226b70492125be1
- SHA256
  
  15a605129cac3663ba1ddb98f5798334fba5e7954ee36a69727299b4e366c2eb
- SHA512
  
  511070c8cfe018e60e11d495393152e10aa2aa0c08cde84678ef3a0efd63ae5c562a47bfab883f4babd469b1873127bacc9c986cb2bc096985176f1dbf93b1fc
- SSDEEP
  
  12288:5+/9JcJlYqCNktA+SXfGpq2fHowSqCNktA+SXfvJR9FrIJJaqCNktA+SXfUC:5+/3qlrCNoh+UqgIwhCNoh+JR9FrIJJw
Score

1^/10
behavioral5
- Target
  
  Builder WorldWind Pro/Builder WorldWind Pro/MetroFramework.dll
- Size
  
  313KB
- MD5
  
  b20f1b5e3d4e3df2d826e9870637cd06
- SHA1
  
  a03bb47afdf9498be409ed5b56e945f6e143fb32
- SHA256
  
  9e58f13deb328455f216f165588b5f5111ecd12042d7dd196686dfb0f0fc68eb
- SHA512
  
  095c5956ebc114c4b380d2b43981bcabd221782530328a51cb2c6aec05a016dad2e5efae36810f6840611f77f589be1e1e7f2200738df3bca222381837033b2d
- SSDEEP
  
  6144:Ys+J/PxfbpAQ1bZHE7Zhm6uOw0g749O2:qJ/PxzpAObhV6uO99O
Score

1^/10
behavioral6
- Target
  
  Builder WorldWind Pro/Builder WorldWind Pro/Mono.Cecil.dll
- Size
  
  273KB
- MD5
  
  80ea4bfe7944e2f384d97488c83d9d25
- SHA1
  
  18789622bdff9d99683504faf2a302a194e3b6c0
- SHA256
  
  1a1565804348c2e621e0a509cedaa516eeb7e9fadfbeefe58e1e9cf8ec16b915
- SHA512
  
  561e8c8465c1989dcc6c03b221f24c0f5c0ee278ff244d171f1761c79ee83debcb00973e2027be28ae77e47956a192b2a4a019e83b2802c62639f5d375aabe5b
- SSDEEP
  
  6144:P0eCY7BUB5SH41/sE0oWZSSCvXb9PKdJDkPWeUP:syK7t1EKWZS1vXbw
Score

1^/10
behavioral7
- Target
  
  Builder WorldWind Pro/Builder WorldWind Pro/stub.dll
- Size
  
  171KB
- MD5
  
  fd12ac8c2bce0eccd26b3f48a8ad4956
- SHA1
  
  7b7c6548ea4e4e897968785126d4033a876c6d3e
- SHA256
  
  c618d6362d0bfe7daf26d6c98271cc38c291e812548c13869c0d1bfb905531d0
- SHA512
  
  cff76beea29e21c0c96bf5f1dc4bf419d1d5246c9cc111ff572909867588694ae80de22b663e2af8b33da52540d6053e106586738db05ec91fafc0055ec41631
- SSDEEP
  
  3072:9ySRwk/N2wtuh77yHcokLZl9CPJ+dZ8BAgTepbDywAWY+WpY:OkV9tuh77ypkLTzyqnpbDq
Score

10^/10

asyncrat stormkitty default rat stealer
- AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- StormKitty
  StormKitty is an open source info stealer written in C#.
  stealer stormkitty
- StormKitty payload
- Async RAT payload
  rat
behavioral8

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

T1102

Impact

Service Stop

T1489

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Targets

Suspicious use of NtCreateUserProcessOtherParentProcess

Blocklisted process makes network request

Downloads MZ/PE file

Drops file in Drivers directory

Stops running service(s)

Checks computer location settings

Executes dropped EXE

Adds Run key to start application

Legitimate hosting services abused for malware hosting/C2

Suspicious use of SetThreadContext

AsyncRat

StormKitty

StormKitty payload

Async RAT payload

MITRE ATT&CK Matrix ATT&CK v6

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8