General

  • Target

    Builder WorldWind Pro.zip

  • Size

    991KB

  • Sample

    230606-vcs6dsef72

  • MD5

    4a952a54799b2e4d3a865f62cb3dee83

  • SHA1

    0d00173fa4e28968f5fbb5db646e1d6d98e6fa5b

  • SHA256

    28553084a22a3336caf73b0c576843f93472e76a6586601def820db18dc025c0

  • SHA512

    0f7f5204d7a6a9599fad0114a81e3681096e5af868339a54d80269cde0b274576c8b78b47b36cb9b5e826f62bbde8d869c8b1c9c44aaabbefd455094e8083ebb

  • SSDEEP

    24576:OKG7SKaZIq3hYiaThGFvIkrlb4yBpssssssss0P0txRwlLcL:mOKK3/a1lkrlb10PGxSKL

Malware Config

Extracted

Family

asyncrat

Botnet

Default

C2

127.0.0.1:6606

127.0.0.1:7707

127.0.0.1:8808

Mutex

AsyncMutex_6SI8OkPnk

Attributes
  • delay

    3

  • install

    false

  • install_folder

    %AppData%

aes.plain

Extracted

Language
ps1
Source
URLs
ps1.dropper

https://rentry.org/nipkv/raw

Targets

    • Target

      Builder WorldWind Pro/Builder WorldWind Pro/Builder WorldWind Pro.exe

    • Size

      73KB

    • MD5

      15b7bffd31462f0ca361a1c2b2211f86

    • SHA1

      bdf831203ded29b82e4aa989f26fea441b6a20ba

    • SHA256

      1ef388812d9c21af5a0a508d5a37561deba51dcbebe9f8a5a9a7397300865580

    • SHA512

      c48fd5855527f2e2615b3614ad43c025fac85ef1538de2a52a6267e3e61be611b04854bbcad54111c56f3ce661159b94d1639414cb0ce0086f466163ed0d3153

    • SSDEEP

      768:6o9jqvFupCbxbbcaqcCNXdca6Nt//cO3wmhrV2pL:V9mN7B33dw

    Score
    10/10
    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Drops file in Drivers directory

    • Stops running service(s)

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Adds Run key to start application

    • Legitimate hosting services abused for malware hosting/C2

    • Suspicious use of SetThreadContext

    • Target

      Builder WorldWind Pro/Builder WorldWind Pro/DotNetZip.dll

    • Size

      448KB

    • MD5

      6d1c62ec1c2ef722f49b2d8dd4a4df16

    • SHA1

      1bb08a979b7987bc7736a8cfa4779383cb0ecfa6

    • SHA256

      00da1597d92235d3f84da979e2fa5dbf049bafb52c33bd6fc8ee7b29570c124c

    • SHA512

      c0dce8eaa52eb6c319d4be2eec4622bb3380c65b659cfb77ff51a4ada7d3e591e791ee823dad67b5556ffac5c060ff45d09dd1cc21baaf70ba89806647cb3bd2

    • SSDEEP

      6144:FuCIjOL8qwWN/jMlC/XiapWSu9vnITVxGtSV41kJDsTDD5rlGe6wfxLV/7:dZLJLdvOSsnjS4csBrge6sf7

    Score
    1/10
    • Target

      Builder WorldWind Pro/Builder WorldWind Pro/Extreme.Net.dll

    • Size

      121KB

    • MD5

      f79f0e3a0361cac000e2d3553753cd68

    • SHA1

      4314bcef76fddc9379a8f3a266b37d685d0adb79

    • SHA256

      8a6518ab7419fbec3ac9875baa3afb410ad1398c7aa622a09cd9084ec6cadfcd

    • SHA512

      c77516e7f5540ecd13fa5d8cecfce34629acecd9b5a445f5f48902c9e823328fa9a6694ecaa39f5b6053de61c2b850c2d87df25357548afaad6ec37eb3e5e355

    • SSDEEP

      3072:bdoECIgjBibgp2tBqL0Y++ruXqMG4ih3lbpMqc:bdoECIgUrG

    Score
    1/10
    • Target

      Builder WorldWind Pro/Builder WorldWind Pro/MetroFramework.Design.dll

    • Size

      16KB

    • MD5

      c853e9e8c720249198ff376f42328ef9

    • SHA1

      a56ee195148023571e26ffeaa5a736bc73a76c40

    • SHA256

      28089707733c92c7fade97e7b6fab4007e7b8bfd6dc7a8526a3ea597f1a30845

    • SHA512

      d21cf5cfe0a5e2f7d4c128e64e0decee28028297c804319fb957b1f0e60d62e3103976b95abc3d2bd5ba66801cb5fe9bef4bae067273079177be28c73132c739

    • SSDEEP

      384:k1q4fJwcRJTxK0JLBamLGqPkO9V1VFf5L7W1OYKjbq9w:6q4hwcRBJLBamSqPkO9V1ViGq9

    Score
    1/10
    • Target

      Builder WorldWind Pro/Builder WorldWind Pro/MetroFramework.Fonts.dll

    • Size

      656KB

    • MD5

      b8c8a532438c4b421081efb258355469

    • SHA1

      41aa88d5eaf398da55f712f30226b70492125be1

    • SHA256

      15a605129cac3663ba1ddb98f5798334fba5e7954ee36a69727299b4e366c2eb

    • SHA512

      511070c8cfe018e60e11d495393152e10aa2aa0c08cde84678ef3a0efd63ae5c562a47bfab883f4babd469b1873127bacc9c986cb2bc096985176f1dbf93b1fc

    • SSDEEP

      12288:5+/9JcJlYqCNktA+SXfGpq2fHowSqCNktA+SXfvJR9FrIJJaqCNktA+SXfUC:5+/3qlrCNoh+UqgIwhCNoh+JR9FrIJJw

    Score
    1/10
    • Target

      Builder WorldWind Pro/Builder WorldWind Pro/MetroFramework.dll

    • Size

      313KB

    • MD5

      b20f1b5e3d4e3df2d826e9870637cd06

    • SHA1

      a03bb47afdf9498be409ed5b56e945f6e143fb32

    • SHA256

      9e58f13deb328455f216f165588b5f5111ecd12042d7dd196686dfb0f0fc68eb

    • SHA512

      095c5956ebc114c4b380d2b43981bcabd221782530328a51cb2c6aec05a016dad2e5efae36810f6840611f77f589be1e1e7f2200738df3bca222381837033b2d

    • SSDEEP

      6144:Ys+J/PxfbpAQ1bZHE7Zhm6uOw0g749O2:qJ/PxzpAObhV6uO99O

    Score
    1/10
    • Target

      Builder WorldWind Pro/Builder WorldWind Pro/Mono.Cecil.dll

    • Size

      273KB

    • MD5

      80ea4bfe7944e2f384d97488c83d9d25

    • SHA1

      18789622bdff9d99683504faf2a302a194e3b6c0

    • SHA256

      1a1565804348c2e621e0a509cedaa516eeb7e9fadfbeefe58e1e9cf8ec16b915

    • SHA512

      561e8c8465c1989dcc6c03b221f24c0f5c0ee278ff244d171f1761c79ee83debcb00973e2027be28ae77e47956a192b2a4a019e83b2802c62639f5d375aabe5b

    • SSDEEP

      6144:P0eCY7BUB5SH41/sE0oWZSSCvXb9PKdJDkPWeUP:syK7t1EKWZS1vXbw

    Score
    1/10
    • Target

      Builder WorldWind Pro/Builder WorldWind Pro/stub.dll

    • Size

      171KB

    • MD5

      fd12ac8c2bce0eccd26b3f48a8ad4956

    • SHA1

      7b7c6548ea4e4e897968785126d4033a876c6d3e

    • SHA256

      c618d6362d0bfe7daf26d6c98271cc38c291e812548c13869c0d1bfb905531d0

    • SHA512

      cff76beea29e21c0c96bf5f1dc4bf419d1d5246c9cc111ff572909867588694ae80de22b663e2af8b33da52540d6053e106586738db05ec91fafc0055ec41631

    • SSDEEP

      3072:9ySRwk/N2wtuh77yHcokLZl9CPJ+dZ8BAgTepbDywAWY+WpY:OkV9tuh77ypkLTzyqnpbDq

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

    • StormKitty

      StormKitty is an open source info stealer written in C#.

    • StormKitty payload

    • Async RAT payload

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Modify Existing Service

1
T1031

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Impair Defenses

1
T1562

Modify Registry

1
T1112

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Command and Control

Web Service

1
T1102

Impact

Service Stop

1
T1489

Tasks