asyncrat | 646d0fa0bc6f0b37f0eded18a574f927106e6b9ff18aa9a173d33ced3b25017c

Analysis

max time kernel
147s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
21/06/2023, 02:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 225KB
Sample230621-c35yrsfc85
SHA256 646d0fa0bc6f0b37f0eded18a574f927106e6b9ff18aa9a173d33ced3b25017c
MD5 f0cb9c5ed742e82039a3921688c3d097
SHA1 bbdc3a912100bfafdf0ee1dc97a023b33c9e5571
SHA512 33481c4d0fe5b02ea780c72759f90b7eed838559b3f7494932db44d94aa288ac9ef6f33e53e88bf51321a1617683439d2e7daf63e45ad072af1c9db42cccef38
SSDEEP 3072:y+STW8djpN6izj8mZwnmLG+j5LHeTlKN/UbBRvz8brbQBGJ4sC4du6+Wpm:v8XN6W8mmnmLG+j5kmUbDvrf4
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

asyncrat stormkitty default rat spyware stealer

Malware Config

Extracted

Family

asyncrat

Botnet

Default

127.0.0.1:6606
127.0.0.1:7707
127.0.0.1:8808
https://api.telegram.org/bot6154715708:AAHIUDtLy5ebOPHMJ5QuP4wzhDI4_P37RBY/sendMessage?chat_id=1165040754

Mutex

AsyncMutex_6SI8OkPnk

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
StormKitty
StormKitty is an open source info stealer written in C#.
stealer stormkitty

StormKitty payload 1 IoCs

resource	yara_rule
behavioral2/memory/3224-133-0x0000000000EC0000-0x0000000000EFE000-memory.dmp	family_stormkitty

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral2/memory/3224-133-0x0000000000EC0000-0x0000000000EFE000-memory.dmp	asyncrat

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Drops desktop.ini file(s) 8 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\f634dd350db6217b0ba96ba0fce869d7\Admin@HCIDPJOT_en-US\Grabber\DRIVE-C\Users\Admin\Documents\desktop.ini	file.exe
File created	C:\Users\Admin\AppData\Local\f634dd350db6217b0ba96ba0fce869d7\Admin@HCIDPJOT_en-US\Grabber\DRIVE-C\Users\Admin\Desktop\desktop.ini	file.exe
File created	C:\Users\Admin\AppData\Local\f634dd350db6217b0ba96ba0fce869d7\Admin@HCIDPJOT_en-US\Grabber\DRIVE-C\Users\Admin\Downloads\desktop.ini	file.exe
File opened for modification	C:\Users\Admin\AppData\Local\f634dd350db6217b0ba96ba0fce869d7\Admin@HCIDPJOT_en-US\Grabber\DRIVE-C\Users\Admin\Downloads\desktop.ini	file.exe
File created	C:\Users\Admin\AppData\Local\f634dd350db6217b0ba96ba0fce869d7\Admin@HCIDPJOT_en-US\Grabber\DRIVE-C\Users\Admin\Pictures\desktop.ini	file.exe
File created	C:\Users\Admin\AppData\Local\f634dd350db6217b0ba96ba0fce869d7\Admin@HCIDPJOT_en-US\Grabber\DRIVE-C\Users\Admin\Pictures\Camera Roll\desktop.ini	file.exe
File created	C:\Users\Admin\AppData\Local\f634dd350db6217b0ba96ba0fce869d7\Admin@HCIDPJOT_en-US\Grabber\DRIVE-C\Users\Admin\Pictures\Saved Pictures\desktop.ini	file.exe
File created	C:\Users\Admin\AppData\Local\f634dd350db6217b0ba96ba0fce869d7\Admin@HCIDPJOT_en-US\Grabber\DRIVE-C\Users\Admin\Documents\desktop.ini	file.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
25	icanhazip.com

Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	file.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	file.exe

Suspicious behavior: EnumeratesProcesses 25 IoCs

pid	Process
3224	file.exe
3224	file.exe
3224	file.exe
3224	file.exe
3224	file.exe
3224	file.exe
3224	file.exe
3224	file.exe
3224	file.exe
3224	file.exe
3224	file.exe
3224	file.exe
3224	file.exe
3224	file.exe
3224	file.exe
3224	file.exe
3224	file.exe
3224	file.exe
3224	file.exe
3224	file.exe
3224	file.exe
3224	file.exe
3224	file.exe
3224	file.exe
3224	file.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3224	file.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 3224 wrote to memory of 1032	3224	file.exe	88
PID 3224 wrote to memory of 1032	3224	file.exe	88
PID 3224 wrote to memory of 1032	3224	file.exe	88
PID 1032 wrote to memory of 5020	1032	cmd.exe	90
PID 1032 wrote to memory of 5020	1032	cmd.exe	90
PID 1032 wrote to memory of 5020	1032	cmd.exe	90
PID 1032 wrote to memory of 4788	1032	cmd.exe	91
PID 1032 wrote to memory of 4788	1032	cmd.exe	91
PID 1032 wrote to memory of 4788	1032	cmd.exe	91
PID 1032 wrote to memory of 4320	1032	cmd.exe	92
PID 1032 wrote to memory of 4320	1032	cmd.exe	92
PID 1032 wrote to memory of 4320	1032	cmd.exe	92
PID 3224 wrote to memory of 3316	3224	file.exe	93
PID 3224 wrote to memory of 3316	3224	file.exe	93
PID 3224 wrote to memory of 3316	3224	file.exe	93
PID 3316 wrote to memory of 2868	3316	cmd.exe	95
PID 3316 wrote to memory of 2868	3316	cmd.exe	95
PID 3316 wrote to memory of 2868	3316	cmd.exe	95
PID 3316 wrote to memory of 3376	3316	cmd.exe	96
PID 3316 wrote to memory of 3376	3316	cmd.exe	96
PID 3316 wrote to memory of 3376	3316	cmd.exe	96

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3224
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1032
- - C:\Windows\SysWOW64\chcp.com
    chcp 65001
    3⤵
    PID:5020
- - C:\Windows\SysWOW64\netsh.exe
    netsh wlan show profile
    3⤵
    PID:4788
- - C:\Windows\SysWOW64\findstr.exe
    findstr All
    3⤵
    PID:4320
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3316
- - C:\Windows\SysWOW64\chcp.com
    chcp 65001
    3⤵
    PID:2868
- - C:\Windows\SysWOW64\netsh.exe
    netsh wlan show networks mode=bssid
    3⤵
    PID:3376

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

msgid.dat

Path C:\Users\Admin\AppData\Local\0e50617d7ae01cdb0050cbf28492112f\msgid.dat
Size 4B
SHA256 2315bd64e75a346541681575e5b227059bc726907f5a5b893505b648a3062e77
MD5 afe434653a898da20044041262b3ac74
SHA1 ee176776f84a8e7eb91c3560943535558748ab9e
SHA512 fe563a8a3e842094a20ab2263438dedd05cf2b347a0e541a4198a855514788fe8a3c1ddfdaf6af76a554da878694296b74e7cbe75eaf4a94111cde51299c9faf
MD5 SHA1 SHA512

Submit Download

Bookmarks.txt

Path C:\Users\Admin\AppData\Local\f634dd350db6217b0ba96ba0fce869d7\Admin@HCIDPJOT_en-US\Browsers\Firefox\Bookmarks.txt
Size 105B
SHA256 c84c98bbf5e0ef9c8d0708b5d60c5bb656b7d6be5135d7f7a8d25557e08cf142
MD5 2e9d094dda5cdc3ce6519f75943a4ff4
SHA1 5d989b4ac8b699781681fe75ed9ef98191a5096c
SHA512 d1f7eed00959e902bdb2125b91721460d3ff99f3bdfc1f2a343d4f58e8d4e5e5a06c0c6cdc0379211c94510f7c00d7a8b34fa7d0ca0c3d54cbbe878f1e9812b7
MD5 SHA1 SHA512

Submit Download

Process.txt

Path C:\Users\Admin\AppData\Local\f634dd350db6217b0ba96ba0fce869d7\Admin@HCIDPJOT_en-US\System\Process.txt
Size 4KB
SHA256 286fb4b35278616727a93804375cee59bc3096a686b9fbb6958c946dbf9ceb26
MD5 8b9618379b19a3666e3fc6160765e833
SHA1 872580e78f526bb89985802efa686db452a226ff
SHA512 22899d5081eb3ce1d26b360570395e6afc728d96105ca791abbd253f3b5c933afe3d99e326922930708a198e32ba052e8d920c37abd948ef14937bb5afaa5b23
SSDEEP 48:C3RL/SBfanXNRWbcwjo23Vc2gDI7Rtb1uqcE0Yk:C3RLqBsNRWwwjo23VcFDI7RtBDX0Yk
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3224-275-0x00000000067C0000-0x0000000006852000-memory.dmp

Download

memory/3224-212-0x0000000005870000-0x0000000005880000-memory.dmp

Download

memory/3224-135-0x0000000005980000-0x00000000059E6000-memory.dmp

Download

memory/3224-133-0x0000000000EC0000-0x0000000000EFE000-memory.dmp

Download

memory/3224-276-0x0000000006E10000-0x00000000073B4000-memory.dmp

Download

memory/3224-278-0x0000000005870000-0x0000000005880000-memory.dmp

Download

memory/3224-281-0x00000000069F0000-0x00000000069FA000-memory.dmp

Download

memory/3224-134-0x0000000005870000-0x0000000005880000-memory.dmp

Download

memory/3224-287-0x0000000006A80000-0x0000000006A92000-memory.dmp

Download

memory/3224-311-0x0000000005870000-0x0000000005880000-memory.dmp

Download