Analysis
-
max time kernel
151s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
11-08-2023 14:32
Static task
static1
Behavioral task
behavioral1
Sample
fe.exe
Resource
win7-20230712-en
General
-
Target
fe.exe
-
Size
24.0MB
-
MD5
fe7a215f58c846f671142227e0a71061
-
SHA1
f40c456ce9f674ee93d3ef691c1b3aec0c53156b
-
SHA256
69a281695cfceb02aec31b7ecc8105a60d606b2fc168ab32964380cd5fa79827
-
SHA512
ff7efbd82997f802339407e709f074277ea609ac1f30ba1d768c5daac4a4990b7a731361717874fe98d524e0a012333e8b45ea1f83a1cc793fd0a06d8296b1ae
-
SSDEEP
393216:VT4ER8LcdmjoDuUKQhgL9bH3x0PmFhpbgab/bKh17KfxRu7i4Kw5jnS01oufNTda:VT4ER0pjoNvhcX6u1blb/bEmZRGi4Lb5
Malware Config
Extracted
asyncrat
Default
127.0.0.1:6606
127.0.0.1:7707
127.0.0.1:8808
https://api.telegram.org/bot6085983475:AAG9ma6AdbwS2Vmvqb_xIeiP1vbivSAPlXU/sendMessage?chat_id=1829819531
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
false
-
install_folder
%AppData%
Signatures
-
StormKitty
StormKitty is an open source info stealer written in C#.
-
StormKitty payload 4 IoCs
resource yara_rule behavioral2/files/0x00080000000231f2-140.dat family_stormkitty behavioral2/files/0x00080000000231f2-145.dat family_stormkitty behavioral2/files/0x00080000000231f2-146.dat family_stormkitty behavioral2/memory/4684-168-0x0000000000D80000-0x0000000000DB0000-memory.dmp family_stormkitty -
Async RAT payload 4 IoCs
resource yara_rule behavioral2/files/0x00080000000231f2-140.dat asyncrat behavioral2/files/0x00080000000231f2-145.dat asyncrat behavioral2/files/0x00080000000231f2-146.dat asyncrat behavioral2/memory/4684-168-0x0000000000D80000-0x0000000000DB0000-memory.dmp asyncrat -
Executes dropped EXE 2 IoCs
pid Process 4684 deneme.exe 3452 ngrok.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 8 IoCs
description ioc Process File created C:\Users\Admin\AppData\Local\9d8acf90a00d8932071a5c4d5cc05447\Admin@GBSDSUCH_en-US\Grabber\DRIVE-C\Users\Admin\Downloads\desktop.ini deneme.exe File created C:\Users\Admin\AppData\Local\9d8acf90a00d8932071a5c4d5cc05447\Admin@GBSDSUCH_en-US\Grabber\DRIVE-C\Users\Admin\Pictures\Camera Roll\desktop.ini deneme.exe File created C:\Users\Admin\AppData\Local\9d8acf90a00d8932071a5c4d5cc05447\Admin@GBSDSUCH_en-US\Grabber\DRIVE-C\Users\Admin\Pictures\Saved Pictures\desktop.ini deneme.exe File created C:\Users\Admin\AppData\Local\9d8acf90a00d8932071a5c4d5cc05447\Admin@GBSDSUCH_en-US\Grabber\DRIVE-C\Users\Admin\Pictures\desktop.ini deneme.exe File opened for modification C:\Users\Admin\AppData\Local\9d8acf90a00d8932071a5c4d5cc05447\Admin@GBSDSUCH_en-US\Grabber\DRIVE-C\Users\Admin\Pictures\desktop.ini deneme.exe File created C:\Users\Admin\AppData\Local\9d8acf90a00d8932071a5c4d5cc05447\Admin@GBSDSUCH_en-US\Grabber\DRIVE-C\Users\Admin\Desktop\desktop.ini deneme.exe File opened for modification C:\Users\Admin\AppData\Local\9d8acf90a00d8932071a5c4d5cc05447\Admin@GBSDSUCH_en-US\Grabber\DRIVE-C\Users\Admin\Desktop\desktop.ini deneme.exe File created C:\Users\Admin\AppData\Local\9d8acf90a00d8932071a5c4d5cc05447\Admin@GBSDSUCH_en-US\Grabber\DRIVE-C\Users\Admin\Documents\desktop.ini deneme.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 32 icanhazip.com -
Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 31 IoCs
pid Process 3004 powershell.exe 3004 powershell.exe 3452 ngrok.exe 3452 ngrok.exe 3452 ngrok.exe 3452 ngrok.exe 4684 deneme.exe 4684 deneme.exe 4684 deneme.exe 4684 deneme.exe 4684 deneme.exe 4684 deneme.exe 4684 deneme.exe 4684 deneme.exe 4684 deneme.exe 4684 deneme.exe 4684 deneme.exe 4684 deneme.exe 4684 deneme.exe 4684 deneme.exe 4684 deneme.exe 4684 deneme.exe 4684 deneme.exe 4684 deneme.exe 4684 deneme.exe 4684 deneme.exe 4684 deneme.exe 4684 deneme.exe 4684 deneme.exe 4684 deneme.exe 4684 deneme.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 3004 powershell.exe Token: SeDebugPrivilege 4684 deneme.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 2236 wrote to memory of 3004 2236 fe.exe 81 PID 2236 wrote to memory of 3004 2236 fe.exe 81 PID 2236 wrote to memory of 4684 2236 fe.exe 82 PID 2236 wrote to memory of 4684 2236 fe.exe 82 PID 2236 wrote to memory of 4684 2236 fe.exe 82 PID 2236 wrote to memory of 3452 2236 fe.exe 84 PID 2236 wrote to memory of 3452 2236 fe.exe 84 PID 4684 wrote to memory of 2348 4684 deneme.exe 94 PID 4684 wrote to memory of 2348 4684 deneme.exe 94 PID 4684 wrote to memory of 2348 4684 deneme.exe 94 PID 2348 wrote to memory of 3404 2348 cmd.exe 96 PID 2348 wrote to memory of 3404 2348 cmd.exe 96 PID 2348 wrote to memory of 3404 2348 cmd.exe 96 PID 2348 wrote to memory of 1680 2348 cmd.exe 97 PID 2348 wrote to memory of 1680 2348 cmd.exe 97 PID 2348 wrote to memory of 1680 2348 cmd.exe 97 PID 2348 wrote to memory of 1316 2348 cmd.exe 98 PID 2348 wrote to memory of 1316 2348 cmd.exe 98 PID 2348 wrote to memory of 1316 2348 cmd.exe 98 PID 4684 wrote to memory of 4536 4684 deneme.exe 100 PID 4684 wrote to memory of 4536 4684 deneme.exe 100 PID 4684 wrote to memory of 4536 4684 deneme.exe 100 PID 4536 wrote to memory of 2092 4536 cmd.exe 102 PID 4536 wrote to memory of 2092 4536 cmd.exe 102 PID 4536 wrote to memory of 2092 4536 cmd.exe 102 PID 4536 wrote to memory of 4624 4536 cmd.exe 103 PID 4536 wrote to memory of 4624 4536 cmd.exe 103 PID 4536 wrote to memory of 4624 4536 cmd.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\fe.exe"C:\Users\Admin\AppData\Local\Temp\fe.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHMAYgBmACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGEAdQBiACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHAAbgBsACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBhACMAPgA="2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3004
-
-
C:\Users\Admin\AppData\Local\Temp\deneme.exe"C:\Users\Admin\AppData\Local\Temp\deneme.exe"2⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4684 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All3⤵
- Suspicious use of WriteProcessMemory
PID:2348 -
C:\Windows\SysWOW64\chcp.comchcp 650014⤵PID:3404
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile4⤵PID:1680
-
-
C:\Windows\SysWOW64\findstr.exefindstr All4⤵PID:1316
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid3⤵
- Suspicious use of WriteProcessMemory
PID:4536 -
C:\Windows\SysWOW64\chcp.comchcp 650014⤵PID:2092
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid4⤵PID:4624
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\ngrok.exe"C:\Users\Admin\AppData\Local\Temp\ngrok.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3452
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2B
MD5d1fe173d08e959397adf34b1d77e88d7
SHA1b74f5ee9461495ba5ca4c72a7108a23904c27a05
SHA25698a3ab7c340e8a033e7b37b6ef9428751581760af67bbab2b9e05d4964a8874a
SHA5127bf79737110a1d25ffc719d9a8df5f5caf32f9f270ba0a560cc320f3a30366a4b20bfad4a4b35119a0764a0130f96f0c505ef3537a2295f6ee8ac1acb8eb36d4
-
C:\Users\Admin\AppData\Local\9d8acf90a00d8932071a5c4d5cc05447\Admin@GBSDSUCH_en-US\System\Process.txt
Filesize4KB
MD5200c67b1d18854d440c4b7e4dc033eeb
SHA1c0d27be0a49b7fb41f742438fb7494e313beca34
SHA2560d3b5cc201d193df781d53979fb40f8a944b83a1d3e7129263460be78fe2adc2
SHA5126bb0f7418ff1657de7b9ab2d8e7ef8431390230aae0ec1e386d5ed513c472c232b67e716848d96946c3e38332b2f1a838208d715c9fce8b755f5b12cd4beff9d
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
170KB
MD5958062458cd994df325348bb9f8f9d11
SHA16d678d971f4239f9304a3a6ac9941b9d7de1ba27
SHA256109f96c67f55689c41320f832134501ec02389a813eba1d990d192ab378ad533
SHA512e73c665f0cd3cc53ea4ca0ef50d196fce4783488759bd9f6b8d9cb842382e88327509a317dd328ddf7b7fc988cde06a46cd82fe2783165f75d5f812e231affff
-
Filesize
170KB
MD5958062458cd994df325348bb9f8f9d11
SHA16d678d971f4239f9304a3a6ac9941b9d7de1ba27
SHA256109f96c67f55689c41320f832134501ec02389a813eba1d990d192ab378ad533
SHA512e73c665f0cd3cc53ea4ca0ef50d196fce4783488759bd9f6b8d9cb842382e88327509a317dd328ddf7b7fc988cde06a46cd82fe2783165f75d5f812e231affff
-
Filesize
170KB
MD5958062458cd994df325348bb9f8f9d11
SHA16d678d971f4239f9304a3a6ac9941b9d7de1ba27
SHA256109f96c67f55689c41320f832134501ec02389a813eba1d990d192ab378ad533
SHA512e73c665f0cd3cc53ea4ca0ef50d196fce4783488759bd9f6b8d9cb842382e88327509a317dd328ddf7b7fc988cde06a46cd82fe2783165f75d5f812e231affff
-
Filesize
23.8MB
MD51c900bf7791f168639d27e19a90a9be7
SHA1ff6b857b8aaf8d9ed72ae300575aeb4ff21925db
SHA256b25a372ebb6692fbc2d3697467a7611dbbd521dd61ed995fa82c170c3ef50300
SHA512c0a96693031c56b4375478e7c15f41ef512b7eec72496e26dcb5dc688b13431852e2c30f98ef25a2d06df421e8c688b17fa603887ef3ae6980c6ee3789fe2988
-
Filesize
23.8MB
MD51c900bf7791f168639d27e19a90a9be7
SHA1ff6b857b8aaf8d9ed72ae300575aeb4ff21925db
SHA256b25a372ebb6692fbc2d3697467a7611dbbd521dd61ed995fa82c170c3ef50300
SHA512c0a96693031c56b4375478e7c15f41ef512b7eec72496e26dcb5dc688b13431852e2c30f98ef25a2d06df421e8c688b17fa603887ef3ae6980c6ee3789fe2988
-
Filesize
23.8MB
MD51c900bf7791f168639d27e19a90a9be7
SHA1ff6b857b8aaf8d9ed72ae300575aeb4ff21925db
SHA256b25a372ebb6692fbc2d3697467a7611dbbd521dd61ed995fa82c170c3ef50300
SHA512c0a96693031c56b4375478e7c15f41ef512b7eec72496e26dcb5dc688b13431852e2c30f98ef25a2d06df421e8c688b17fa603887ef3ae6980c6ee3789fe2988