asyncrat | d5957803eb8a1c83dd84f7d08d431c9ad3a7e3c29814f8b46b805083f5b4899a

General

Target

Dekont.pdf.exe
Size

1006KB
MD5

9b37096274af2542b2e8e5460a32ad92
SHA1

fd1bd3fe73844de5f69dfc4b42e9f40aa4395308
SHA256

d5957803eb8a1c83dd84f7d08d431c9ad3a7e3c29814f8b46b805083f5b4899a
SHA512

2297155b35eadd6d0fcad613d954558f116c9ff660ce7470f428123a99840747056e8648d51c31b86ccd900ace9075f4888e47dd9cac8dc228f40c21e49de994
SSDEEP

24576:2TbBv5rUDKoU7LEoW9MZBGa6mXcqIAXiAZfzI6l:IBUUPEjKGLAXiAZz

Score

10^/10

asyncrat stormkitty default rat stealer

Malware Config

Extracted

Family

asyncrat

Botnet

Default

C2

127.0.0.1:6606

127.0.0.1:7707

127.0.0.1:8808

https://api.telegram.org/bot6889241853:AAHAa8eUBd5h6tWRG0OvgDx7o1_LKQJi-y8/sendMessage?chat_id=6367688286

Mutex

AsyncMutex_6SI8OkPnk

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
StormKitty
StormKitty is an open source info stealer written in C#.
stealer stormkitty

StormKitty payload 3 IoCs

resource	yara_rule
behavioral2/memory/2432-55-0x0000000000620000-0x0000000001620000-memory.dmp	family_stormkitty
behavioral2/memory/2432-56-0x0000000000620000-0x0000000000650000-memory.dmp	family_stormkitty
behavioral2/memory/2432-58-0x000000000F910000-0x000000000F920000-memory.dmp	family_stormkitty

Async RAT payload 2 IoCs

rat

resource	yara_rule
behavioral2/memory/2432-55-0x0000000000620000-0x0000000001620000-memory.dmp	asyncrat
behavioral2/memory/2432-56-0x0000000000620000-0x0000000000650000-memory.dmp	asyncrat

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
40	icanhazip.com

Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3368	ipconfig.exe
4060	ipconfig.exe

C:\Users\Admin\AppData\Local\Temp\Dekont.pdf.exe
"C:\Users\Admin\AppData\Local\Temp\Dekont.pdf.exe"
1⤵
PID:2144
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\dgmc.vbe"
  2⤵
  PID:3532
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c ipconfig /release
    3⤵
    PID:4748
  - - C:\Windows\SysWOW64\ipconfig.exe
      ipconfig /release
      4⤵
      Gathers network information
      PID:4060
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c innlltqdtq.exe tirru.msc
    3⤵
    PID:3512
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c ipconfig /renew
    3⤵
    PID:4892

C:\Users\Admin\AppData\Local\Temp\RarSFX0\innlltqdtq.exe
innlltqdtq.exe tirru.msc
1⤵
PID:4676
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  PID:2432
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All
    3⤵
    PID:3960
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid
    3⤵
    PID:4068
  - - C:\Windows\SysWOW64\netsh.exe
      netsh wlan show networks mode=bssid
      4⤵
      PID:824
  - - C:\Windows\SysWOW64\chcp.com
      chcp 65001
      4⤵
      PID:1088

C:\Windows\SysWOW64\ipconfig.exe
ipconfig /renew
1⤵
- Gathers network information
PID:3368

C:\Windows\SysWOW64\findstr.exe
findstr All
1⤵
PID:2408

C:\Windows\SysWOW64\netsh.exe
netsh wlan show profile
1⤵
PID:3928

C:\Windows\SysWOW64\chcp.com
chcp 65001
1⤵
PID:1568

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RarSFX0\dgmc.vbe

Filesize
61KB

MD5
223e418a5069dfcfb8d61f5b4519a123

SHA1
9d68dec1ac850812890321e836c9dfd207409776

SHA256
dbb4a26b43ad9039c07a966522f664ff9d95511d36e35c7f8b7b233e8bbbbd84

SHA512
d25d601e14ba9506c2423c2dd37770436fa894bc26d55b9bbae7bdb77846a6c96d9717f0e4605f72a6e20f327b0079aac6f0c129885e62b2ecd2412b67f13fee

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\innlltqdtq.exe

Filesize
384KB

MD5
2df3fc0b0f6b6bfdf51b56af325e41a1

SHA1
6abbc31d99e775a3a42e468830db71e12f3ffd67

SHA256
fc48655d010e97a6fdc35c14dd1773218f0b610f0192f76375aa9dd47a04646f

SHA512
577ea17093a124ce5fc661a9d0e962d4de8c2ee8f4e9008d031234b3a37f636abed5bb490a818c1d2944b67fc82123508fa7bd46bda3b3ed3a1f224d480ad5c3

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\jmsfmvjc.3gp

Filesize
42KB

MD5
802a42df47211020f63e3a050b3dbcd8

SHA1
b7037c56899d4032c5fbfaf3b54d202cbf415615

SHA256
52904d235ea9092b2a021827b3249a954e800931c8e44b067fb79bb8887496f7

SHA512
048708da64d4fb7a04dda7d655b33cb3efa413f43e44f73643c8c95e68c7d6639dc137a75c950ccf817440c1e630765de8fce86fbfec911c605a596391b2989d

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\tirru.msc

Filesize
92KB

MD5
3bd0396f3d7a3cff156561116b3affad

SHA1
6a35abe27be4f7f6ca84449f4ae0356d88b0d799

SHA256
413fe23d25dc37ef22a241280dffad928ce8ff7b5e7d7a84838052450306fa19

SHA512
1abd79b1e8e6407aa69ae8e608fffe2a17d970dbb0e44a4053616c1868d63e68b42543b2028c9d67c5627a90c6c9fd653f0d476934143aca6adee022199b3881

Download Submit
memory/2432-59-0x000000000F9C0000-0x000000000FA26000-memory.dmp

Filesize
408KB

Download
memory/2432-56-0x0000000000620000-0x0000000000650000-memory.dmp

Filesize
192KB

Download
memory/2432-57-0x0000000071FD0000-0x0000000072780000-memory.dmp

Filesize
7.7MB

Download
memory/2432-58-0x000000000F910000-0x000000000F920000-memory.dmp

Filesize
64KB

Download
memory/2432-55-0x0000000000620000-0x0000000001620000-memory.dmp

Filesize
16.0MB

Download
memory/2432-230-0x000000000F910000-0x000000000F920000-memory.dmp

Filesize
64KB

Download
memory/2432-232-0x0000000010420000-0x00000000104B2000-memory.dmp

Filesize
584KB

Download
memory/2432-233-0x0000000010A70000-0x0000000011014000-memory.dmp

Filesize
5.6MB

Download
memory/2432-237-0x0000000010500000-0x000000001050A000-memory.dmp

Filesize
40KB

Download
memory/2432-243-0x00000000109B0000-0x00000000109C2000-memory.dmp

Filesize
72KB

Download
memory/2432-267-0x0000000071FD0000-0x0000000072780000-memory.dmp

Filesize
7.7MB

Download
memory/2432-268-0x000000000F910000-0x000000000F920000-memory.dmp

Filesize
64KB

Download
memory/2432-269-0x000000000F910000-0x000000000F920000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing