Analysis

  • max time kernel
    158s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20-03-2024 12:03

General

  • Target

    Serverv1.exe

  • Size

    175KB

  • MD5

    86ec635a29a4c13bd3d32d34ec028efe

  • SHA1

    c5ab23555b3921ae012aa945b9f1bb72dbd6fd59

  • SHA256

    e25817f6fe634b116ec878c734495b848b68a56a12cb43181bc07d9da3be3835

  • SHA512

    567e186c9f47bbf58114337e5bc2b696d2e65c93269b77cf60dc94f487b3c082196b30992d4992c2eee9dc9a59e7d0024d6bd2ae64e31e6515e699ff9f5065ea

  • SSDEEP

    3072:2e8oX8Sb5KcXrtkkXmf/bDsvqtU+lLToChAP0UZ0b2gT1wAqE+Wpor:XXtb5KcXr7XmfgqtjhAxZ0b26

Malware Config

Extracted

Family

asyncrat

Botnet

Default

C2

127.0.0.1:6606

127.0.0.1:7707

127.0.0.1:8808

https://api.telegram.org/bot6959532402:AAG6PUhEHO5sJn075QDj3pF3kOIEoYH6CpY/sendMessage?chat_id=6075361534

Mutex

AsyncMutex_6SI8OkPnk

Attributes
  • delay

    3

  • install

    false

  • install_folder

    %AppData%

aes.plain

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

  • StormKitty

    StormKitty is an open source info stealer written in C#.

  • StormKitty payload 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Drops desktop.ini file(s) 10 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Looks up geolocation information via web service

    Uses a legitimate geolocation service to find the infected system's geolocation info.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Serverv1.exe
    "C:\Users\Admin\AppData\Local\Temp\Serverv1.exe"
    1⤵
    • Drops desktop.ini file(s)
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1704
    • C:\Windows\SysWOW64\cmd.exe
      "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3048
      • C:\Windows\SysWOW64\chcp.com
        chcp 65001
        3⤵
          PID:3916
        • C:\Windows\SysWOW64\netsh.exe
          netsh wlan show profile
          3⤵
            PID:2868
          • C:\Windows\SysWOW64\findstr.exe
            findstr All
            3⤵
              PID:3468
          • C:\Windows\SysWOW64\cmd.exe
            "cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:5016
            • C:\Windows\SysWOW64\chcp.com
              chcp 65001
              3⤵
                PID:2572
              • C:\Windows\SysWOW64\netsh.exe
                netsh wlan show networks mode=bssid
                3⤵
                  PID:2208
            • C:\Windows\System32\rundll32.exe
              C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
              1⤵
                PID:3016
              • C:\Windows\system32\rundll32.exe
                "C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
                1⤵
                  PID:2512
                • C:\Windows\System32\svchost.exe
                  C:\Windows\System32\svchost.exe -k UnistackSvcGroup
                  1⤵
                  • Suspicious use of AdjustPrivilegeToken
                  PID:936

                Network

                MITRE ATT&CK Enterprise v15

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\Users\Admin\AppData\Local\14c7a52060ae13d63cf43467d962ab19\msgid.dat

                  Filesize

                  1B

                  MD5

                  cfcd208495d565ef66e7dff9f98764da

                  SHA1

                  b6589fc6ab0dc82cf12099d1c2d40ab994e8410c

                  SHA256

                  5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9

                  SHA512

                  31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99

                • C:\Users\Admin\AppData\Local\5ebf8879f5e766157b72a78c7a073672\Admin@MKDQUQPQ_en-US\System\Process.txt

                  Filesize

                  4KB

                  MD5

                  10143d6b360f19c15e42c771e4203a52

                  SHA1

                  ad79d9dc4e51dd353f61f3a34684f467cb9e6cc6

                  SHA256

                  7a3768c688f25d3cdbc3869512c067f3648660d8275d51c55ed5c1c45f6b2fe8

                  SHA512

                  a3b86aaa8b69c9fddfcead1622c4c254682922b93264e086944817b8f1e9ada337e45154de3287c7baab0984bd0e2ccb1645e45b8482df7b53fce52e80e80230

                • C:\Users\Admin\AppData\Local\Comms\UnistoreDB\store.jfm

                  Filesize

                  16KB

                  MD5

                  89c891803047aeb46ddbecb96f6aa300

                  SHA1

                  603c7e1ad219808a6680353fdd7454e16ad695fa

                  SHA256

                  2b5c6b9a356ee0c721f6faad137e52763e5dba7ce6658fdca7d99edf12644ceb

                  SHA512

                  0dfb264b9e8ed8ad14a7cb37fb8ee734cc75d8694eec0f5f8ad132bbb796183624bd8ef766da21c691a2a0d45f36057d39d2ef771c62607ee31a1d0fc81f0b28

                • memory/936-238-0x00000138EC380000-0x00000138EC381000-memory.dmp

                  Filesize

                  4KB

                • memory/936-239-0x00000138EC370000-0x00000138EC371000-memory.dmp

                  Filesize

                  4KB

                • memory/936-263-0x00000138EC5D0000-0x00000138EC5D1000-memory.dmp

                  Filesize

                  4KB

                • memory/936-262-0x00000138EC4C0000-0x00000138EC4C1000-memory.dmp

                  Filesize

                  4KB

                • memory/936-230-0x00000138EC760000-0x00000138EC761000-memory.dmp

                  Filesize

                  4KB

                • memory/936-261-0x00000138EC4C0000-0x00000138EC4C1000-memory.dmp

                  Filesize

                  4KB

                • memory/936-259-0x00000138EC4B0000-0x00000138EC4B1000-memory.dmp

                  Filesize

                  4KB

                • memory/936-231-0x00000138EC760000-0x00000138EC761000-memory.dmp

                  Filesize

                  4KB

                • memory/936-247-0x00000138EC2B0000-0x00000138EC2B1000-memory.dmp

                  Filesize

                  4KB

                • memory/936-232-0x00000138EC760000-0x00000138EC761000-memory.dmp

                  Filesize

                  4KB

                • memory/936-244-0x00000138EC370000-0x00000138EC371000-memory.dmp

                  Filesize

                  4KB

                • memory/936-195-0x00000138E4040000-0x00000138E4050000-memory.dmp

                  Filesize

                  64KB

                • memory/936-211-0x00000138E4140000-0x00000138E4150000-memory.dmp

                  Filesize

                  64KB

                • memory/936-227-0x00000138EC730000-0x00000138EC731000-memory.dmp

                  Filesize

                  4KB

                • memory/936-228-0x00000138EC760000-0x00000138EC761000-memory.dmp

                  Filesize

                  4KB

                • memory/936-229-0x00000138EC760000-0x00000138EC761000-memory.dmp

                  Filesize

                  4KB

                • memory/936-241-0x00000138EC380000-0x00000138EC381000-memory.dmp

                  Filesize

                  4KB

                • memory/936-237-0x00000138EC760000-0x00000138EC761000-memory.dmp

                  Filesize

                  4KB

                • memory/936-236-0x00000138EC760000-0x00000138EC761000-memory.dmp

                  Filesize

                  4KB

                • memory/936-233-0x00000138EC760000-0x00000138EC761000-memory.dmp

                  Filesize

                  4KB

                • memory/936-234-0x00000138EC760000-0x00000138EC761000-memory.dmp

                  Filesize

                  4KB

                • memory/936-235-0x00000138EC760000-0x00000138EC761000-memory.dmp

                  Filesize

                  4KB

                • memory/1704-169-0x0000000005650000-0x0000000005662000-memory.dmp

                  Filesize

                  72KB

                • memory/1704-163-0x00000000050F0000-0x0000000005100000-memory.dmp

                  Filesize

                  64KB

                • memory/1704-0-0x0000000000740000-0x0000000000772000-memory.dmp

                  Filesize

                  200KB

                • memory/1704-3-0x0000000005270000-0x00000000052D6000-memory.dmp

                  Filesize

                  408KB

                • memory/1704-157-0x00000000066E0000-0x0000000006C84000-memory.dmp

                  Filesize

                  5.6MB

                • memory/1704-194-0x00000000050F0000-0x0000000005100000-memory.dmp

                  Filesize

                  64KB

                • memory/1704-2-0x00000000050F0000-0x0000000005100000-memory.dmp

                  Filesize

                  64KB

                • memory/1704-1-0x0000000075110000-0x00000000758C0000-memory.dmp

                  Filesize

                  7.7MB

                • memory/1704-162-0x00000000061B0000-0x00000000061BA000-memory.dmp

                  Filesize

                  40KB

                • memory/1704-161-0x0000000075110000-0x00000000758C0000-memory.dmp

                  Filesize

                  7.7MB

                • memory/1704-156-0x0000000006090000-0x0000000006122000-memory.dmp

                  Filesize

                  584KB

                • memory/1704-154-0x00000000050F0000-0x0000000005100000-memory.dmp

                  Filesize

                  64KB