Analysis
- max time kernel
148s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20240412-en - resource tags
- submitted
14/04/2024, 07:28
General
- Target 78f7efed48c531657b84cd66911c7eef.exe
- Size 605KB
- Sample240414-janbkshg8s
- SHA256 40ba4a68575cda8b4da56ef2efae3f3c217bf7b78d68c29086e86d324d3ebffa
Malware Config
Extracted
-
asyncrat
-
Default
-
127.0.0.1:6606
-
127.0.0.1:7707
-
127.0.0.1:8808
-
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
false
-
install_folder
%AppData%
Signatures
- AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
- Quasar RAT 3 IoCs
Quasar is an open source Remote Access Tool.
- StormKitty
StormKitty is an open source info stealer written in C#.
- StormKitty payload 2 IoCs
- Async RAT payload 1 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 3 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops desktop.ini file(s) 8 IoCs
- Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 23 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 32 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\78f7efed48c531657b84cd66911c7eef.exe"C:\Users\Admin\AppData\Local\Temp\78f7efed48c531657b84cd66911c7eef.exe"1⤵
- Quasar RAT
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Orifaaywu.exe"C:\Users\Admin\AppData\Local\Temp\Orifaaywu.exe"2⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\chcp.comchcp 650014⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile4⤵
-
-
C:\Windows\SysWOW64\findstr.exefindstr All4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\chcp.comchcp 650014⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Vqmqsfffubp.exe"C:\Users\Admin\AppData\Local\Temp\Vqmqsfffubp.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Spotify" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\Vqmqsfffubp.exe" /rl HIGHEST /f3⤵
- Creates scheduled task(s)
-
-
C:\Users\Admin\AppData\Roaming\SpotifyClient\Spotify.exe"C:\Users\Admin\AppData\Roaming\SpotifyClient\Spotify.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Spotify" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SpotifyClient\Spotify.exe" /rl HIGHEST /f4⤵
- Creates scheduled task(s)
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
Process.txt
msgid.dat
Orifaaywu.exe
Vqmqsfffubp.exe
memory/3016-193-0x00000000068F0000-0x0000000006E94000-memory.dmp
memory/3016-192-0x00000000062A0000-0x0000000006332000-memory.dmp
memory/3016-204-0x00000000053D0000-0x00000000053E0000-memory.dmp
memory/3016-197-0x00000000065B0000-0x00000000065BA000-memory.dmp
memory/3016-190-0x00000000053D0000-0x00000000053E0000-memory.dmp
memory/3016-30-0x0000000000A70000-0x0000000000AA2000-memory.dmp
memory/3016-33-0x00000000053D0000-0x00000000053E0000-memory.dmp
memory/3016-189-0x0000000075100000-0x00000000758B0000-memory.dmp
memory/3016-31-0x0000000075100000-0x00000000758B0000-memory.dmp
memory/3016-45-0x0000000005450000-0x00000000054B6000-memory.dmp
memory/3520-26-0x00007FFB429E0000-0x00007FFB434A1000-memory.dmp
memory/3520-2-0x0000000002470000-0x0000000002480000-memory.dmp
memory/3520-0-0x0000000000350000-0x00000000003EC000-memory.dmp
memory/3520-1-0x00007FFB429E0000-0x00007FFB434A1000-memory.dmp
memory/3984-28-0x0000000000F10000-0x0000000000F18000-memory.dmp
memory/3984-41-0x00007FFB429E0000-0x00007FFB434A1000-memory.dmp
memory/3984-35-0x000000001C660000-0x000000001C69C000-memory.dmp
memory/3984-34-0x000000001BA80000-0x000000001BA92000-memory.dmp
memory/3984-32-0x0000000002F80000-0x0000000002F90000-memory.dmp
memory/3984-29-0x000000001B9E0000-0x000000001BA7E000-memory.dmp
memory/3984-27-0x00007FFB429E0000-0x00007FFB434A1000-memory.dmp
memory/4808-43-0x00000000016A0000-0x00000000016B0000-memory.dmp
memory/4808-42-0x00007FFB429E0000-0x00007FFB434A1000-memory.dmp
memory/4808-203-0x00007FFB429E0000-0x00007FFB434A1000-memory.dmp