Analysis

  • max time kernel
    149s
  • max time network
    146s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    17-04-2024 14:55

General

  • Target

    c6f6a21328d5e291f331c4283fb3d4ed13499a1de87f773734c09ba0ccbd72be.exe

  • Size

    980KB

  • MD5

    f5314596dce7444d09432a391bf7f669

  • SHA1

    b1186e0501078a510ad0a4af1bbefc2f7f9dee5c

  • SHA256

    c6f6a21328d5e291f331c4283fb3d4ed13499a1de87f773734c09ba0ccbd72be

  • SHA512

    0b45253fcaafbd9b5d4d10e8f7a313a46ea99cff8b9455e884db5f378e41578faab769beaddfb8fee81d72c46131cb7e967fe5e421053902ba190dff800e97f8

  • SSDEEP

    24576:3TbBv5rUEFP5eAsXpp3q1BGa6mXcqIAXiAZfzI6u:RBfP5vCAKLAXiAZs

Malware Config

Extracted

Family

asyncrat

Botnet

Default

C2

127.0.0.1:6606

127.0.0.1:7707

127.0.0.1:8808

https://api.telegram.org/bot6889241853:AAHAa8eUBd5h6tWRG0OvgDx7o1_LKQJi-y8/sendMessage?chat_id=6367688286

Mutex

AsyncMutex_6SI8OkPnk

Attributes
  • delay

    3

  • install

    false

  • install_folder

    %AppData%

aes.plain

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

  • StormKitty

    StormKitty is an open source info stealer written in C#.

  • StormKitty payload 4 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Drops desktop.ini file(s) 6 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Looks up geolocation information via web service

    Uses a legitimate geolocation service to find the infected system's geolocation info.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Gathers network information 2 TTPs 2 IoCs

    Uses commandline utility to view network configuration.

  • Suspicious behavior: EnumeratesProcesses 15 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c6f6a21328d5e291f331c4283fb3d4ed13499a1de87f773734c09ba0ccbd72be.exe
    "C:\Users\Admin\AppData\Local\Temp\c6f6a21328d5e291f331c4283fb3d4ed13499a1de87f773734c09ba0ccbd72be.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1400
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\xikg.vbe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2504
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c ipconfig /release
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2796
        • C:\Windows\SysWOW64\ipconfig.exe
          ipconfig /release
          4⤵
          • Gathers network information
          PID:1916
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c swbglvlssx.bmp vcpadlxuao.dat
        3⤵
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:3052
        • C:\Users\Admin\AppData\Local\Temp\RarSFX0\swbglvlssx.bmp
          swbglvlssx.bmp vcpadlxuao.dat
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:1300
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
            5⤵
            • Drops desktop.ini file(s)
            • Checks processor information in registry
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:372
            • C:\Windows\SysWOW64\cmd.exe
              "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:1616
              • C:\Windows\SysWOW64\chcp.com
                chcp 65001
                7⤵
                  PID:2880
                • C:\Windows\SysWOW64\netsh.exe
                  netsh wlan show profile
                  7⤵
                    PID:880
                  • C:\Windows\SysWOW64\findstr.exe
                    findstr All
                    7⤵
                      PID:1112
                  • C:\Windows\SysWOW64\cmd.exe
                    "cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid
                    6⤵
                    • Suspicious use of WriteProcessMemory
                    PID:1752
                    • C:\Windows\SysWOW64\chcp.com
                      chcp 65001
                      7⤵
                        PID:2060
                      • C:\Windows\SysWOW64\netsh.exe
                        netsh wlan show networks mode=bssid
                        7⤵
                          PID:1384
                • C:\Windows\SysWOW64\cmd.exe
                  "C:\Windows\System32\cmd.exe" /c ipconfig /renew
                  3⤵
                  • Suspicious use of WriteProcessMemory
                  PID:2188
                  • C:\Windows\SysWOW64\ipconfig.exe
                    ipconfig /renew
                    4⤵
                    • Gathers network information
                    PID:2668

            Network

            MITRE ATT&CK Matrix ATT&CK v13

            Execution

            Command and Scripting Interpreter

            1
            T1059

            Discovery

            System Information Discovery

            3
            T1082

            Query Registry

            1
            T1012

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
              Filesize

              68KB

              MD5

              29f65ba8e88c063813cc50a4ea544e93

              SHA1

              05a7040d5c127e68c25d81cc51271ffb8bef3568

              SHA256

              1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

              SHA512

              e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

            • C:\Users\Admin\AppData\Local\88aae9043eb411c41390c3c6f32b12ab\msgid.dat
              Filesize

              1B

              MD5

              cfcd208495d565ef66e7dff9f98764da

              SHA1

              b6589fc6ab0dc82cf12099d1c2d40ab994e8410c

              SHA256

              5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9

              SHA512

              31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99

            • C:\Users\Admin\AppData\Local\Temp\Cab4543.tmp
              Filesize

              65KB

              MD5

              ac05d27423a85adc1622c714f2cb6184

              SHA1

              b0fe2b1abddb97837ea0195be70ab2ff14d43198

              SHA256

              c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

              SHA512

              6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

            • C:\Users\Admin\AppData\Local\Temp\RarSFX0\anrpi.3gp
              Filesize

              36KB

              MD5

              406db994bb11c5320a6d2780c8af9419

              SHA1

              10503f33ae662a8eb92dc3198ffc074cc736b24c

              SHA256

              ee4366252ab52d6c079246c14d9407457a91a64065816ac2c26acc2582c41fd2

              SHA512

              1a5e66f74f7112e2e0cdec4d5e997c02656efb0182b1c1aa292437eb711046c3b110a8adb548d603f17d67c764b1aa5f189408050cc6478ad38bcfe238342e72

            • C:\Users\Admin\AppData\Local\Temp\RarSFX0\qwjwmi.lsc
              Filesize

              292KB

              MD5

              042b73b18e96dd8e5848507d7ac60ddc

              SHA1

              cc789c7fca70c7a2cb3666a4c691cfafa74f3cb2

              SHA256

              d5f12fabd9bab67d33cf3e26a325c7f720dc9d58b505605c5b17a2e26b7b7437

              SHA512

              8c9bd44c14960f587abc387fe817be479e02c2b7c503b849d441101f2f248460d0452040f646c1832b19a5690db47b43687250e295835abe7cee4900f0768969

            • C:\Users\Admin\AppData\Local\Temp\RarSFX0\vcpadlxuao.dat
              Filesize

              93.6MB

              MD5

              aa1915f975679c2099d0a9fdacabfd85

              SHA1

              6fa5f8a05ad8b06b4a4464560c669c1067cb8f4a

              SHA256

              48842b595e9dfa512f008c6d77520c4cfdea84c16336a2f1c5003f1964b0d8da

              SHA512

              67b016129ec10111c81f25f922369eaae486437ad6614f5cfb0339e260d29f2e27010f0ec14addd2d7aa8212bfa783740f9989284ee175524da349a1b198ad9b

            • C:\Users\Admin\AppData\Local\Temp\RarSFX0\xikg.vbe
              Filesize

              71KB

              MD5

              5ae9f9fdd5c7d683b7f9f2ea276b2fb7

              SHA1

              a71eed0968de9caf7636a1c81322f27588af0546

              SHA256

              b1b3fd9a4ae874afe1ac1af617d6e7210dfe831a9057bbebdf74f3086f5af8b1

              SHA512

              49343720b71d35fd28d0567b751a01e0d504204845930caa0cec3879f95c056703894e0579fd4d7f75c763f382323b66f259c6a3c1959b26b7a0a44316f50f2b

            • C:\Users\Admin\AppData\Local\Temp\Tar5284.tmp
              Filesize

              177KB

              MD5

              435a9ac180383f9fa094131b173a2f7b

              SHA1

              76944ea657a9db94f9a4bef38f88c46ed4166983

              SHA256

              67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

              SHA512

              1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

            • \Users\Admin\AppData\Local\Temp\RarSFX0\swbglvlssx.bmp
              Filesize

              925KB

              MD5

              0adb9b817f1df7807576c2d7068dd931

              SHA1

              4a1b94a9a5113106f40cd8ea724703734d15f118

              SHA256

              98e4f904f7de1644e519d09371b8afcbbf40ff3bd56d76ce4df48479a4ab884b

              SHA512

              883aa88f2dba4214bb534fbdaf69712127357a3d0f5666667525db3c1fa351598f067068dfc9e7c7a45fed4248d7dca729ba4f75764341e47048429f9ca8846a

            • memory/372-82-0x0000000001170000-0x00000000011A0000-memory.dmp
              Filesize

              192KB

            • memory/372-81-0x0000000001170000-0x0000000002170000-memory.dmp
              Filesize

              16.0MB

            • memory/372-83-0x0000000073100000-0x00000000737EE000-memory.dmp
              Filesize

              6.9MB

            • memory/372-84-0x0000000000D20000-0x0000000000D60000-memory.dmp
              Filesize

              256KB

            • memory/372-179-0x0000000000D20000-0x0000000000D60000-memory.dmp
              Filesize

              256KB

            • memory/372-183-0x0000000073100000-0x00000000737EE000-memory.dmp
              Filesize

              6.9MB

            • memory/372-184-0x0000000000D20000-0x0000000000D60000-memory.dmp
              Filesize

              256KB

            • memory/372-79-0x0000000001170000-0x0000000002170000-memory.dmp
              Filesize

              16.0MB

            • memory/372-77-0x0000000001170000-0x0000000002170000-memory.dmp
              Filesize

              16.0MB

            • memory/372-76-0x000000007EFDE000-0x000000007EFDF000-memory.dmp
              Filesize

              4KB

            • memory/372-74-0x0000000001170000-0x0000000002170000-memory.dmp
              Filesize

              16.0MB

            • memory/372-267-0x0000000000D20000-0x0000000000D60000-memory.dmp
              Filesize

              256KB