Analysis

  • max time kernel
    194s
  • max time network
    210s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240412-en
  • resource tags

    arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    17-04-2024 19:21

General

  • Target

    ess.exe

  • Size

    38KB

  • MD5

    a657e08819360c2d09a02900c1340cc1

  • SHA1

    009c944d9182e96a4d1a67f09dbe2edd0864b068

  • SHA256

    f66d125ed2d2267ac2de3b7290b0abfa9a1b4265d04ed872a4d96888888d5296

  • SHA512

    0ef5ddc58e4d30d4df2200b18ac66671fb223924011854242e0702b89b75c9d1fa54ef88d9a133309f0c20e021ebe1d39a6626172f6e37c73b356f349d4405d9

  • SSDEEP

    768:P5fQwpevonRaGqwhXARyrjJj9HNy6B6SE7NL:P5pa1whXA4x9tJop7NL

Malware Config

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

  • StormKitty

    StormKitty is an open source info stealer written in C#.

  • StormKitty payload 1 IoCs
  • Async RAT payload 2 IoCs
  • Sets file to hidden 1 TTPs 2 IoCs

    Modifies file attributes to stop it showing in Explorer etc.

  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Delays execution with timeout.exe 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 19 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs
  • Views/modifies file attributes 1 TTPs 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ess.exe
    "C:\Users\Admin\AppData\Local\Temp\ess.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:640
    • C:\Windows\System32\attrib.exe
      "C:\Windows\System32\attrib.exe" +s +h "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\woah"
      2⤵
      • Sets file to hidden
      • Views/modifies file attributes
      PID:3400
    • C:\Windows\System32\attrib.exe
      "C:\Windows\System32\attrib.exe" +s +h "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\woah\$77woah.pif"
      2⤵
      • Sets file to hidden
      • Views/modifies file attributes
      PID:2208
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpB21A.tmp.bat""
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:5116
      • C:\Windows\system32\timeout.exe
        timeout 3
        3⤵
        • Delays execution with timeout.exe
        PID:4544
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\woah\$77woah.pif
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\woah\$77woah.pif"
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of AdjustPrivilegeToken
        PID:5556

Network

MITRE ATT&CK Matrix ATT&CK v13

Defense Evasion

Hide Artifacts

2
T1564

Hidden Files and Directories

2
T1564.001

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

System Information Discovery

1
T1082

Collection

Data from Local System

1
T1005

Command and Control

Web Service

1
T1102

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\tmp34D1.tmp.dat
    Filesize

    46KB

    MD5

    8f5942354d3809f865f9767eddf51314

    SHA1

    20be11c0d42fc0cef53931ea9152b55082d1a11e

    SHA256

    776ecf8411b1b0167bea724409ac9d3f8479973df223ecc6e60e3302b3b2b8ea

    SHA512

    fde8dfae8a862cf106b0cb55e02d73e4e4c0527c744c20886681245c8160287f722612a6de9d0046ed1156b1771229c8950b9ac036b39c988d75aa20b7bac218

  • C:\Users\Admin\AppData\Local\Temp\tmp34D2.tmp.dat
    Filesize

    46KB

    MD5

    14ccc9293153deacbb9a20ee8f6ff1b7

    SHA1

    46b4d7b004ff4f1f40ad9f107fe7c7e3abc9a9f3

    SHA256

    3195ce0f7aa2eae2b21c447f264e2bd4e1dc5208353ac72d964a750de9a83511

    SHA512

    916f2178be05dc329461d2739271972238b22052b5935883da31e6c98d2697bd2435c9f6a2d1fcafb4811a1d867c761055532669aac2ea1a3a78c346cdeba765

  • C:\Users\Admin\AppData\Local\Temp\tmpB21A.tmp.bat
    Filesize

    184B

    MD5

    d0e49bce1b17ec0f634be98b1cb99a69

    SHA1

    617625f98f08174038d72b459dde6adb3d6a59b4

    SHA256

    cd8689f3241ea19125da6e3b99f2a6865abc677c6fa8e71b08dec0aea495ae27

    SHA512

    9fca0d14e2efc8c5cc7310ef3f9fc5c4f39c135fb8d2d5a0f6362aed20bc6b348bee57bb409fa1a097f52e542a4d79a9cd05f2e2c97be4e53e26b3be056d0595

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\woah\$77woah.pif
    Filesize

    38KB

    MD5

    a657e08819360c2d09a02900c1340cc1

    SHA1

    009c944d9182e96a4d1a67f09dbe2edd0864b068

    SHA256

    f66d125ed2d2267ac2de3b7290b0abfa9a1b4265d04ed872a4d96888888d5296

    SHA512

    0ef5ddc58e4d30d4df2200b18ac66671fb223924011854242e0702b89b75c9d1fa54ef88d9a133309f0c20e021ebe1d39a6626172f6e37c73b356f349d4405d9

  • memory/640-1-0x00007FFEC3420000-0x00007FFEC3EE2000-memory.dmp
    Filesize

    10.8MB

  • memory/640-2-0x00007FFEC3420000-0x00007FFEC3EE2000-memory.dmp
    Filesize

    10.8MB

  • memory/640-8-0x00007FFEC3420000-0x00007FFEC3EE2000-memory.dmp
    Filesize

    10.8MB

  • memory/640-0-0x0000000000AF0000-0x0000000000B00000-memory.dmp
    Filesize

    64KB

  • memory/5556-12-0x00007FFEC3420000-0x00007FFEC3EE2000-memory.dmp
    Filesize

    10.8MB

  • memory/5556-15-0x00007FFEC3420000-0x00007FFEC3EE2000-memory.dmp
    Filesize

    10.8MB

  • memory/5556-16-0x0000000001830000-0x0000000001840000-memory.dmp
    Filesize

    64KB

  • memory/5556-17-0x0000000001820000-0x000000000182E000-memory.dmp
    Filesize

    56KB

  • memory/5556-20-0x000000001C9D0000-0x000000001C9FA000-memory.dmp
    Filesize

    168KB

  • memory/5556-14-0x000000001CDD0000-0x000000001CDE0000-memory.dmp
    Filesize

    64KB

  • memory/5556-13-0x0000000001830000-0x0000000001840000-memory.dmp
    Filesize

    64KB