Analysis

  • max time kernel
    144s
  • max time network
    118s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29-04-2024 11:41

General

  • Target

    ser.exe

  • Size

    477KB

  • MD5

    3fecaea34d8bfd0c53d453ba377f5515

  • SHA1

    a8909056a93d5c01d5b4f7079603559ef33ee199

  • SHA256

    fb5035e26f908cf1de308fdac8db6fb751ac69357b9ab2445fdaf1765c86b366

  • SHA512

    e92f474d4a7a6afa20ce5995cabe14c3442cf9a868269e528fb041dff712eeaa6eda56806126bd3efbb9d1f0719f18b50610bec2eae869d70e8186736f1aeeaf

  • SSDEEP

    6144:1fkZ3FM+Z6Q/8CqyRr/b0AxouMu3JQ04+S6JutalHVDvG1FhNoX9w:1fkZVfD/LUAoutIUJPHxv2rNY

Malware Config

Extracted

Family

asyncrat

Botnet

Default

C2

127.0.0.1:6606

127.0.0.1:7707

127.0.0.1:8808

https://api.telegram.org/bot6792184664:AAGxPEwztsvs2oQ0e1vEY9lLZzPUDNJZYS8/sendMessage?chat_id=5918227737

Mutex

AsyncMutex_6SI8OkPnk

Attributes
  • delay

    3

  • install

    false

  • install_folder

    %AppData%

aes.plain

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

  • StormKitty

    StormKitty is an open source info stealer written in C#.

  • StormKitty payload 1 IoCs
  • Async RAT payload 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Drops desktop.ini file(s) 8 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Looks up geolocation information via web service

    Uses a legitimate geolocation service to find the infected system's geolocation info.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 21 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ser.exe
    "C:\Users\Admin\AppData\Local\Temp\ser.exe"
    1⤵
    • Drops desktop.ini file(s)
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4344
    • C:\Windows\SYSTEM32\notepad.exe
      notepad.exe
      2⤵
        PID:404
      • C:\Windows\SYSTEM32\cmd.exe
        "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:1620
        • C:\Windows\system32\chcp.com
          chcp 65001
          3⤵
            PID:3540
          • C:\Windows\system32\netsh.exe
            netsh wlan show profile
            3⤵
              PID:1668
            • C:\Windows\system32\findstr.exe
              findstr All
              3⤵
                PID:2220
            • C:\Windows\SYSTEM32\cmd.exe
              "cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:1780
              • C:\Windows\system32\chcp.com
                chcp 65001
                3⤵
                  PID:2364
                • C:\Windows\system32\netsh.exe
                  netsh wlan show networks mode=bssid
                  3⤵
                    PID:2152

              Network

              MITRE ATT&CK Matrix ATT&CK v13

              Credential Access

              Unsecured Credentials

              1
              T1552

              Credentials In Files

              1
              T1552.001

              Discovery

              Query Registry

              1
              T1012

              System Information Discovery

              1
              T1082

              Collection

              Data from Local System

              1
              T1005

              Command and Control

              Web Service

              1
              T1102

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\3748126a29ea084777d6eafa9295d890\msgid.dat
                Filesize

                1B

                MD5

                cfcd208495d565ef66e7dff9f98764da

                SHA1

                b6589fc6ab0dc82cf12099d1c2d40ab994e8410c

                SHA256

                5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9

                SHA512

                31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99

              • C:\Users\Admin\AppData\Local\c0af4052649db16718fa9a022fee5e86\Admin@RHATQEDQ_en-US\System\Process.txt
                Filesize

                3KB

                MD5

                1929c52790f7df99fafcbbdc9969ade1

                SHA1

                069e6ed73a450f784c5e27744da17ab04c59442f

                SHA256

                dfbddc5dc819569ced0881af26fa52ee6507b5def6dbfc66ade7f67bc1bac2f4

                SHA512

                b31b83510d6dc229e9c8c172cb6a6508a2d660b4d97b3566cab2fd31313d024ac0cbef1aca9c1b424953d6ef562b512746c59d453a643f62a5deec212f7e5d75

              • C:\Users\Admin\AppData\Local\c0af4052649db16718fa9a022fee5e86\Admin@RHATQEDQ_en-US\System\Process.txt
                Filesize

                4KB

                MD5

                7955b6f490fcb9def01bf1c08634e0da

                SHA1

                3e51eb8dfda557ff11f3fed9bb998c5b6e983de1

                SHA256

                9b0a517c953735b3ba735971ee2eb83fa3caefa8dce3ac1b8980b688add90c77

                SHA512

                74a03b055b979624b9ce6c4edf8379a4e8555a1e4b1a26db9f56766273058df54cee914eacc916b32f6fc2b511efab6ebac89b62f2b52de2b67a590a8c9af44f

              • C:\Users\Admin\AppData\Local\c0af4052649db16718fa9a022fee5e86\Admin@RHATQEDQ_en-US\System\Process.txt
                Filesize

                443B

                MD5

                a4854d3b3c736fcdddadb463ac8df5c9

                SHA1

                7893544a1b4c1e2457fbaae7d45b9cb5ff216fe8

                SHA256

                290baf6636ea41fc49829cbc481e0390af6c4f6d4e3a3e3617911aedf86bf4f3

                SHA512

                41fd88c3f02056c418c23be273529fcc33eb3bb110a990c302d749cd86b5addf78e24cd588e9cc8ebd895214968e6131348acc470c05a417b92c56827af7402e

              • C:\Users\Admin\AppData\Local\c0af4052649db16718fa9a022fee5e86\Admin@RHATQEDQ_en-US\System\Process.txt
                Filesize

                1KB

                MD5

                741a60cd5e1f3816dfeaa8edca61df6a

                SHA1

                084f05b3c8cdf316ecc8498cb85aa17abf1497ab

                SHA256

                2847026181bed6041937cd172583b6e602faa1c43dcc8c068b652976dd2614c6

                SHA512

                57e963dac48c65e68f4979048668015ae8dc7a9cff7d8cc667515afc304b5a9ba0743a563de72a11e02e4ef53634540433e29cd6db19ea0795b882449bf7a595

              • memory/4344-148-0x0000029130700000-0x0000029130710000-memory.dmp
                Filesize

                64KB

              • memory/4344-154-0x0000029130750000-0x000002913075A000-memory.dmp
                Filesize

                40KB

              • memory/4344-5-0x0000029130700000-0x0000029130710000-memory.dmp
                Filesize

                64KB

              • memory/4344-4-0x00007FFD30850000-0x00007FFD31311000-memory.dmp
                Filesize

                10.8MB

              • memory/4344-3-0x0000029130640000-0x0000029130672000-memory.dmp
                Filesize

                200KB

              • memory/4344-0-0x00007FFD4E8D0000-0x00007FFD4EAC5000-memory.dmp
                Filesize

                2.0MB

              • memory/4344-150-0x0000029130700000-0x0000029130710000-memory.dmp
                Filesize

                64KB

              • memory/4344-6-0x0000029130700000-0x0000029130710000-memory.dmp
                Filesize

                64KB

              • memory/4344-2-0x0000029130330000-0x0000029130366000-memory.dmp
                Filesize

                216KB

              • memory/4344-160-0x0000029149390000-0x00000291493A2000-memory.dmp
                Filesize

                72KB

              • memory/4344-183-0x00007FFD30850000-0x00007FFD31311000-memory.dmp
                Filesize

                10.8MB

              • memory/4344-186-0x0000029130700000-0x0000029130710000-memory.dmp
                Filesize

                64KB

              • memory/4344-187-0x0000029130700000-0x0000029130710000-memory.dmp
                Filesize

                64KB

              • memory/4344-188-0x0000029130700000-0x0000029130710000-memory.dmp
                Filesize

                64KB

              • memory/4344-189-0x0000029130700000-0x0000029130710000-memory.dmp
                Filesize

                64KB

              • memory/4344-190-0x0000029130700000-0x0000029130710000-memory.dmp
                Filesize

                64KB