Analysis

  • max time kernel
    144s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240419-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29-04-2024 12:08

General

  • Target

    ser.exe

  • Size

    477KB

  • MD5

    3fecaea34d8bfd0c53d453ba377f5515

  • SHA1

    a8909056a93d5c01d5b4f7079603559ef33ee199

  • SHA256

    fb5035e26f908cf1de308fdac8db6fb751ac69357b9ab2445fdaf1765c86b366

  • SHA512

    e92f474d4a7a6afa20ce5995cabe14c3442cf9a868269e528fb041dff712eeaa6eda56806126bd3efbb9d1f0719f18b50610bec2eae869d70e8186736f1aeeaf

  • SSDEEP

    6144:1fkZ3FM+Z6Q/8CqyRr/b0AxouMu3JQ04+S6JutalHVDvG1FhNoX9w:1fkZVfD/LUAoutIUJPHxv2rNY

Malware Config

Extracted

Family

asyncrat

Botnet

Default

C2

127.0.0.1:6606

127.0.0.1:7707

127.0.0.1:8808

https://api.telegram.org/bot6792184664:AAGxPEwztsvs2oQ0e1vEY9lLZzPUDNJZYS8/sendMessage?chat_id=5918227737

Mutex

AsyncMutex_6SI8OkPnk

Attributes
  • delay

    3

  • install

    false

  • install_folder

    %AppData%

aes.plain

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

  • StormKitty

    StormKitty is an open source info stealer written in C#.

  • StormKitty payload 1 IoCs
  • Async RAT payload 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Drops desktop.ini file(s) 8 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Looks up geolocation information via web service

    Uses a legitimate geolocation service to find the infected system's geolocation info.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 25 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ser.exe
    "C:\Users\Admin\AppData\Local\Temp\ser.exe"
    1⤵
    • Drops desktop.ini file(s)
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2864
    • C:\Windows\SYSTEM32\notepad.exe
      notepad.exe
      2⤵
        PID:4900
      • C:\Windows\SYSTEM32\cmd.exe
        "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:2036
        • C:\Windows\system32\chcp.com
          chcp 65001
          3⤵
            PID:3496
          • C:\Windows\system32\netsh.exe
            netsh wlan show profile
            3⤵
              PID:1864
            • C:\Windows\system32\findstr.exe
              findstr All
              3⤵
                PID:1816
            • C:\Windows\SYSTEM32\cmd.exe
              "cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:4684
              • C:\Windows\system32\chcp.com
                chcp 65001
                3⤵
                  PID:8
                • C:\Windows\system32\netsh.exe
                  netsh wlan show networks mode=bssid
                  3⤵
                    PID:1576

              Network

              MITRE ATT&CK Matrix ATT&CK v13

              Credential Access

              Unsecured Credentials

              1
              T1552

              Credentials In Files

              1
              T1552.001

              Discovery

              Query Registry

              1
              T1012

              System Information Discovery

              1
              T1082

              Collection

              Data from Local System

              1
              T1005

              Command and Control

              Web Service

              1
              T1102

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\4bd7d84de8e2478a58846a04673b779c\Admin@LFKTDJGL_en-US\System\Process.txt
                Filesize

                2KB

                MD5

                8367a76ebcc00955f36276f0856024a8

                SHA1

                b06a9b64a6b31ce7aa87e10a7ca438322311e08d

                SHA256

                6c016cc75bb60da1ec5f81bde5d0560bacf924bad8c26c6ded10bab3cb9dfc7a

                SHA512

                bfd8b81718354585145983855ca0e4d706f0c3ddf32cb578464cfcb6c8c5c8f111dbe1f2cf302c3a62bce938be127c7680d9496717519a9f645d2abbf6adbc49

              • C:\Users\Admin\AppData\Local\4bd7d84de8e2478a58846a04673b779c\Admin@LFKTDJGL_en-US\System\Process.txt
                Filesize

                4KB

                MD5

                b613b2356a8b1d1c4f1dd8088f40f273

                SHA1

                cfe35e7d4d09ff154f36999ee0cbeecb54aad928

                SHA256

                4e24935f9b2ae85c7db2951150c68adfaffbaccee15f5190ebb56fef5e65ffce

                SHA512

                273ca8fc76ea066f16a0961e6a3b763215ea96c4077bd132e22a96edc40947fcb886ca376f7ed0fe7da567b3425e522593a8c06b08f380d1b897865076a1d701

              • C:\Users\Admin\AppData\Local\4bd7d84de8e2478a58846a04673b779c\Admin@LFKTDJGL_en-US\System\Process.txt
                Filesize

                527B

                MD5

                bd21a164e49e285d5af348e3ccf1e938

                SHA1

                1d11a25ed613c74a03c0a0a793d324a0c6e225d4

                SHA256

                ca43e5d89e4dc66d04682df25fb031f823c8ce070d20151f75e908385ca119d1

                SHA512

                b7a90dfb806de54110b25c08f0fa76d9de9e937cdbcc95ccb2dcc5e574ec4319b7b2e62bc18eddba089758b4b2e74f228a79d8d509fe5e3fdbdfd7f3025181e0

              • C:\Users\Admin\AppData\Local\4bd7d84de8e2478a58846a04673b779c\Admin@LFKTDJGL_en-US\System\Process.txt
                Filesize

                1KB

                MD5

                f928e0e7081b55f0196ae4543ebdca88

                SHA1

                575462c688a66c890ee0508a36ec433928c6a1ff

                SHA256

                45630f91493a51e37db10f3a85ba188199bb7fb67298867c34075bcdd60e1e08

                SHA512

                6ff5801736fc5ac91af0eacc51666b6008b68f3bc2cc437db19ab13bfd65cc5d7b7c1f56553f33178e6b9c74eb24cf325958fdf18520aed5c393867df1cdb3ac

              • C:\Users\Admin\AppData\Local\655a0eca073de928e8f00fce0a3f3d95\msgid.dat
                Filesize

                1B

                MD5

                cfcd208495d565ef66e7dff9f98764da

                SHA1

                b6589fc6ab0dc82cf12099d1c2d40ab994e8410c

                SHA256

                5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9

                SHA512

                31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99

              • memory/2864-6-0x000001EFC0B70000-0x000001EFC0B80000-memory.dmp
                Filesize

                64KB

              • memory/2864-161-0x000001EFC1FE0000-0x000001EFC1FEA000-memory.dmp
                Filesize

                40KB

              • memory/2864-2-0x000001EFA8020000-0x000001EFA8056000-memory.dmp
                Filesize

                216KB

              • memory/2864-4-0x00007FFE308D0000-0x00007FFE31391000-memory.dmp
                Filesize

                10.8MB

              • memory/2864-3-0x000001EFA81C0000-0x000001EFA81F2000-memory.dmp
                Filesize

                200KB

              • memory/2864-156-0x000001EFC0B70000-0x000001EFC0B80000-memory.dmp
                Filesize

                64KB

              • memory/2864-157-0x000001EFC0B70000-0x000001EFC0B80000-memory.dmp
                Filesize

                64KB

              • memory/2864-5-0x000001EFC0B70000-0x000001EFC0B80000-memory.dmp
                Filesize

                64KB

              • memory/2864-0-0x00007FFE4EC50000-0x00007FFE4EE45000-memory.dmp
                Filesize

                2.0MB

              • memory/2864-167-0x000001EFC2010000-0x000001EFC2022000-memory.dmp
                Filesize

                72KB

              • memory/2864-190-0x00007FFE308D0000-0x00007FFE31391000-memory.dmp
                Filesize

                10.8MB

              • memory/2864-193-0x000001EFC0B70000-0x000001EFC0B80000-memory.dmp
                Filesize

                64KB

              • memory/2864-194-0x000001EFC0B70000-0x000001EFC0B80000-memory.dmp
                Filesize

                64KB

              • memory/2864-195-0x000001EFC0B70000-0x000001EFC0B80000-memory.dmp
                Filesize

                64KB