Analysis

  • max time kernel
    145s
  • max time network
    49s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240419-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30-04-2024 12:16

General

  • Target

    ser.exe

  • Size

    477KB

  • MD5

    3fecaea34d8bfd0c53d453ba377f5515

  • SHA1

    a8909056a93d5c01d5b4f7079603559ef33ee199

  • SHA256

    fb5035e26f908cf1de308fdac8db6fb751ac69357b9ab2445fdaf1765c86b366

  • SHA512

    e92f474d4a7a6afa20ce5995cabe14c3442cf9a868269e528fb041dff712eeaa6eda56806126bd3efbb9d1f0719f18b50610bec2eae869d70e8186736f1aeeaf

  • SSDEEP

    6144:1fkZ3FM+Z6Q/8CqyRr/b0AxouMu3JQ04+S6JutalHVDvG1FhNoX9w:1fkZVfD/LUAoutIUJPHxv2rNY

Malware Config

Extracted

Family

asyncrat

Botnet

Default

C2

127.0.0.1:6606

127.0.0.1:7707

127.0.0.1:8808

https://api.telegram.org/bot6792184664:AAGxPEwztsvs2oQ0e1vEY9lLZzPUDNJZYS8/sendMessage?chat_id=5918227737

Mutex

AsyncMutex_6SI8OkPnk

Attributes
  • delay

    3

  • install

    false

  • install_folder

    %AppData%

aes.plain

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

  • StormKitty

    StormKitty is an open source info stealer written in C#.

  • StormKitty payload 1 IoCs
  • Async RAT payload 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Drops desktop.ini file(s) 8 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Looks up geolocation information via web service

    Uses a legitimate geolocation service to find the infected system's geolocation info.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 23 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ser.exe
    "C:\Users\Admin\AppData\Local\Temp\ser.exe"
    1⤵
    • Drops desktop.ini file(s)
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:208
    • C:\Windows\SYSTEM32\notepad.exe
      notepad.exe
      2⤵
        PID:4596
      • C:\Windows\SYSTEM32\cmd.exe
        "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:716
        • C:\Windows\system32\chcp.com
          chcp 65001
          3⤵
            PID:4920
          • C:\Windows\system32\netsh.exe
            netsh wlan show profile
            3⤵
              PID:1724
            • C:\Windows\system32\findstr.exe
              findstr All
              3⤵
                PID:1552
            • C:\Windows\SYSTEM32\cmd.exe
              "cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:4260
              • C:\Windows\system32\chcp.com
                chcp 65001
                3⤵
                  PID:1976
                • C:\Windows\system32\netsh.exe
                  netsh wlan show networks mode=bssid
                  3⤵
                    PID:4692

              Network

              MITRE ATT&CK Matrix ATT&CK v13

              Credential Access

              Unsecured Credentials

              1
              T1552

              Credentials In Files

              1
              T1552.001

              Discovery

              Query Registry

              1
              T1012

              System Information Discovery

              1
              T1082

              Collection

              Data from Local System

              1
              T1005

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\1bb289bb8707dff085ac42f2958db7c9\msgid.dat
                Filesize

                1B

                MD5

                cfcd208495d565ef66e7dff9f98764da

                SHA1

                b6589fc6ab0dc82cf12099d1c2d40ab994e8410c

                SHA256

                5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9

                SHA512

                31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99

              • C:\Users\Admin\AppData\Local\3e9692157c7cce905c4243269c8b7ddd\Admin@EXNCLZLI_en-US\System\Process.txt
                Filesize

                2KB

                MD5

                edac7bea578b356f092268bd03b90224

                SHA1

                dee052f636b40bbb18079b98726d703a1dc977d7

                SHA256

                d939c604f6a140aa84d69bf36749d5cc80abc99d03b5e8b716204b808d53e9b0

                SHA512

                e93a2c465458c6fbde834894c67f3a20fcd9625b97dc9f48c326025b3fe81cb14cbe6fbf4d27584c29f709eaf8453f9fa37adf263c2d6ef7c9e35584e397518d

              • C:\Users\Admin\AppData\Local\3e9692157c7cce905c4243269c8b7ddd\Admin@EXNCLZLI_en-US\System\Process.txt
                Filesize

                4KB

                MD5

                267d7ad72bdc3ee36c7276182a3b6d5f

                SHA1

                96d4e46b7a82d5a0623e306cf3eb90b6f23c2831

                SHA256

                834fb324fd139bf70a6c50351830f62378ffd0dfa735f29fd191885a1c669b92

                SHA512

                995e022114f3472e5d07d635065c04ee3f174cc93aacbecb962f1c3813514cfc927173beb71b446e71500f593f0044675f70f9e8ada89ca29831a2b340e8ea7d

              • C:\Users\Admin\AppData\Local\3e9692157c7cce905c4243269c8b7ddd\Admin@EXNCLZLI_en-US\System\Process.txt
                Filesize

                1KB

                MD5

                9e9f1194c20ca288fffee5e28d48902b

                SHA1

                3d53528b3dc023d63820797dc803ba3b9914e6ac

                SHA256

                c89f050b5bb27e5f15874659ad7b2705bd15eab1c4d316adfae3a22ece2b8610

                SHA512

                5bd43a0fd9ab855baf3de5433ce6b2eae83516f463bae31d6b28129147839bc930fb35891dd78d5bd2d3a4e6501faf3d4385102d494246378724571d93448a59

              • memory/208-7-0x0000021623DB0000-0x0000021623DC0000-memory.dmp
                Filesize

                64KB

              • memory/208-154-0x0000021623DB0000-0x0000021623DC0000-memory.dmp
                Filesize

                64KB

              • memory/208-5-0x0000021623DB0000-0x0000021623DC0000-memory.dmp
                Filesize

                64KB

              • memory/208-2-0x0000021623860000-0x0000021623896000-memory.dmp
                Filesize

                216KB

              • memory/208-4-0x00007FFF7DB90000-0x00007FFF7E651000-memory.dmp
                Filesize

                10.8MB

              • memory/208-3-0x00000216239D0000-0x0000021623A02000-memory.dmp
                Filesize

                200KB

              • memory/208-153-0x0000021623DB0000-0x0000021623DC0000-memory.dmp
                Filesize

                64KB

              • memory/208-6-0x0000021623DB0000-0x0000021623DC0000-memory.dmp
                Filesize

                64KB

              • memory/208-158-0x0000021623D60000-0x0000021623D6A000-memory.dmp
                Filesize

                40KB

              • memory/208-159-0x00007FFF7DB90000-0x00007FFF7E651000-memory.dmp
                Filesize

                10.8MB

              • memory/208-160-0x0000021623DB0000-0x0000021623DC0000-memory.dmp
                Filesize

                64KB

              • memory/208-161-0x0000021623DB0000-0x0000021623DC0000-memory.dmp
                Filesize

                64KB

              • memory/208-0-0x00007FFF9BE90000-0x00007FFF9C085000-memory.dmp
                Filesize

                2.0MB

              • memory/208-167-0x0000021623DB0000-0x0000021623DC0000-memory.dmp
                Filesize

                64KB

              • memory/208-168-0x0000021623DB0000-0x0000021623DC0000-memory.dmp
                Filesize

                64KB